Privacy Policy

Data we process

We process account data, organization data and the governance content you enter into the product.

• Account data: name, email address, authentication identifiers and role assignments.
• Organization data: organization name, country, size, industry and membership records.
• Governance content: assessment answers, AI systems, use cases, vendors, risk findings, actions, policies, literacy records and evidence you upload.
• Operational data: audit events recording who performed which governance action and when.

Why we process it

We process this data to deliver the product you purchased: producing readiness scores, generating governance documentation, maintaining version history, and providing an audit trail of governance activity. We also process a minimal amount of data to operate the service securely and to handle billing.

AI processing

Some features send the content you provide to AI models to summarize, explain, draft or structure it. AI processing happens server side. See the AI usage and data processing page for detail on what is sent and what is not.

Tenant isolation and access

Governance data belongs to your organization. Access is restricted to members of that organization and enforced by database authorization rules. Platform administrators do not obtain access to your private evidence content through the normal product interface; any elevated support access is explicit and recorded.

Storage and retention

Evidence files are stored privately and are not publicly enumerable; access uses short-lived signed links. Governance data is retained while your organization is active. Document versions are retained as historical records so that an approved document can always be traced.

Deletion

You can request deletion of your account, or deletion of an entire organization and its governance data, from the account settings area. Organization deletion is performed by an organization owner and removes governance records, documents and evidence, subject to any records we must retain for legal or accounting reasons.

Your rights

Depending on where you are located you may have rights of access, rectification, erasure, restriction, portability and objection. Contact us and we will respond within the applicable statutory period.

Contact

For privacy questions or requests, contact privacy@trustpack.ai. If you believe we have not resolved your concern, you may contact your local supervisory authority.