Privacy Policy

This Privacy Policy explains how Trooth, LLC ("Trooth," "we," "us") collects, uses, discloses, and protects personal information when you use our websites, applications, and services (the "Service"). If you use Trooth on behalf of an organization that is our customer, that customer controls the data you process through the Service, and our Data Processing Addendum governs that processing.

1. Information we collect

• Account information: name, work email, company name, and credentials you create.
• Connected-integration data: when you connect a tool, we process the configuration and operational signals we are authorized to read, and we store the access tokens or keys you provide (encrypted at rest). We retrieve only what is needed to witness and map evidence.
• Content you provide: documents, policies, and other material you upload or link.
• Sign-in providers: if you sign in with Google, Microsoft, Apple or GitHub, the provider sends us your name, your email address and an identifier for your account with it. Apple may send a private relay address that forwards to you instead of your own address; we use whichever address it sends. We use these only to sign you in and to reach you about your account. We keep the provider and its identifier for your account, with the address it sent and when you last signed in with it, so that it signs you in to the same Trooth account even when its address differs from yours; you can see and disconnect these under Password and authentication in your settings.
• How you signed in, for that session only: when you sign in through Google, Microsoft or single sign-on, we keep, for that session only, which of them you used and the company domain it confirmed: the Google Workspace domain of your account, the domain of your Microsoft work account, or a domain your single sign-on organization has confirmed. We keep it so that you can use that sign-in to confirm a claim to that domain. It is deleted when the session ends: when you sign out, when the session is revoked, and within an hour after the session expires, 30 days after you signed in. If you use it to confirm a claim, the claim record says that the domain was confirmed by an identity-provider sign-in.
• Answers to "Was this page helpful?": when you answer it under a documentation page, we keep the page, your Yes or No, the note you choose to add and the day. Nothing that identifies you is sent or kept with it. We delete these answers after 12 months.
• Usage and device data: log data, IP address, and browser/device information.
• Cookie choices: the choice you make in the cookie panel, kept in your browser with a random receipt id, and a copy of that choice we keep so we can show it was made. The copy holds no IP address, email or account (Section 10).
• Web analytics, where allowed: page visits counted in aggregate by Vercel Web Analytics and a sample of page-load timings, as the Cookie Policy describes. In the European Economic Area, the United Kingdom and Switzerland they run only with your consent.

Where it comes from. Most of this information comes from you or from your use of the Service. Evidence from a tool comes from the tool you connect. Listings of companies that have not claimed a profile are built from public sources, such as a company's own website, public DNS and certificate records and public filings, as the Trust Profile & Network Terms describe.

What is required. Your name, work email and a credential are needed to create an account; without them we cannot provide one. Everything else you give us is optional, and the Service works without it, with the features that depend on it unavailable.

Trooth does not charge for the service today and collects no payment information. If that changes, this policy and the subprocessor register will be updated first.

2. How we use information

We use information to provide, secure, and improve the Service; to witness and map evidence; to manage accounts, watchlists and alert subscriptions; to send transactional and service messages and alerts; to provide support; to detect, prevent, and address fraud, abuse, and security issues; and to comply with law. We do not sell personal information, and we do not use the content of your connected data for advertising.

We do not train AI models on your data. We do not use your content, your connected-integration data, or your account information to train foundation models, and we do not sell or share it so that others can train on it. Where AI features run inside the Service, they run on your data to produce your result and for no other purpose. The full commitment, including how we handle model providers, is in our AI Policy.

3. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service); our legitimate interests (to secure and improve the Service and prevent abuse); consent (where required, e.g., certain cookies or communications); and compliance with legal obligations.

For web analytics, we rely on your consent in the European Economic Area, the United Kingdom and Switzerland, and on our legitimate interest in understanding how the Website is used elsewhere; you can turn analytics off at any time from Cookie preferences in the Website's footer. We keep a copy of each cookie choice because the law asks us to be able to show that consent was given (GDPR Article 7(1)).

Automated decisions. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. The AI features in the Service draft and explain; a person decides what to do with the result.

We also rely on legitimate interests to publish limited, factual listings for companies in the Trooth Network that have not yet claimed a profile. The interest we are pursuing, the balancing test we carried out, and the free correction and removal routes that go with it are set out in Sections 4, 6, and 7 of the Trust Profile & Network Terms. You can object to that processing at any time.

4. How we share information

We share personal information with: service providers and sub-processors that help us operate the Service (Section 5); third-party services you choose to connect, at your direction; and authorities or others where required by law or to protect rights, safety, and security. In a merger, acquisition, or sale of assets, information may be transferred subject to this Policy. We do not sell or "share" personal information for cross-context behavioral advertising as defined under U.S. state privacy laws.

Slack, when you choose it. If you send status alerts to a Slack channel with Add to Slack, Slack Technologies, LLC receives each incident message we post there and the channel's webhook address, under your own agreement with Slack. The message describes the incident and carries no personal information. Removing the subscription stops delivery, and you can also remove the app in Slack.

Company logos. Where a page shows a company's small logo from its domain, our server asks Google's public favicon service (google.com/s2/favicons) for it, sending only that company's domain, and keeps the image for up to a week. Your browser loads the logo from trooth.co, so Google does not receive your IP address or learn which page you are reading. Integration logos in setup are files on trooth.co. No page loads images from api.iconify.design or cdn.simpleicons.org.

5. Sub-processors and service providers

We use the following sub-processors to deliver the Service:

We require sub-processors to protect personal information consistent with this Policy. The current, complete list of our sub-processors, including the purpose and data location of each, is published at trooth.co/subprocessors and updated whenever it changes.

6. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, then for a reasonable period to comply with legal, tax, accounting, and security obligations, after which we delete or de-identify it. You may request deletion as described below, and you can export your data at any time from your account settings.

The schedule below states the maximum period we keep each category. We often delete sooner, and deleting sooner is always consistent with this schedule.

Where we must keep something longer, for example because of a legal hold, a tax obligation, or an open dispute, we keep only what that obligation requires and delete the rest on the schedule above.

7. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (TLS) and encryption of sensitive stored fields and credentials at rest (AES-256-GCM), least-privilege access, edge isolation, and regular backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. If we confirm a personal-data breach affecting your information, we will notify affected users without undue delay after confirming the breach, and we will notify the relevant supervisory authorities where the law requires it.

8. International transfers

We may process and store information in the United States and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal information, and to withdraw consent at any time, without affecting processing that took place before. EEA/UK residents may lodge a complaint with a supervisory authority. U.S. state residents (for example, in California, Colorado, Connecticut, Virginia or Texas) may have rights to know, access, delete and correct personal information, to obtain a copy in a portable form, and to opt out of sale, sharing, targeted advertising and profiling; we do none of those things, so there is nothing to opt out of. Where you are our customer's user, we may direct your request to that customer.

How to make a request. Email privacy@trooth.co with the subject line "Data Request"; a request sent to hello@trooth.co is accepted too. We will verify your identity before acting on the request, using information we already hold, and respond within the time the law allows: one month under the GDPR and UK GDPR, and 45 days under U.S. state laws, extended only where the law permits and with notice. You may use an authorized agent; we will ask for proof of the agent's authority and may ask you to confirm your identity directly. There is no charge for a request.

Appeals. If we decline your request, you may appeal by replying with the subject line "Appeal". We will answer within 45 days and explain our decision in writing. If your appeal is denied, you may contact your state attorney general.

No discrimination. We will not deny you the Service, charge you a different price or give you a different quality of service because you exercised a privacy right.

Sensitive information. The only sensitive personal information we handle is the credential you use to sign in, and we use it only to authenticate you and keep your account secure. We do not use or disclose sensitive personal information to infer characteristics about you.

Privacy officer. Trooth's privacy officer is responsible for privacy and for answering requests, including as the person in charge of the protection of personal information under Quebec law and as the contact for data protection under Brazil's LGPD. Contact: privacy@trooth.co.

10. Cookies

We use strictly necessary cookies to operate the Service, such as keeping you signed in. Web analytics runs only where allowed: in the European Economic Area, the United Kingdom and Switzerland only after you agree in the cookie panel, and elsewhere by default, with a switch to turn it off in Cookie preferences in the Website's footer. Trooth sets no advertising cookies and does no cross-site tracking. Every cookie we set, what it does and how long it is kept is listed in our Cookie Policy.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control signal, we treat it as a choice to reject all optional cookies and analytics for that browser. Browsers' older "Do Not Track" setting has no agreed meaning, so we do not act on it separately; the Global Privacy Control signal and Cookie preferences give you the same control.

11. Children

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12. Changes and contact

We may update this Policy; material changes will be posted here with a new "Last updated" date. Questions or requests: privacy@trooth.co, Trooth, LLC, 777 Brickell Ave, Suite 500, PMB 1174, Miami, FL 33131, United States.

Document workflows

Three different things are called sharing a document, and Trooth stores different things for each.

Tools that need no account

The public API, the MCP server, the command line and the badge need no account, and that is not the same as sending nothing. Each request sends what you ask about, and your connection sends your IP address and a user agent, as with any web request.

Google user data (Connect Google)

Semanto, part of Trooth, lets a company connect its own Google Merchant Center account and Google Business Profile from the Semanto dashboard. Connecting is optional, and only a workspace owner or admin can do it.

Trooth's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Trooth uses Google user data only to provide the Connect Google features described here. Trooth does not sell it, does not use it for advertising, does not use it to train or improve artificial intelligence models, and no person at Trooth reads it except with your consent for support, for security, or where the law requires it.

You can disconnect at any time in the Semanto dashboard, or remove Trooth's access in your Google Account at myaccount.google.com/permissions. Disconnecting deletes the stored token.

The MCP server uses the IP address to rate-limit tool calls, in memory for about a minute, and writes it nowhere.

Two parts of the MCP server and the A2A agent at api.trooth.co take an OAuth access token issued by our sign-in provider, WorkOS, to a person who has signed in to Trooth: the tool that reads your own workspace's company record, and A2A tasks kept for a token holder. No scope is asked for. The token is checked and then discarded; it is not stored, logged or passed on. When you sign in to trooth.co with enterprise SSO, we record which workspace your WorkOS account belongs to, so the tool can read that workspace and no other. The tool reads your workspace's name, slug and public page address, and its call count records that it ran, never which workspace. A kept A2A task holds the skill's answer under a SHA-256 digest of the token's issuer, subject and client, not the token or your name; it is no longer returned 24 hours after it is made, and it is deleted when the agent next clears expired tasks, which it does at most once an hour while it is in use.

Revision note. Revised September 3, 2026. The billing-information entry previously described a subscription plan and payment records. Trooth takes no payment for access, so the entry now says so. No other collection, use or disclosure was changed, and the correction is recorded under our publication and correction policy.

Revised September 4, 2026: descriptions of retired features (composite figure, plan tiers, TruePass badge, Verified Inquiries) removed; the document now describes the witness record as published. The usage-data entry no longer names push-notification tokens from a mobile app, because Trooth distributes no mobile app and collects none. No collection, use or disclosure was widened.

Revised September 4, 2026: the billing-information category, the billing purpose in Section 2, the payment-processor disclosure in Section 4, the Stripe, Inc. row in Section 5 and the billing-records row in Section 6 were removed. Trooth takes no payment and processes no card data, so none of them described anything that happens. One sentence in Section 1 now records that, and what will happen first if it changes. The Expo (650 Industries, Inc.) row in Section 5 was also removed, because Trooth distributes no mobile application and sends no push notifications. No collection, use or disclosure was widened.

Revision note. Revised September 23, 2026. Dates are written month first. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.

Revision note. Revised September 26, 2026. The retention table listed "security, authentication, and access logs" at 12 months while the retention schedule keeps records of who opened a shared document for 24 months. They are two kinds of record, and the table now lists them separately, with the 24 months the schedule has always applied. The retention schedule is the controlling statement of how long each kind of data is kept and what each deletion action does; this table summarizes it. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.

Revision note. Revised September 26, 2026. A section, Tools that need no account, now says what the command line, the MCP server and the badge send to Trooth and what Trooth keeps. A no-account tool was described elsewhere as sending nothing about you; the command line's check sends the domain you look up. A second new section, Document workflows, says what Trooth stores when a buyer requests a gated document, when a company publishes one, and when a buyer shares a review by link; a statement elsewhere that Trooth never stores documents applies to the first of those only. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.

Revision note. Revised September 27, 2026. This policy now says where the information we hold comes from, which information is required to open an account, how web analytics is governed by region and by consent, that we keep a copy of each cookie choice and for how long, that we make no solely automated decisions with legal effect, how Global Privacy Control and Do Not Track signals are handled, how to appeal a declined request, that authorized agents may make requests, that exercising a right never changes the Service you receive, how sensitive information is used, who the privacy officer is, and the response times the law sets. It names both addresses that accept a data request, which the policy previously gave differently in two places, and the sub-processor table now says that Cloudflare also runs form bot checks and the AI inference behind Kyrie, and that Vercel also provides web analytics where allowed. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised September 28, 2026. The retention table kept copies of cookie choices for as long as they might be needed; it now gives their end, 24 months after the choice, with the page and user agent removed after 90 days, and adds dispute files, whose personal content is removed 24 months after the dispute is resolved, as the Retention Schedule now sets out. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 5, 2026. Since this date one MCP tool, which reads your own workspace's company record, and A2A tasks kept for a token holder accept an OAuth access token from our sign-in provider, with no scope. The section Tools that need no account now says what that token is used for, that it is not kept, that sign-in with enterprise SSO records which workspace your WorkOS account belongs to, and that a kept task is held under a digest of the token's issuer, subject and client for 24 hours. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 6, 2026. The Amazon Web Services row in the sub-processor table now reads as the Sub-processor List does: the cloud beneath the managed database (through Neon), in the United States. It previously named storage and key management in the United States and European Union. No other change.

Revision note. Revised October 7, 2026. Section 1 now says that, when you sign in through Google, Microsoft or single sign-on, we keep, for that session only, which of them you used and the company domain it confirmed, so that you can use that sign-in to confirm a claim to that domain, and that it is deleted when the session ends. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 16, 2026. The Sentry row in the table of service providers read "United States, EU region available". Trooth does not offer to move error tracking to Sentry's EU region, so the row now reads "United States". No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 17, 2026. The sub-processor rows here now read as the Sub-processor List does after its October 17 revision: each purpose in a few words, without internal systems, database engines, cloud regions or backup schedules. No sub-processor was added or removed, no data moved, and no right or obligation was narrowed; the change is recorded under our publication and correction policy.

Revision note. Revised October 21, 2026. Section 1 now names every sign-in provider the Service offers, adding Apple and GitHub beside Google and Microsoft, and says what each sends us and why; Apple and GitHub sign-in were offered before this note and the policy did not name them. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 23, 2026. Section 4 now names two services this Policy did not: Slack, which receives status alerts when you choose to send them to a Slack channel, and Google's favicon service, which our server asks for a company's logo by domain. Until this revision, logo tiles and setup marks loaded from google.com, api.iconify.design and cdn.simpleicons.org in your browser, which gave those services your IP address; they are now served from trooth.co. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 23, 2026. Section 4 now says that when you sign in with Google, Microsoft, Apple or GitHub, or connect one of them in your settings, we keep the provider and its identifier for your account so that it signs you in to the same Trooth account, and that you can see and disconnect it. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.

Revision note. Revised October 23, 2026. Section 4 now describes the answers to "Was this page helpful?" under documentation pages: the page, the answer, an optional note and the day, with nothing that identifies the reader, deleted after 12 months. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.