TrustedApp Privacy Policy

Controller (most of the time). We act as an independent controller for account data, profiles, usage logs, product communications, payments and payouts administration, safety/abuse prevention, and analytics.

Processor / joint controller (some research). When a Provider commissions interviews/calls/surveys and we process Expert deliverables to fulfill that engagement, we may act as a processor (or joint controller) for that narrow purpose under our Data Processing Addendum (DPA) (available on request).

If anything here conflicts with a signed DPA, the DPA governs for processor-mode activities.

Account & Auth. Name, email, password hash, role (Expert/Provider), and optional SSO identifiers (e.g., LinkedIn, Google if enabled).

Profile. Title, company, bio, skills/domain expertise, location region, LinkedIn URL, profile photo.

Verification. Phone number for OTP; LinkedIn URL for profile verification; payout/KYC data handled by our payments partner (we don't store full card/bank numbers).

Transactions. Bookings, invoices, payout status, tax/VAT IDs (where applicable).

Usage & Device. IP address, approximate location, device/browser type, timestamps, feature interactions, logs.

Session Content (optional). Call recordings, transcripts, notes, surveys, attachments you submit.

Marketing (optional). UTM parameters, email engagement if you opt in.

Sources. You; your device; Providers; public sources; integrated services you connect (e.g., LinkedIn OAuth); optional business enrichment.

We do not intentionally collect sensitive categories such as precise geolocation, health data, or government IDs unless required for compliance by a payments/KYC provider.

Provide the Services. Account creation, authentication, matching, scheduling, payments/payouts, and support. (Contract; Legitimate interests.)

Safety & integrity. Prevent abuse, fraud, spam; secure accounts and infrastructure. (Legitimate interests; Legal obligation.)

Automated matching (AI). We use LLM-assisted ranking to help Providers discover relevant Experts. Providers make final selections. You may opt out of AI ranking (manual matching may be slower). (Legitimate interests; opt-out available.)

Communications. Transactional emails/SMS (e.g., OTP, receipts, policy updates) and product updates if you subscribe. (Contract; Consent.)

Improvement & analytics. Diagnose performance, enhance accuracy, and improve workflows. We train internal models on aggregate/de-identified data only. We do not use your personal data to train third-party foundation models. (Legitimate interests.)

Compliance. Tax, accounting, auditing, lawful requests, and enforcing terms. (Legal obligation.)

We process your phone number and messaging metadata (timestamps, country/carrier codes, delivery status, error codes) for authentication, fraud prevention, and account-security notifications.

Processor: Twilio (USA/EU regions as configured). We share only what's needed to send and deliver the message.

Content: OTP codes and brief transactional text (e.g., "TrustedApp code 123-456"). We don't use phone numbers for marketing without your separate opt-in.

Retention: We keep phone numbers for your active account and minimal messaging metadata for a limited period to investigate abuse/disputes, then delete or de-identify. (Twilio retains its own logs per its policy.)

Your controls: You can opt out by replying STOP (or disable phone verification where supported). You can also email us to delete your number; note this may disable SMS login.

Legal bases (EEA/UK): contract (account security) and legitimate interests (fraud/abuse prevention).

International transfers: safeguarded by vendor transfer mechanisms (see "International transfers").

Essential (auth, security, payments) — always on.

Analytics (e.g., privacy-centric tools; or Google Analytics if enabled) — to measure usage and improve performance.

Marketing pixels — load only if you opt-in; we honor your choices.

Manage preferences anytime via "Cookie Settings" in the footer. We currently do not respond to DNT signals but respect your in-product cookie choices.

We disclose personal data to service providers under contracts with confidentiality, security, and use restrictions. Typical processors include:

Legal & safety. We may disclose data to comply with law, protect rights/safety, or in a merger/acquisition.

Sub-processors page. We maintain a current list at /subprocessors (or will provide it by email if the page is not yet live).

AI matching opt-out. Ask us to exclude your profile from LLM-assisted ranking.

Email preferences. Unsubscribe links are included in non-essential emails.

Cookie controls. Use "Cookie Settings" in the footer to turn analytics/marketing on/off.

"Do Not Sell or Share." Use the footer link to opt out of cross-context behavioral advertising (if any non-essential pixels are enabled).

Depending on where you live, you may have rights to access, correct, delete, restrict/object to certain processing, and port your data.

California (CPRA) & other U.S. states. You may request to know, access, correct, delete, and opt out of sale/share/targeted advertising. We will not discriminate for exercising rights. If we deny your request, you may appeal by replying to our decision email; we'll respond within 45 days.

EEA/UK/Switzerland. You have rights to access, rectification, erasure, restriction/objection, and portability; you may lodge a complaint with your local supervisory authority.

How to exercise rights. Email nate@trustedapp.co with the subject "Privacy Request." We must verify your identity (e.g., email confirmation, logged-in request). You may use an authorized agent per applicable law.

Response times. We aim to respond within 30 days (extendable once if reasonably necessary).

We keep data only as long as needed for the purposes described, then delete or de-identify it.

Account & profile: Active account + 24 months of inactivity

Financial records (invoices, payouts): 7 years (tax/audit)

Recordings & transcripts: 36 months or earlier upon approved request

Security logs & backups: ≤ 30 days (longer if investigating abuse)

Marketing contacts: Until you unsubscribe or 24 months of no engagement

We use industry-standard safeguards: encryption in transit and at rest; least-privilege access; MFA for admin access; audit logging; and periodic security testing and reviews. No method of transmission or storage is 100% secure.

Questions, requests, or complaints: nate@trustedapp.co

Postal: Only Founders, Inc., 380 C Street, Hayward, CA 94541, USA