Privacy Policy

Who is responsible for your data

The controller is [legal entity and registered address — to be confirmed]. [Representative in the EU or the UK and a data protection officer, where one is required — to be confirmed.] You can reach us about anything in this policy at support@truffle.space.

Who this policy covers

• Visitors to the public site.
• People who join the waitlist.
• Account holders and the members of their teams.
• Creators whose public profiles appear in the platform.

What we collect

• Account data: name, email address, password hash, chosen language, the teams you belong to, and the security methods you set up.
• Waitlist data: your email address and anything else you choose to tell us in the form.
• Usage data: the pages you open and the actions you take, with timestamps.
• Technical data: IP address, browser and device, and the approximate location derived from the IP address.
• Communications: the messages sent and received through the platform, and the emails you send us.
• Billing data: invoices and the last digits of the card. Card details themselves go straight to the payment provider and never reach our servers.

Creator data

Creator profiles are built from public pages and from the interfaces the platforms provide: handle, public profile, published metrics, language, country, topics, links, and contact details the creator has published themselves.

• The basis is our legitimate interest in running a creator-discovery service, weighed against the fact that the data was published for exactly this kind of contact.
• We do not deliberately collect special-category data, and we do not build profiles about anyone's private life.
• A creator can object, correct their profile or ask to be removed by writing to support@truffle.space, and we act on that.

Why we process it

• To provide the service you signed up for — because we have a contract with you.
• To keep the service secure, prevent abuse and investigate incidents — our legitimate interest.
• To improve the service and decide what to build next — our legitimate interest.
• To answer your enquiries and to tell waitlist subscribers when access opens — your consent, withdrawable at any time.
• To meet accounting, tax and other legal obligations — because the law requires it.

[The legal-basis framework and the wording of consent depend on the applicable jurisdiction — to be confirmed.]

Automated processing and AI

Relevance scoring, cost forecasts and drafted messages are produced by AI models, some of them run by providers on our behalf.

• Your data and your correspondence are not used to train publicly available models.
• Providers process the data under contract, only on our instructions. [The list of AI sub-processors and their terms — to be confirmed.]
• Scoring produces a suggestion, not a decision with a legal effect, and a person can review any of it.

Who we share it with

• Service providers who run the infrastructure for us: hosting, email delivery, analytics, payments and AI. [The list of sub-processors — to be confirmed.]
• Authorities, when the law requires it and to the extent it requires.
• Our advisers, under a duty of confidence.
• A buyer or successor, if the business is sold or merged, with notice to you beforehand.

We do not sell personal data, and we do not share it for third-party advertising.

Where it is stored

Data is stored in [hosting region — to be confirmed]. Where it is transferred outside that region, the transfer relies on [transfer mechanism: adequacy decision, standard contractual clauses or equivalent — to be confirmed].

How long we keep it

• Account data: while the account exists, and [retention period after closure — to be confirmed] afterwards.
• Waitlist data: until access opens or until you withdraw, whichever comes first.
• Correspondence and collaboration history: [retention period — to be confirmed].
• Technical logs: [retention period — to be confirmed].
• Invoices and accounting records: for the period the law requires, [statutory retention period — to be confirmed].

How we protect it

• Traffic is encrypted in transit, and passwords are stored hashed, never in the clear.
• Two-factor authentication and passkeys are available on every account.
• Access to production data is limited to the people who need it to do their work.
• Backups are taken regularly and their restoration is tested.

No service is perfectly secure. If a breach affects you, we notify you and the supervisory authority within [breach notification deadline — to be confirmed].

Your rights

• Ask what data we hold about you and get a copy of it.
• Have it corrected, or deleted.
• Restrict or object to how we process it, including profiling.
• Receive it in a portable format, or have it sent to another provider.
• Withdraw consent at any time, without affecting what was done before.
• Complain to [supervisory authority — to be confirmed].

Write to support@truffle.space. We answer within [response deadline — to be confirmed] and may ask you to confirm who you are before we act.

Cookies

• Essential cookies keep you signed in, protect forms against forgery and remember your language and theme. The service does not work without them.
• We set no advertising cookies and do no cross-site tracking.
• Analytics: [the analytics tool, what it stores and whether consent is required — to be confirmed].

Children

The service is not intended for people under 16, or under the higher age set by local law. We do not knowingly collect their data, and we delete such an account once we learn of it.

Changes to this policy

When this policy changes, the date at the top changes with it. Material changes are announced by email or on the site before they take effect.

Contact

support@truffle.space — access requests, deletion requests, and questions about anything above.