Privacy Policy

• Account data: email address, display name (if provided), the sign-in method you use (email & password, Google, Apple or X) and a unique account ID. Passwords are handled by Firebase Authentication — we never see or store them. Apple may give us a private relay email; X may give no email at all.
• Profile and plan data: your chosen group (Tester, Builder or Learner), learner level, learning enrolment status, subscription status and Stripe customer/subscription identifiers.
• Work you create: Secure Agent Builder projects and specifications, AI Trust Testing project names, clients and descriptions, and your settings (for example your chosen AI provider and, if you add one, your Agentverse API key, which is stored encrypted).
• Content you submit for analysis: files, images, web-page addresses, text, system prompts, code or API descriptions that you submit to AI content detection or security testing (see section 3).
• Messages: your name, email, topic and message if you use our contact form.
• Usage and technical data: daily usage counters for free-plan limits, security and audit logs (event type, account ID, and for web-page checks the website’s hostname), and the IP address and device information that our hosting provider processes to deliver and protect the service. We do not use advertising trackers or third-party analytics at the time of writing.

• To provide the services you ask for: sign-in, running analyses, saving projects, enrolling you in courses.
• To take payments and manage subscriptions, and to apply plan limits.
• To keep the service secure, prevent abuse and fix problems.
• To answer your messages and send service notices (we do not send marketing email unless you ask for it).
• To meet legal obligations.

We rely on your consent (for example when you create an account or tick the authorisation box before a security analysis), on what is needed to perform our contract with you, and on our legitimate interests in running and securing the service.

Files and text you submit to AI content detection or security testing are processed in memory to produce your result and are not stored on our servers. To produce the result, the content (or extracts of it) is sent to the AI and detection providers we use — see section 4 — which process it under their own terms. We do not use your content to train our own models.

Your detection and security-test history (file name or address, scores, findings and a short text excerpt) is saved in your own browser, not on our servers. Clearing your browser data removes it. Please do not submit content you are not allowed to share, and avoid submitting secrets or personal data of other people unless you need to.

We use trusted service providers (“processors”) and share only what each needs:

• Google Firebase (Google LLC) — authentication and sign-in.
• Apple and X Corp. — only if you choose to sign in with them.
• Supabase (database, hosted on AWS in the Tokyo region) and Vercel (website hosting and delivery).
• Stripe — payments and subscription billing. Card details go directly to Stripe; we never see or store full card numbers.
• Brevo — sends us notification emails about contact-form messages.
• AI and detection providers, depending on configuration: Anthropic, OpenAI, OpenRouter, Groq, Ollama Cloud, Hugging Face and Sightengine — to analyse content you submit.
• EduStream — our learning-platform partner, if you enrol as a Learner (your account ID and level).
• Fetch.ai Agentverse — only if you choose to publish an agent there with your own key.

We do not sell your personal data. We may disclose data if required by law or to protect our rights, users or the public. A limited number of administrators can see account, plan and contact-message data to run the service.

Our providers operate in several countries (including Singapore, Japan, the United States and Europe). When your data is transferred abroad we take steps to make sure it receives a standard of protection comparable to the PDPA, for example through the providers’ contractual commitments.

• Strictly necessary: a secure, HTTP-only sign-in cookie, and Firebase’s sign-in state in your browser.
• Preferences and history: your light/dark theme and your detection and security-test history, kept in your browser’s local storage.

You can clear these at any time in your browser settings; you will be signed out and local history will be lost.

We keep account, profile and project data while your account is active. If you ask us to delete your account, we delete your profile, projects and settings from our database. Payment and tax records may be kept by Stripe and by us for as long as the law requires. In Cost Tracker, usage figures are kept until you delete the entries, disconnect the provider, or delete your account. Contact-form messages are kept until we delete them. Technical logs are kept only for a short period.

In Cost Tracker you can connect AI and API services you use by giving us a key or credential for them, so we can read your usage and spending. We protect those credentials as follows:

• They are encrypted with AES-256 before they are stored.
• Your keys are never shown again — not to you, and not to anyone at TRUST AI (admins included). The only thing you'll see is a short, non-secret hint: the last 4 characters of a key, or a service account's email address.
• They are decrypted only on our server, only for the moment needed to read your usage, and are never sent to your browser or written to logs.
• When you disconnect a service, the encrypted credential is deleted immediately.
• Usage figures are kept until you delete the entries, disconnect the provider, or delete your account.

Disconnecting a provider also deletes that connection’s usage history; a record that the connection existed (provider and dates, no credentials or usage figures) is kept in our security audit log. We recommend using read-only or usage-only keys where the provider offers them. These credentials are used only to read your usage from the service you connected, and for nothing else.

We use encryption in transit (HTTPS), encryption at rest for stored API keys, access controls, rate limiting and server-side verification of every signed-in request. No system is perfectly secure; please use a strong, unique password and tell us promptly if you suspect a problem.

You can ask us to give you access to your personal data, correct it, delete it, or withdraw consent for its use, and (where the GDPR applies) to restrict or object to processing and to receive a portable copy. We will respond within 30 days. You can also change your plan, cancel, and manage settings yourself in Settings. To exercise a right, contact us using the contact form. If you are unhappy with our answer you may complain to the Personal Data Protection Commission (Singapore) or your local data protection authority.

TRUST AI is not for people under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

We may update this policy as the service changes. We will change the “Last updated” date above and, for significant changes, tell you in the app or by email.

Data protection contact: Cedric Mutsu, via the contact form (choose “General enquiry” and mention “privacy”).