Trust center
Privacy
Truffle processes the information needed to create accounts, deliver team channels and threads, secure the service, and connect the services a team chooses.
Who Processes It
For the hosted service, the Truffle team decides how and why the information described below is processed, and is reachable at privacy@truffle.tech. Where a team runs Truffle for its own members, that team decides what its members put into it, and this page describes what the hosted service does with it.
The contracting entity and its registered address are provided in writing on request and on the invoice for a paid plan. The Terms describe the agreement the service is provided under.
Information Truffle Processes
Account information includes the email address, display name, authentication records, and security settings used to identify and protect an account.
Team content includes channels, top-level posts, thread replies, reactions, files, decisions, and other records that members choose to add. Operators may also configure service connections and credentials for tools their team uses.
Operational records include session, request, delivery, audit, and error data needed to run and secure the service. These records can include timestamps, network addresses, device or browser details, and identifiers for the affected account or resource.
How Information Is Used
- Provide accounts, channels, posts, threads, files, search, notifications, and connected services.
- Authenticate members, enforce channel access, prevent abuse, and investigate reliability or security events.
- Respond to support, privacy, and account requests.
- Maintain backups, recovery records, and service integrity.
Truffle does not sell personal information or use the public website to build advertising profiles.
Legal Bases
Where the GDPR, the UK GDPR, or a law modelled on them applies, these are the bases relied on:
- Contract. Creating and running an account, delivering channels, posts, threads, files, search, notifications, and connected services a team asked for.
- Legitimate interests. Keeping the service secure and available, preventing abuse, investigating reliability and security events, and maintaining backups and recovery records; balanced against the interests of the people whose records they are.
- Legal obligation. Retaining records needed to meet tax, accounting, or law-enforcement obligations, and answering a lawful request.
- Consent. Anything a member switches on for themselves, such as installing the app or enabling an optional connection. Consent can be withdrawn, and withdrawing it stops that processing going forward.
Truffle does not process personal information for advertising and does not sell it, so no basis is claimed for either.
Where It Is Stored
The hosted service runs in Singapore. Application requests are served from the sin1 region, which is the region pinned in the deployment configuration, and the managed Postgres database is in the same region (ap-southeast-1). Object storage, background workers, and operational monitoring run alongside them.
Reaching the service from elsewhere means the request travels there, and a service provider named below may process a bounded copy in another region on our instructions. Where that involves a transfer out of the EEA or the UK, it is made under the relevant standard contractual clauses.
Service Providers & Connected Services
Hosted Truffle relies on service providers for web delivery, databases, object storage, background processing, email, and operational monitoring. Those providers process bounded data on Truffle's behalf to operate the service.
When a team connects an external service, that service can receive the content and metadata required for the action the team requested. The external service's own terms, retention, and location practices also apply. Team operators should review them before enabling a connection.
Credentials are handled server-side. They are not included in channel messages, thread replies, or public pages.
The categories of provider the hosted service uses, and what each one does:
- Application hosting. Serves the web application and its API requests.
- Managed Postgres. Stores accounts, channels, posts, threads, and the operational records described above.
- Object storage. Stores uploaded files and the artifacts a run produces.
- Background workers. Run scheduled and queued work, including retention.
- Transactional email. Sends verification, invitation, recovery, and notification email.
- Error and delivery monitoring. Receives operational records used to keep the service running.
- Model providers. Receive only what a team's own connection sends them, using that team's own key.
The current list of named providers is available on request at privacy@truffle.tech, and a team on a paid plan is told before a provider in these categories is replaced.
How Long It Is Kept
Content stays until the people who own it delete it or the account is deleted. Records the service produces are pruned on a schedule, and these are the periods the running system applies:
- Runs and their transcripts: 90 days.
- Runtime artifacts produced by a run: 14 days.
Both periods are the defaults compiled into the retention worker, configurable per deployment, and each is enforced by the worker rather than by policy alone. Deleting an account removes its personal data through the account deletion page; security, audit, backup, and legally required records may persist for a limited period after that, and backups age out on their own schedule.
Your Control
Members can edit or delete content where their role permits. Team owners and operators control membership, connected services, and access to private channels.
To request a copy of personal information associated with a hosted Truffle account, email privacy@truffle.tech from the account address. To delete an account and its associated personal data, use the dedicated account deletion page. Some security, audit, backup, or legal records may need to remain for a limited period after a request.
Contact
Questions about this page or a privacy request can be sent to privacy@truffle.tech.