Privacy Policy

Controller: Robert Vizitiu, a sole trader based in the United Kingdom.

Registered address: Greenwood, Sandycroft Road, Gloucester GL3 1JQ, United Kingdom.

Privacy contact: privacy@truelink365.com.

This policy covers the TrueLink 365 marketing site and the client portal. It does not cover our clients' own websites, except for the AI Assistant chat widget and lead forms we operate on them, which are addressed in section 4. Third-party sites we link to have their own policies.

Account and workspace data you give us:

• —Your name, email address, and (optionally) phone number
• —Your business or brand name, industry, website domain, time zone, and language preferences
• —A password, which is stored only as a salted hash — we never see the plaintext
• —If you sign in with Google, your Google account email and basic profile

Billing data:

• —Payments are processed by Stripe. Card numbers are entered directly into Stripe and are never received or stored by us.
• —We store your Stripe customer and subscription identifiers, plan, status, billing address, and invoice history.

Content you provide to run the Service:

• —Knowledge-base sources for the Assistant (page URLs and text you paste)
• —Assistant configuration, follow-up email templates, and project or brief details

Data the Service generates:

• —Chat transcripts, captured leads, bookings, and email send logs
• —Usage counters and an internal event log for support and security

Technical data:

• —IP address, browser and device information, and pages requested
• —Strictly necessary cookies for sign-in sessions and security (see section 6)
• —Server and error logs

Communications: messages you send us by email or through the support form, and our replies.

When you enable the Assistant or lead capture on your site, your visitors' messages and form submissions are processed to generate replies, capture leads, and book meetings. We do this as a processor acting on your documented instructions.

• —Visitor messages are sent to our AI provider (Anthropic) to generate a response, and are stored so you can review conversations in your portal.
• —Visitor and lead data is not used to train AI models.
• —You are the controller for this data. You are responsible for telling your visitors that the chat is AI-powered and that messages are logged, and for obtaining any consent your local law requires.
• —Our processing terms for this data are set out in the Data Processing Addendum.

• —To provide, maintain, and secure the Service and your account — performance of our contract with you.
• —To process payments and keep tax and accounting records — performance of the contract and compliance with a legal obligation.
• —To prevent fraud and abuse, debug problems, and protect the Service — our legitimate interests.
• —To send service and transactional messages (billing, security, changes to the Service) — performance of the contract and our legitimate interests.
• —To send product or marketing email, where we do — your consent, which you can withdraw at any time via the unsubscribe link.
• —To comply with law and respond to lawful requests — compliance with a legal obligation.

We use only strictly necessary cookies: a session cookie to keep you signed in and a token to protect forms against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

For basic traffic statistics we run our own privacy-friendly analytics: it records the page visited, the referring site, an approximate country, and a device type. It sets no cookies, does not store your IP address, and uses only a salted daily hash that cannot be linked back to you or across days.

We share personal data only with vendors that make the Service work, and never sell it. Our current sub-processors are:

• —Vercel Inc. — Application hosting, CDN, and serverless compute (United States (EU function region: London)).
• —Neon Inc. — Managed PostgreSQL database (European Union — AWS eu-west-2 (London)).
• —Stripe, Inc. — Payment processing and subscription billing (United States).
• —Resend (Plus Five Five, Inc.) — Transactional and notification email delivery (United States).
• —Anthropic, PBC — Large language model that powers the AI Assistant (United States).
• —Voyage AI (MongoDB, Inc.) — Text embeddings for knowledge-base search (United States).
• —Google LLC — Google Sign-In and Google Calendar booking — only if you choose to connect them (United States).

The full list with the data involved is at /legal/subprocessors. We may also disclose data to comply with law, enforce our terms, or in connection with a merger or sale of the business, in which case we will notify you.

Some sub-processors are located in the United States. Where we transfer personal data out of the EEA or the UK, we rely on the transfer safeguards offered by those providers, such as the European Commission's Standard Contractual Clauses and the providers' data processing agreements.

• —Account and workspace data: for as long as your account is open, and up to 90 days after closure, unless a longer period is legally required.
• —Chat transcripts, leads, and bookings: until you delete them or close your account. You control this from the portal.
• —Billing and tax records: retained for the period required by applicable tax law (typically 5–7 years).
• —Backups: rotate out on a rolling basis, within 90 days.
• —Server and security logs: up to 90 days, longer only if needed to investigate an incident.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. If you are in California, you may request to know, delete, or correct your personal information and are entitled to non-discrimination for exercising these rights; we do not sell or share personal information as those terms are defined by California law.

To exercise any right, email privacy@truelink365.com. We respond within the time your law allows (30 days under the GDPR, 45 days under California law, each extendable where permitted). If we process data about you on behalf of one of our clients, we will refer your request to that client. You also have the right to complain to your data protection supervisory authority.

We use encryption in transit, store passwords only as salted hashes, restrict internal access on a need-to-know basis, and host with reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Service is for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

We may update this policy. When we do, we will change the version and effective date at the top. For material changes we will give notice by email or in the portal before they take effect.

Questions about this policy or your data: privacy@truelink365.com, or write to us at Greenwood, Sandycroft Road, Gloucester GL3 1JQ, United Kingdom.