Privacy policy
How TryTrustable collects, uses, shares and protects personal data, and the rights you have over it under the DPDP Act, the GDPR and US state privacy laws.
Last updated 4 October 2026
Who we are and what this covers
TryTrustable ("we", "us") provides the TryTrustable compliance, security and consent platform, the trytrustable.com website, the TryTrustable SDK and the consent banner our customers place on their own websites and apps. TryTrustable is based in India.
This policy explains what personal data we handle, why, who we share it with, how long we keep it and the rights you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the EU and UK GDPR, and US state privacy laws including the CCPA.
Our two roles. For our website, your account, billing and our own communications, we decide why and how personal data is used, so we are the Data Fiduciary (DPDP) or controller (GDPR). For the data our customers put into the platform, including the consent records of visitors to a customer's website, the customer decides, and we act as their Data Processor or processor under our agreement with them. If you are a visitor to a customer's site or an employee of a customer, contact that organisation first; we will help them answer you.
The personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact | Name, work email, company, job role, sign-in and MFA settings | You, when you sign up, book a demo or contact us |
| Support and correspondence | Messages, call notes, attachments you send us | You |
| Billing | Billing contact, company tax details, plan and invoices. Card details go directly to the payment processor and never reach us | You, and our payment processors once paid checkout is enabled |
| Product usage and security | Actions in the platform and their timestamps, the audit trail, sign-in events, IP address and browser of a session | Generated when you use the platform |
| Website | Pages viewed, referring page, device and browser type; analytics identifiers only if you accept analytics cookies | Your browser, our website host and, with consent, Google Analytics |
| Data from your connected systems | Configuration and user lists from GitHub, AWS, Google Cloud, Okta or Google Workspace, such as staff names, emails, MFA status and admin roles | Integrations a customer connects (we act as processor) |
| SDK findings | A finding with the single code line it points to (credentials redacted), file paths, line numbers; consent discovery sends paths, lines and the matched fragment, never file contents | The SDK running in a customer's own pipeline (processor) |
| Consent records | The choice made, purposes, notice version, language, regime, timestamp and a salted hash prefix of the IP address, never the address itself | The consent banner on a customer's site (processor) |
Cookies and similar technologies
The platform uses one strictly necessary session cookie to keep you signed in, protected against cross-site requests. Our website and the consent banner store your consent choice (trytrustable_consent) and your language so you are not asked again; these are strictly necessary.
Website analytics, only with consent. If you accept analytics cookies, we load Google Analytics 4 to understand which pages are read and how visitors find us. It is not loaded at all until you agree. It sets cookies such as _ga and _ga_*, which last up to two years, and Google may process the data outside your country, including in the United States. We do not use advertising cookies, and we keep analytics event data for no longer than 14 months.
You can change or withdraw your choice at any time from the Cookie settings link in the footer. Withdrawing is as easy as consenting was.
How we use personal data, and on what basis
| Purpose | Basis (GDPR) | Basis (DPDP) |
|---|---|---|
| Provide the platform, your account and support | Contract | Consent given when you sign up, or the s.7(a) voluntary-provision use |
| Keep the service secure: authentication, abuse and fraud prevention, logging | Legitimate interests | Legitimate use and the security duty in s.8(5) |
| Bill for paid plans and keep tax records | Contract and legal obligation | Legal obligation |
| Improve the product from aggregated, de-identified usage | Legitimate interests | Consent, where personal data is involved |
| Website analytics | Consent | Consent |
| Product news and marketing emails | Consent (or legitimate interests for existing customers, with an easy opt-out) | Consent |
| Meet legal obligations, such as CERT-In log retention and responding to authorities | Legal obligation | Legal obligation |
AI and machine learning
We do not use customer data, consent records or your personal data to train AI models, ours or anyone else's.
No AI model provider is connected to the production platform today, so no customer data is sent to one. If we enable an AI-assisted feature, we will list the provider in this policy first, send it only the snippets the feature needs, and let customers switch the feature off.
Where your data is stored
The platform and its database run on Google Cloud in Mumbai, India, for every customer. We are expanding to Singapore, the US and the EU.
Some providers above are outside India, so data reaches them through a transfer. Transfers out of India are permitted under s.16 of the DPDP Act except to countries the Government restricts. For data covered by the EU or UK GDPR, we rely on an adequacy decision where one exists, or on Standard Contractual Clauses with additional safeguards.
How long we keep it
| Data | How long |
|---|---|
| Account data | For the life of the account, then 12 months, unless the law requires longer |
| Customer data in the platform | As the customer configures it; deleted after the 30-day export window that follows termination |
| Consent records | For the period the customer configures, which needs to cover how long they must be able to prove consent |
| Security, access and audit logs | At least one year, as the DPDP Rules require, and longer where an investigation needs it |
| Billing and tax records | As long as tax law requires |
| Website analytics | No more than 14 months |
| Backups | A limited rolling period; deleted data leaves backups as they expire |
How we protect it
- Encryption in transit (TLS) and at rest
- Credentials for connected systems encrypted with AES-256-GCM; integrations read-only by default
- Multi-factor authentication, single sign-on (OIDC) and role-based access in the platform
- Access to production limited to the people who need it, and logged
- A tamper-evident audit trail, and consent records that store a salted hash of the IP, not the address
- Credentials removed from SDK findings before they leave your environment
No system is perfectly secure. If a personal data breach affects you, we tell the affected customers and people without undue delay, and the authorities within the time the law sets: the Data Protection Board of India under the DPDP Rules, CERT-In within six hours for reportable incidents, and the supervisory authority within 72 hours under the GDPR.
Your rights
Under the DPDP Act you can ask for a summary of your personal data and who it was shared with, ask us to correct, complete, update or erase it, withdraw consent, have a grievance answered, and nominate someone to exercise these rights if you die or become unable to.
Under the GDPR and UK GDPR you can ask for access, rectification, erasure, restriction and portability, object to processing based on legitimate interests or for direct marketing, withdraw consent, and complain to your data protection authority.
Under US state laws such as the CCPA you can ask to know, correct and delete your personal data, and to opt out of its sale or sharing, which we do not do. We will not treat you differently for using these rights.
How to ask. Email privacy@trytrustable.com. We may ask you to confirm your identity so we do not disclose your data to someone else, and we answer within 30 days. Where we hold your data for a customer, we pass the request to them and help them answer it.
Make a privacy request
Use this form to ask for a summary of your personal data, to correct or erase it, to withdraw consent, to raise a grievance, or to nominate someone to exercise your rights if you die or become unable to. It goes straight into our request queue, which records when it arrived and when it is due. We reply by email and may ask you to confirm it is you before we disclose or erase anything.
Children
The platform is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@trytrustable.com and we will delete it.
Grievances and contact
Questions, requests and complaints about personal data: privacy@trytrustable.com. Our Grievance Officer and Data Protection Officer can be reached at the same address. We acknowledge a grievance promptly and resolve it within 30 days.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India, or to your data protection authority in the EU or the UK.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your personal data, we tell you by email or in the platform before it takes effect and, where the law requires it, ask for your consent again.