Privacy notice

Trellis Systems, Inc. is a Delaware C corporation with its office at 2201 Broadway, Suite 410, Oakland, CA 94612, United States. We are the controller for the personal data described here.

Reach us at privacy@trelliscore.co for anything on this page.

Account data: your name, email address, an optional company name, and a hash of your password. If you sign in with Google we receive your name, email address and profile image from Google.

Material you submit: the policies, tickets, settings exports and questionnaire answers you paste into a readiness check, and the results produced from them.

Usage data: which pages you visited, when a readiness check ran, how long it took and which model answered. We keep this to run and improve the service.

Support and forms: what you write to us through the contact, help and careers forms.

Billing: if you subscribe, Stripe handles your card. We never see or store card numbers.

• To provide the service you asked for, which is the readiness check and the drafts it produces.
• To keep accounts secure and to enforce plan limits.
• To answer you when you write to us.
• To take payment when you subscribe.
• To meet our own legal and accounting obligations.

Our lawful bases are performance of a contract with you, our legitimate interest in running and securing the service, and consent where you gave it. We do not sell personal data and we do not use it for advertising.

Material you submit for a readiness check is sent to the routed model provider to produce your result. Nothing else is sent.

Your material does not train a model. We use providers under agreements that prohibit training on our API traffic, we do not fine-tune on customer content, and we do not use one customer's material to improve another customer's results.

The current provider list is published on our Security page and we post there before adding to it.

Our subprocessors, listed in full on the Security page: our hosting provider, our model provider and our payment processor. Each receives only what it needs for its part.

Nobody else. We do not share personal data with advertisers, data brokers or analytics networks.

We may disclose data if the law requires it. If that happens and we are permitted to tell you, we will.

Account data: while your account exists, then 30 days.

Material submitted for a readiness check and the results: while the workspace exists. Delete a run and its material goes with it.

Everything, including backups: within 30 days of deleting your workspace.

Billing records: seven years, because accounting rules require it.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, or object to a use. If you are in the EEA or the UK you have these rights under the GDPR. If you are in California you have similar rights under the CCPA, including the right not to be discriminated against for exercising them.

Write to privacy@trelliscore.co and we will answer within 30 days. We will not ask you to justify the request.

We set a small number of first-party cookies that are needed for the product to function: a session cookie, a signed account cookie and a usage meter. There are no advertising or cross-site tracking cookies. The Cookies page lists each one.

TLS in transit, AES-256 at rest, scrypt password hashing with per-account salts, and access to production restricted to the engineers who need it, behind single sign on with a second factor. Fuller detail is on the Security page.

If we change this notice in a way that matters, we will post the new version here and email workspace owners before it takes effect. The date at the top always reflects the current version.