This notice explains how the operator of TrustRespond.ai processes personal data under Articles 13 and 14 GDPR.
1. Controller and contact
The operator of TrustRespond.ai is the controller for website, pilot and account administration data. Contact: info@trustrespond.ai. A Data Protection Officer has not been appointed where Article 37 GDPR does not require one. Formal operator details are available in the Impressum.
2. Purposes, data and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Pilot requests and pre-contract communication | Name, business email, company, role, questionnaire and deployment information, message | Art. 6(1)(b) GDPR and legitimate interests, Art. 6(1)(f) |
| Providing the questionnaire workflow | Account data, uploaded documents, questionnaire content, generated results and usage data | Art. 6(1)(b); security interests under Art. 6(1)(f) |
| Website security and abuse prevention | Request and browser data, security logs and short-lived keyed rate-limit identifiers | Art. 6(1)(f) |
| Optional analytics | Pseudonymous interaction events described in the Cookie Policy | Consent, Art. 6(1)(a) |
| Legal obligations and disputes | Relevant account, contract and communication records | Art. 6(1)(c) and (f) |
3. AI-assisted processing
The hosted workflow uses Google Gemini 2.5 Flash to generate answer suggestions from customer-provided context. Outputs require human review and are not autonomous contractual decisions. TrustRespond.ai does not use customer documents to train its own public model. See AI system information.
4. Providers and subprocessors
| Provider | Purpose | Current configuration |
|---|---|---|
| Vercel | Web hosting and server functions | Frankfurt, Germany (fra1) |
| Supabase | Database, authentication and storage | Central EU, Frankfurt (eu-central-1) |
| Google Gemini API | AI inference | Gemini 2.5 Flash; provider-managed processing |
| Zoho Mail | Transactional email via SMTP | Provider-managed processing |
5. International transfers
The application and primary database are configured in Frankfurt. Some provider operations may nevertheless involve processing outside the EEA. Where required, transfers rely on an adequacy decision or safeguards such as Standard Contractual Clauses and supplementary measures. Relevant documentation can be requested at info@trustrespond.ai.
6. Retention
- Uploaded documents and generated results: 90 days, unless deleted earlier or contractually agreed otherwise.
- Pilot and sales leads: until manually deleted or a valid erasure request is fulfilled; no automatic expiry currently applies.
- Rate-limit identifiers: only for the active anti-abuse window; raw IP addresses are not stored in the lead database.
- Contract and accounting records: for applicable statutory periods.
There is currently no separate automated application backup process. See the Security Overview.
7. Your rights
Subject to the GDPR conditions, you may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw consent prospectively and complain to a competent supervisory authority. Send requests to info@trustrespond.ai.
8. Required information
Required pilot and account fields are needed to respond to a request or provide the agreed service. Optional fields are marked accordingly. Do not send confidential documents by ordinary email; secure upload instructions are provided separately.
9. Cookies
See the Cookie Policy. Non-essential analytics require consent.
10. Changes
Material updates are reflected by the date above and communicated where required.