Privacy policy

1. Who we are

TRU Network Ltd is a private limited company registered in England and Wales under company number 16032929, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.

We are the data controller for the personal information described in this policy, except where clause 4 states that we act as a processor on a business customer’s instructions. We are registered with the Information Commissioner’s Office as a data controller and pay the annual data protection fee.

We have not appointed a Data Protection Officer, as we are not required to do so. Our data protection contact can be reached at privacy@tru-network.com.

This policy covers tru-network.com, our hosted TRU Card profile pages, and the TRU Card, TRU Board, TRU Home and BOARD AI products.

2. Information we collect

Information you give us

• Your customer type, name, email address, telephone number, country or business location, company and website details where applicable, product interests and message, when you use the enquiry or contact forms
• Account details when you register for a product, including the email address used to sign in and your multi-factor authentication settings
• Profile content you choose to publish on a TRU Card profile — photograph, job title, contact details, links and any promotional material you upload
• Billing details where you buy a paid service. Card payments are handled by our payment provider; we do not receive or store full card numbers

Information collected automatically when you use our systems

• Technical and security logs needed to operate the service, detect abuse and investigate incidents, which include IP addresses
• Device and browser information submitted by your browser as part of an ordinary web request

Engagement measurement on hosted TRU Card profiles

Where a visitor to a hosted card has given consent, we record the card opened, whether the interaction was a view or a tap, the link selected, the route by which the visitor arrived, the page path with any query string removed, and the time. We also record the country reported by our network provider.

We deliberately limit this data. The visitor’s IP address is not stored. It is converted to a keyed irreversible value inside our edge service, used only to enforce rate limits and prevent inflated counts, and the IP field on the analytics record is stored empty. We do not use any IP geolocation service, and we do not record town, city or region. No visitor name or email address is requested, and no record is linked to a visitor as an identified individual.

3. Why we use it, and our lawful basis

• To respond to your enquiry — legitimate interests: replying to someone who has contacted us
• To provide the product you have bought and to administer your account — performance of a contract
• To store and read information on a visitor’s device, and to measure engagement on a hosted card — consent, given through the banner on the card and withdrawable at any time
• To keep the service secure, prevent abuse and investigate incidents — legitimate interests in protecting our service, our customers and their data
• To provide the optional BOARD AI service — performance of a contract with the account holder, and consent to the additional data sharing given at activation
• To send product updates or marketing — consent, which you can withdraw at any time, or our legitimate interest in marketing similar products to an existing customer who has not opted out
• To meet our accounting, tax and other legal obligations — legal obligation

Where we rely on legitimate interests we have assessed that our interest is not overridden by your rights and freedoms. You can ask us for that assessment.

4. How our products handle your data

TRU Board

TRU Board is local-first by design. Your board — actions, notes and history — is stored in a file you control, on your own device or in your own connected cloud storage. We do not hold a permanent copy of your board. The application sends the content needed for a requested operation to gated TRU Network server routes so that the service can calculate, format or generate the response; that content is processed in memory for the response and is not retained by us afterwards, is not written to our logs, and is not used to train any model.

To be precise about the boundary: the accurate statement is that we store nothing and your files never leave your device, not that no content is ever transmitted. Your account data — name, email address, company, product grants and support notes — is stored by us in the ordinary way. See Security and data handling for the technical detail.

BOARD AI and TRUbot

BOARD AI is inactive unless the account holder activates the paid option and accepts the additional data-sharing notice. TRU Board Secure continues to operate without AI processing when BOARD AI is off.

When BOARD AI is active, we process only the board information and the external sources that the customer connects or selects. Depending on the plug-ins chosen, this may include email message content and metadata, completed meeting transcripts, an in-person meeting recording or transcript, selected cloud-storage files, and a restricted summary of board actions. We also process connection status, provider and mailbox labels, consent versions, AI plan settings, TRUbot Credit balances, and an append-only usage and purchase ledger.

The purpose is to deliver the requested assistant service: summarising work, identifying decisions and actions, finding likely duplicates, proposing owners and dates, preparing reply drafts, mapping approved information to the customer’s board, and highlighting overdue, blocked or stalled work.

Source emails, meeting transcripts and cloud files remain with the connected provider wherever technically possible. We send only the content required for a requested operation, through protected server routes; we do not place full source copies in the board file, and we do not store email, transcript or board content in the BOARD AI credit database. Generated proposals remain drafts until a person approves, defers or rejects them.

Where a business customer uses BOARD AI in relation to its own staff, suppliers or customers, that business determines why the source material is processed and is normally the controller for it. In that case TRU Network acts as processor on the customer’s instructions for the delivery of BOARD AI, under a data processing agreement. TRU Network remains controller for account administration, security, billing, fraud prevention and the TRUbot Credit ledger.

Content may be sent to the connected service provider and to the AI provider selected by the customer. Where the customer selects Customer AI, the customer’s own contract and privacy settings with that provider also apply. Where the customer selects TRU Managed AI, we use a contracted model provider acting on our instructions. We do not use customer content from BOARD AI to train general-purpose models.

The customer must ensure that it has the authority and a lawful basis for the content it connects, and must give any required notice or obtain any consent before an in-person meeting is recorded or transcribed. BOARD AI does not make decisions based solely on automated processing that produce legal or similarly significant effects: human review is required before a proposed board change or external communication takes effect.

TRU Home

TRU Home runs on a server located in your own property. Camera footage, sensor readings, calendars, shopping lists and device history remain on that hardware, under your control. We access a customer system only with your permission and for support purposes.

TRU Card

Cards are the exception, because the service only works if the profile is hosted. Profile content you publish is public by design — anyone with the card, code or link can see it, so publish only what you are content for others to see. Views and taps on your profile are recorded, where the visitor has consented, so that we can produce your reporting.

5. Who we share it with

We do not sell personal information, and we do not share it for anyone else’s marketing.

We use a small number of service providers who process personal data on our behalf under written contract, and only on our instructions. They fall into these categories:

• Website, application and database hosting, and content delivery and network security
• Authentication and identity services
• Transactional email and form delivery
• Payment processing
• Connected productivity services that a customer chooses to link, such as email and cloud storage
• AI model processing for the optional BOARD AI service
• Error, performance and security monitoring

A current list of our processors is available on request from privacy@tru-network.com. Where a Customer AI user connects a provider directly, that provider acts under the customer’s own agreement rather than ours.

We may also disclose information where the law requires it, where it is necessary to establish, exercise or defend legal claims, or to our professional advisers under a duty of confidentiality. If the business is sold or reorganised, information may transfer to the buyer subject to the same protections.

6. How long we keep it

• Enquiries that do not become customers: up to 24 months
• Customer account and profile data: for as long as the account is active, then up to 12 months
• TRU Card engagement records: 395 days, deleted automatically by a scheduled daily purge
• Abuse-prevention and rate-limiting records: 30 days
• Accounting and tax records: 6 years, as UK tax law requires
• Security logs: up to 12 months
• BOARD AI connection settings and consent evidence: while BOARD AI is active, then up to 12 months
• TRUbot Credit ledger, purchases and related billing evidence: 6 years, where required for accounting, tax, fraud prevention or dispute handling
• Source content submitted to a BOARD AI operation: processed transiently for that operation only, unless the customer approves information into its own board or asks a connected provider to retain it
• Routine backups: overwritten on their own cycle, after which deleted data does not persist

When a retention period ends we delete the information or anonymise it so that it can no longer identify anyone.

7. International transfers

We aim to keep personal data in the United Kingdom or the European Economic Area. Where a provider processes data outside that area, we rely on UK adequacy regulations or on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards a transfer risk assessment identifies, so that your information keeps an equivalent level of protection. You can ask us which providers are involved and which safeguard applies.

8. Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the personal information we hold about you
• Have inaccurate information corrected or incomplete information completed
• Ask us to delete information, in certain circumstances
• Ask us to restrict how we use it, or object to our use of it, including any use for direct marketing
• Receive information you gave us in a portable, machine-readable format
• Withdraw consent at any time where we relied on consent, without affecting processing carried out before the withdrawal

Email privacy@tru-network.com and we will respond within one month. We may extend that period by up to two further months for a complex request, and will tell you if we do. There is no charge for a request unless it is manifestly unfounded or excessive. We may need to verify your identity before we act.

If you are dissatisfied with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the opportunity to put matters right first.

9. Cookies and device storage

Our signed-in website areas use only the storage strictly necessary to keep you signed in and to complete multi-factor authentication. We do not use advertising cookies, and we do not permit third-party tracking for advertising.

On hosted TRU Card profiles nothing is stored on the visitor’s device, and no engagement record is created, unless the visitor consents. Our cookie and device storage policy sets out each item we store, why, and how long it lasts.

10. Security

All traffic to our sites is encrypted with HTTPS and served with strict transport security and a content security policy. Access to systems is restricted, and administrative access requires multi-factor authentication and a current, unexpired grant. Customer environments are isolated from one another by database-level access control that denies direct access by default. Our local-first design for TRU Board and TRU Home means that the most sensitive material is never on our infrastructure at all.

No system is completely secure. If a personal data breach occurs, we will notify the ICO within 72 hours where the breach is likely to result in a risk to people’s rights and freedoms, and we will notify affected individuals without undue delay where the risk is high. Further detail is on our Security and data handling page.

11. Children

Our products are intended for adults and are not directed at children. We do not knowingly collect information from anyone under 16, and accounts may only be opened by people aged 18 or over. If you believe a child has provided us with personal information, contact privacy@tru-network.com and we will delete it. A TRU Home household calendar may include family members’ names entered by the account holder; that data remains on the household’s own server and is not sent to us.

12. Changes and contact

We may update this policy as the products and the law develop. The version and date at the top of this page will change, and we will notify customers directly of any material change. Where a change affects processing that relies on your consent, we will ask for consent again.

Questions: privacy@tru-network.com, or write to TRU Network Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.