Your information, handled with care.

Who we are

Trustology (“we,” “us”) runs trustology.org and the services we provide to business clients. This policy covers both. By using the site or sending us information, you agree to this policy.

What we collect

• Assessment form. Required: your name, work email, business name, and a short description of what is happening. Optional: everything else on the form, such as the tools you use, rough hours and costs, goals, budget, timeline, website, phone, and team size.
• Project work. The documents we prepare for you, such as opportunity summaries, decision memos, build plans, and blueprints, and files you send us for the project (for example, a price list or a screenshot).
• Email. Messages you send to any trustology.org address. These can be added to your client record.
• Partner applications. The partner application is a preview and does not send or save anything. Before it opens, we will update this policy to say what we collect from applicants.
• Please do not send passwords, personal records about other people, or confidential secrets.

What we do not collect

We do not have visitor accounts. We do not take payments on this site. We do not use advertising or tracking cookies. We do not intentionally collect sensitive personal information, such as health, financial account, biometric, or government ID data.

Information collected automatically

When you load a page, Cloudflare, which hosts the site, processes standard request data such as your IP address, browser type, and the time of the request. This is used for delivery and security. When you send a form, Cloudflare Turnstile checks that a person sent it. We do not build profiles from this data.

Analytics. We use Cloudflare Web Analytics to count visits and learn which pages are useful and how fast they load. It does not use cookies or browser storage, and it does not fingerprint you by IP address or browser. It records the page viewed, the referring site, country, device type, browser, operating system, and page performance. We see only totals, and the data is kept for up to six months.

Cookies and browser storage

The public site does not set cookies. Our analytics does not set cookies either.

• If you start the assessment, your answers are saved in your browser's session storage so a refresh does not lose them. This clears when you close the tab or send the form.
• When you dismiss our cookie notice, we save one small flag in your browser so the notice does not show again.
• If we ever add cookies that are not needed for the site to work, we will update this page and ask you first.

How we use your information

We use it to reply to you, prepare your assessment and documents, deliver the work you hire us for, keep the site and our records secure, and meet legal, tax, and accounting duties. We do not use it for anything else.

Where it is stored and how we protect it

Your information is stored with Cloudflare in the United States. Before storage, your contact details and answers are encrypted with AES-256-GCM using keys that only our application holds. Files are encrypted before they are stored. Only Trustology's founder can open client records. Sign-in requires a password and an authenticator code, and each sign-in is recorded. No system is perfectly secure. If a breach affects your information, we will tell you without unreasonable delay and as the law requires.

Documents and share links

We may send you documents as a private link. Only people who have the link can open it. A link expires after 30 days, or sooner if we turn it off. We record how many times a link was opened. If you approve a decision memo on its page, we record your name, the time, and a protected (hashed) form of your IP address.

Who we share it with

• Service providers. Cloudflare hosts our site, forms, database, file storage, mailbox, and bot checks. It processes data only to provide those services to us.
• Partner introductions. If your work needs a specialist from our partner network, we ask you first. With your permission, we share only what the partner needs to review the work: your name, business, contact details, and a summary of the need. Partners are independent businesses. After the introduction, their own privacy policy covers how they use your information. A partner may pay us a referral fee for work you choose to give them. We are never paid for your personal information itself, and we share nothing without your permission.
• Legal requirements. We share information when the law, a court order, or a valid legal process requires it, or to protect our rights, our clients, or the public.
• Business transfer. If Trustology is sold or merges, your information can move to the new owner under this policy.
• We do not sell, rent, or trade your information, and we do not share it for targeted advertising.

How long we keep it

If you do not become a client, we erase your personal details after 24 months with no activity. A note that the record was erased stays, with no personal details. Client records stay while we work together and for as long as tax and accounting rules require. Encrypted backups are kept for recovery and are replaced on a rolling basis. Deleting a record also deletes its documents, files, and share links.

Your rights

Wherever you are, you can ask us to:

• show you the information we hold about you;
• correct information that is wrong;
• delete your information;
• give you a copy in a common format;
• stop any non-essential email from us.

Email us at the address below. We may ask you to confirm your identity first. We reply within 30 days and do not charge for requests. If we cannot fully meet a request, for example because the law requires us to keep a tax record, we will tell you why.

Children

Our services are for businesses and are not directed to anyone under 16. If we learn that we have information from a child, we will delete it.

Other websites

Our site can link to other sites, which have their own privacy policies. For Cloudflare's processing, read the Cloudflare Privacy Policy and the Turnstile Privacy Addendum.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we also email active clients before it takes effect.