Privacy Policy

1. Who is responsible

1.1 Twilight Media Design Corporation, (to be confirmed), operates WhatTrust (whattrust.com). It is the controller of the personal data described in this policy, except where section 7 says we act for you as your processor.

1.2 Contact: (to be confirmed).

2. What we collect and why

What we do not collect or do:

• We do not collect or store your full card number. Stripe handles card details.
• We use no advertising cookies, analytics tools or third-party tracking scripts in the app or on websites we host for you.
• We do not sell or register domains, so we collect no domain registrant details.
• We cannot read your Gmail or Outlook inbox. Those connections are send-only.
• We do not collect email addresses from public business listings, scrape websites, or buy contact lists. No licensed commercial contact-data provider (for example Apollo, Google Places or DataForSEO business listings) is connected.
• From Shopify, Etsy and eBay we take only paid order totals. We store no buyer names, emails or addresses.
• Apart from sending a message you approved from your own mailbox, we never post, publish, message or charge anything on a platform you connect.

Automated decisions. We use automated analysis to rank opportunities and to score organisations found in listings for fit. It does not produce legal or similarly significant effects on you or on them; you decide what to do.

3. Research sources

3.1 Deep Research and the knowledge base use public and official statistics (for example World Bank, OECD, ILO, Eurostat, Wikimedia pageviews, US BLS and Census data, and, for South Korea, Naver search-trend data), web search and page reading through OpenAI, and search-demand data from DataForSEO where enabled. We send these sources search terms built from our own fixed lists of industries, business models and market codes, and, for Validate, keywords from your idea text for that report. We do not send your name or email address.

3.2 Research Memory: shared, non-personal evidence. To make research faster and more consistent, WhatTrust keeps a shared library of market evidence. It contains no customer data, by design: only searches built from our own fixed lists can add to it (the database rejects anything else); searches built from your text are used only for your report and never stored in it; and the Grow business description is never used as a search term. Evidence is stored or reused only when the source's licence allows it.

3.3 Your own reports, answers, business records, CRM and workspace are private to your account and are never shared with other customers. We do not use customer data to train AI models or to build knowledge shared across customers.

4. AI processing

4.1 The AI Business Agent, report writing, web search for research and AI-generated drafts use language models provided by OpenAI. Depending on the task, OpenAI receives:

• for the AI Business Agent: your request and the conversation, your business record (assessment, selected opportunity and research summary, offer, confirmed facts, pipeline counts, website state, money summary), website content, drafts, and a summary of your contacts (first names, stage, channel, follow-up date and the latest enquiry text with contact details removed);
• for metered tasks: the request you confirmed and the business context it needs;
• for research: public evidence and search terms (section 3.1).

4.2 Our requests ask OpenAI not to store them for later retrieval (store: false). OpenAI processes them in the United States.

4.3 Live AI is enabled only when the owner approves it for an environment. Content from web pages, your customers' messages and tool results is treated as information, not as instructions.

5. Customer acquisition and public business listings

5.1 When you ask WhatTrust to find organisations, we query OpenStreetMap through public Overpass servers (currently overpass-api.de and overpass.private.coffee) with the buyer category, country and city of your business. The servers see the query and our server's address, not your identity. Results are © OpenStreetMap contributors, available under the Open Database Licence.

5.2 We search for organisations, not consumers. From each listing we keep the organisation's name, category, website, listed business phone number, city and country, with the source, licence and attribution. If a listing includes an email address, we do not store it. A listed phone number or website is a business contact detail, not consent to marketing.

5.3 Candidates you do not save are kept for 90 days. Organisations you save become contacts in your CRM and keep their source and attribution.

5.4 Your do-not-contact list is kept per business. An email address is stored only as a one-way hash (SHA-256 of the lower-cased address); a domain is stored as the domain name. The list is checked before every message sent from a connected mailbox.

5.5 Where a listed organisation is a sole trader, its listing may be personal data. You are the controller of the contacts you save and of any outreach (section 7).

6. Connections and OAuth permissions

You can connect accounts that you own, for a specific business. We store access tokens encrypted (section 12) and never show them in the app or in your export.

Each platform's own privacy policy applies to your account there. Some connections become available only after the platform approves WhatTrust's application. We honour platform privacy requests: Shopify customer-data, customer-redaction and shop-redaction webhooks (a shop redaction deletes that connection's records), and eBay marketplace account-deletion notifications.

7. Data we process for you (you are the controller)

7.1 When your CRM holds information about other people (contacts you enter, leads imported from your Facebook Lead Ads forms, organisations you save from listings, enquiries from your website's visitors, and messages you send to them), you decide what is collected and why. You are the controller of that data and we are your processor (or "service provider"). We process it only to provide the Service to you.

7.2 Website visitors. When someone submits the contact form on a website we host for you, we receive their name, email address, optional phone number and message, and the consent text they accepted. We add it to your CRM for that business. We use the visitor's network address only to limit repeated submissions, and we count page visits only as daily totals, with no cookie, IP address or visitor identifier. You must give your visitors any privacy notice your law requires.

7.3 You are responsible for having a lawful basis, giving any notices required and responding to requests from those people. Do not enter sensitive data (Terms, section 6.4). If one of those people contacts us, we will refer them to you where possible, and we will help you respond.

7.4 This data is deleted when you delete the business project it belongs to, or your account. Disconnecting a platform does not delete leads or income records already imported.

7.5

8. Who we share data with

We share personal data only with service providers that process it for us under contract, and only as needed.

Platforms you connect (Google, Microsoft, Meta, TikTok, LinkedIn, Shopify, Etsy, eBay) are not our processors. We exchange data with them under your authorisation, as described in section 6, and their own terms apply.

We may also disclose data:

• if the law requires it;
• to protect rights, safety or the Service;
• to a buyer or successor of our business, under this policy.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

9. How long we keep data

The table shows how long we intend to keep each kind of data and what happens today.

10. Your choices: export and deletion

10.1 Export. Account settings → Privacy & data → Export my data downloads a JSON file. It contains: your profile; assessments; subscription status; research credits; reports; projects; CRM contacts and notes; revenue and money entries; financial models; experiments; offers; the consent records you gave; your AI agent credit ledger; your websites, their saved versions and connected domains; your legal-event history; agent authorisations; businesses and their facts; plans and task progress; task evidence; agent outputs and agent actions; spending limits; records imported from connected platforms; your connections (platform, account, scopes, status, dates, never tokens); recommendation feedback and learning consent; and alternative-direction explorations. It does not yet include: your sent-message log, acquisition strategies, discovery results and do-not-contact list, saved agent drafts, agent conversations and memory notes, quotes and invoices, website revision requests and usage counts, support messages, security logs, report-view logs, billing event records and the research-job input snapshot. You can ask us for any of these at (to be confirmed).

10.2 Deletion. Account settings → Privacy & data → Delete my account does the following, in this order:

• cancels at Stripe, immediately and with no automatic refund, your first business subscription and every active additional-website plan (Subscription, Refund and Cancellation Policy, section 8). If a cancellation fails, nothing is deleted.
• disconnects every domain you connected from WhatTrust hosting;
• destroys the stored tokens of every connected account and marks the connections revoked; deletes records imported from connected platforms and pending sign-in states; revokes your spending limits;
• deletes your businesses and their facts and agent outputs, your learning feedback and learning consent, your projects and everything attached to them (including tasks, offers, experiments, income entries, CRM contacts and notes, your sent-message log, acquisition strategies, discovery results, do-not-contact lists, agent conversations and saved drafts), your websites, your alternative-direction requests, your assessments, and any guest assessment you claimed;
• removes the idea, business-profile, financial and market-plan sections from your reports, and the copy of your answers stored with each research job;
• replaces the email on your profile with an anonymous placeholder, and unlinks your Research Memory usage records;
• signs you out.

10.3 What we keep after deletion, and why. To meet legal obligations, handle tax and accounting, and establish or defend legal claims (for example card disputes), we keep:

• your consent records and legal-event history;
• billing records and Stripe event records;
• security and audit logs, including sign-in events containing your email address;
• report-view logs;
• your subscription, business-subscription and credit history, and your AI agent wallet, ledger, tasks and authorisations;
• the remaining parts of your reports (opportunities, sources and delivery data);
• our sign-in account record, which holds your original email address. It is referenced by the retained legal records and cannot be removed while they are kept.

We keep these only for the periods in section 9.

10.4 Disconnecting a platform destroys its stored tokens at once. For Google, we also revoke access at Google; for Microsoft, remove WhatTrust in your Microsoft account settings if you also want the consent removed there.

10.5 Other rights. Depending on where you live, you may have the right to:

• access, correct or delete your data;
• restrict or object to processing;
• data portability;
• withdraw consent;
• not be discriminated against for exercising your rights;
• complain to a regulator (for example your EU/UK supervisory authority, the Australian OAIC, the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, Türkiye's KVKK Authority, Korea's PIPC, or the data-protection authority in your Gulf state).

Contact us to exercise these rights. We will respond within the time the law requires. You can correct your language and country in Settings.

11. International transfers

11.1 Our servers and main providers are in the United States. If you use WhatTrust from another country, your data is transferred to and processed in the US, where data-protection law may differ from yours.

11.2 We rely on:

• for the EU/EEA, the EU–US Data Privacy Framework for certified providers, or Standard Contractual Clauses;
• for the UK, the UK Extension or the IDTA;
• for Turkey, KVKK standard contracts or notification;
• for South Korea, PIPA consent or another legal basis;
• for China, the PIPL mechanisms;
• for Saudi Arabia, the UAE, Canada and Australia, their own transfer rules.

12. Security

What we actually do:

• Database access control. Row-level security is enforced on our tables. Each signed-in customer can read only their own rows. Shared tables and logs are accessible only to our server.
• Server-side secrets. API keys and signing secrets are kept on the server and never sent to your browser. Production refuses to start without a session-signing secret.
• Connection tokens. Access tokens for accounts you connect are encrypted with AES-256-GCM before they are stored, separately for each connection, with keys kept outside the database. Tokens are never shown in the app or included in exports.
• Verified payments. Stripe messages must carry a valid cryptographic signature (5-minute tolerance). We re-check the subscription with Stripe before granting access.
• Tamper-evident records. Consent records, legal events, audit logs, metered-call logs and Research Memory audit history are append-only. Nobody, including our own server, can edit or delete an entry through normal operations.
• No card data. Card numbers are entered on Stripe's page and never reach us.
• Sign-in. One-time codes with limited attempts and rate limits per email and IP address. Session cookies are HttpOnly and SameSite=Lax, marked Secure on hosted environments, and expire after 30 days. A session cannot yet be revoked before it expires.
• Outreach safeguards. One message per approval, to one contact of the same business, with per-mailbox limits and a do-not-contact check.
• Minimisation. Guest tokens are stored only as a hash; do-not-contact email addresses are stored only as a hash; audit entries for sent emails and website enquiries do not contain the message text.

We rely on our providers (Supabase, Vercel, Stripe) for physical and infrastructure security, including any encryption they provide. We do not hold any independent security certification (such as SOC 2 or ISO 27001).

No system is perfectly secure. We will notify you and regulators of a personal-data breach where the law requires.

13. Cookies and browser storage

We use only storage that is strictly necessary for the Service or that remembers your own progress:

• Stripe's payment page sets its own cookies on Stripe's domain, under Stripe's policy.
• We use no analytics, advertising or social-media cookies, in the app or on websites we host for you. If that changes, we will ask for consent first where required.

14. Children

WhatTrust is not intended for anyone under 18 (to be confirmed). We do not knowingly collect data from children. At checkout we ask you to confirm that you are at least 18, or the age of majority where you live. If you believe a child has given us data, contact us and we will delete it.

15. Regional information

Additional information for your region will be added here.

16. Changes

We will post updates here and, for material changes, tell you in advance by email or in the Service.

17. Contact

Twilight Media Design Corporation — (to be confirmed) — (to be confirmed).