Privacy Policy.
How we collect, use, and protect information across GRIP and SENTINEL — and why, with SENTINEL, your data never leaves your server.
1. Who we are
Truvad ("Truvad", "we", "us") provides regulatory-intelligence software for U.S. financial-services organizations. For the purposes of this policy, the data controller is [Legal Entity Name], [registered address]. Questions can be sent to [email protected].
2. Information we collect
Account & billing data
Name, work email, company, role, and billing details you provide when you create an account or start a subscription. Payment card details are handled by our payment processor and are never stored on Truvad servers.
Usage data
Log data, device and browser information, and product interactions that help us secure and improve GRIP.
Content you track
The regulators, jurisdictions, and workflows you configure in GRIP. This is the configuration of your feed — not your internal documents.
3. GRIP vs SENTINEL — where your data lives
GRIP (hosted): runs on Truvad-managed infrastructure and processes the account, usage, and configuration data described above.
SENTINEL (on-premise): is deployed inside your own environment as an air-gapped package. Your documents and regulatory analysis are processed on your infrastructure and do not leave your server. Truvad has no access to, and does not receive, the content processed by SENTINEL.
4. How we use information
- To provide, secure, and maintain the Services.
- To process subscriptions and send service communications.
- To respond to support requests and improve our products.
- To meet legal, tax, and regulatory obligations.
5. Legal bases (where GDPR applies)
Where the GDPR applies, we rely on performance of a contract, our legitimate interests in operating and securing the Services, your consent (where requested), and compliance with legal obligations.
6. Sharing and sub-processors
We do not sell personal information. We share data only with vetted sub-processors (for example, cloud hosting, email delivery, and payment processing) under contract, and where required by law. A current list of sub-processors is available on request at [email protected].
7. Data retention
We retain account data for as long as your account is active and as needed to meet legal obligations, resolve disputes, and enforce agreements. You may request deletion as described below.
8. Security
We apply administrative, technical, and organizational safeguards appropriate to the data we handle. See our Security & Trust page for details on encryption, access control, and our on-premise model.
9. Your rights
U.S. (CCPA/CPRA): California residents may request access to, correction of, or deletion of personal information, and may opt out of sale or sharing (note: we do not sell personal information). We will not discriminate against you for exercising these rights.
EU/UK (GDPR): you may request access, correction, deletion, restriction, portability, and object to certain processing.
To exercise any right, contact [email protected].
10. International transfers
Where data is transferred across borders, we use appropriate safeguards such as Standard Contractual Clauses.
11. Cookies
We use strictly necessary cookies to operate the site and sign-in, and limited analytics cookies to understand usage. You can control cookies through your browser settings.
12. Children
Our Services are intended for business use and are not directed to children under 16. We do not knowingly collect their data.
13. Changes to this policy
We may update this policy from time to time. Material changes will be posted here with a new effective date.
14. Contact
[Legal Entity Name], [registered address] — [email protected].