Privacy Notice

This Privacy Notice explains how TruthLens AI ("we", "us", "our"), operating the TruthLens AI service (the "Service"), collects, uses, and shares personal data. TruthLens AI is the data controller responsible for your personal data.

1. Personal data we collect

• Account data: email address, authentication identifiers, password hash (when using email/password) or Google account identifier.
• Content you submit: conversation text and screenshots you upload for analysis, and the resulting reports.
• Usage & telemetry: pages visited, feature usage, device and browser information, IP address, and error logs.
• Billing metadata: plan, credit balance, and transaction identifiers. Payment card details are collected and processed by Paddle, not by us.
• Support communications: messages you send us.

2. Purposes and legal bases

• Providing the Service, including running AI analyses and displaying reports — performance of a contract.
• Account management, authentication, and customer support — performance of a contract.
• Security, fraud prevention, and abuse detection — legitimate interests.
• Product improvement and analytics — legitimate interests.
• Compliance with legal, tax, and accounting obligations — legal obligation.
• Marketing communications, where applicable — consent, which you can withdraw at any time.

3. How we share data (subprocessors)

We share personal data with the following categories of recipients:

• Paddle.com Market Ltd — Merchant of Record; handles payments, subscription billing, invoicing, refunds, sales tax, and fraud screening.
• Supabase — database, authentication, and backend hosting.
• Google (Gemini via Lovable AI gateway) — AI model provider used to generate analyses of the content you submit.
• Cloudflare — application hosting and content delivery.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law or to protect our rights.

4. Data retention

Account data is retained for as long as your account is active. Analyses and uploaded screenshots are retained for as long as you keep them in your account, and you can delete individual reports at any time. Billing records are retained for the period required by applicable tax and accounting law (typically 6–10 years). When data is no longer needed, it is deleted or anonymised.

5. Your rights

Subject to applicable law (including the GDPR for users in the UK/EEA), you have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent where processing is based on consent. You can also lodge a complaint with your local data protection authority. We will respond to requests within one month.

6. International transfers

Personal data may be transferred to and processed in countries outside your own, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Security

We implement appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege database policies — designed to protect your personal data. No system is perfectly secure, and we cannot guarantee absolute security.

8. Cookies

We use strictly necessary cookies and local storage for authentication and session management. We do not currently use advertising cookies. Where analytics or marketing cookies are added in the future, we will request your consent.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them.

10. Contact

To exercise your rights or ask questions about this notice, contact us via the in-app support option or the contact details listed on our website.