What we collect, why, where it lives, and how to get it back.

1. Two roles

For account data (who you are, how to reach you, how you pay), we are the controller and this policy governs.

For customer content (the AI responses you submit for verification, the questions, the evidence retrieved from your connectors, the standing records and attestations produced), you are the controller and we are your processor. We process it only to provide the service, under your instructions and our data processing addendum. On a dedicated stack, that content lives in an AWS account under your control and we have no standing path to read it.

2. What we collect and why

From visitors to this website

• Contact form. Name, work email, company, what your AI answers, and volume. Used to reply to you and to prepare a proposed configuration. It is delivered to our mailbox as an email and nothing else: there is no marketing database, no CRM, and no lead-scoring service behind it. To keep the form from being used to flood that mailbox we count submissions per IP address for a minute at a time, and we carry a field that a person never sees and a script tends to fill. Neither uses a CAPTCHA or a third-party bot-detection service.
• Server logs. This website runs on Cloudflare Workers. Cloudflare records IP address, user agent, requested page, and time for security and capacity, and we do not keep our own copy. We run no analytics scripts, no advertising pixels, and no third-party trackers on this site, and the site sets no cookies and writes nothing to your browser's storage.
• Fonts. Pages load typefaces from Google Fonts, which receives your IP address and user agent to serve the files. See Google's privacy policy for how it handles that request. This is the only third party your browser contacts on this site.

From customers and users of the service

• Account and sign-in. Name, email, password hash, optional authenticator secret, session records, sign-in attempts and failures, roles, teams, and organizations. Used to authenticate you and enforce access.
• Company profile. Legal name, tax id, addresses, phone, website, billing and support contacts, industry, time zone. Used for invoices, notices, and support.
• Billing. Plan, usage meters, invoices, and receipts. Card details are entered directly into Stripe and never touch our servers. We hold Stripe's customer and payment-method identifiers.
• Audit log. Who did what and when in the admin app: invites, role and team changes, key and connector changes, policy edits, adjudications. Kept for the life of the account because the audit log is part of the product.
• Support. Emails and any material you send us to diagnose a problem.

Customer content, processed on your behalf

• Submissions. AI responses, questions, and citations you send to the verify endpoint. These may contain personal data about your users or third parties. You decide what to send and how long we keep it; retention is set per organization and redaction hooks run before storage when you configure them.
• Evidence snapshots. Text retrieved from your connectors at grading time, hashed and stored in the object bucket of your stack.
• Connector credentials. Held encrypted in AWS Secrets Manager, used only to query your stores. External connectors never copy your corpus.
• Model provider keys. If you bring your own, they are stored encrypted, shown masked, validated with a minimal call, and never returned after entry.
• Standing records and attestations. The output of the service, retained as long as you keep the account or stack, exportable at any time.

3. Cookies and browser storage

This website sets no cookies at all. The application sets exactly one: a session cookie named tl_session, which holds an opaque reference to a session stored on our server, not your identity. It is marked httpOnly so scripts cannot read it, SameSite=Lax so it is not sent from other sites, and Secure so it travels only over TLS. It exists to keep you signed in, and clearing it signs you out.

We use no tracking, advertising, or analytics cookies anywhere. We do not respond to Do Not Track signals, because we do not track anyone across third-party sites in the first place.

4. Legal basis for processing, for the EEA and UK

• Contract. Account, sign-in, company profile, and billing data are processed because we cannot provide the service or invoice you without them.
• Legitimate interests. Security monitoring, abuse and fraud prevention, rate limiting, audit logging, technical troubleshooting, and capacity planning. We balance these against your rights and use the least data that works.
• Legal obligation. Tax and accounting records we are required to retain.
• Consent. Where the law requires it, we ask first, and you may withdraw at any time.

For customer content we process on a customer's behalf, the customer chooses the legal basis; we act on their instructions.

5. Who else processes data

We use these subprocessors. Each is bound by a contract that restricts use to providing its service to us. We may add or change a provider within one of these roles, provided it meets the same standards.

• Amazon Web Services, us-east-1 by default, or the region of your dedicated stack. Compute, database, object storage, key management, and outbound mail through Amazon SES.
• Cloudflare for this marketing website, its rate limiting, and delivery of contact-form submissions to our mailbox.
• Fastmail for the mailboxes behind our published addresses, which is where anything you email us is stored.
• Stripe for payments, invoices, and receipts. Card details go directly to Stripe and never reach our servers; we hold only its customer and payment-method identifiers.
• Model providers chosen per organization, Anthropic by default, and optionally OpenAI, Google, xAI, or Amazon Bedrock. When you use platform keys, submissions and evidence are sent to the provider under our agreement with it, which prohibits training on that data. When you bring your own keys, they are sent under your agreement, and any zero-retention terms you hold with that provider apply.
• Exa for live web search when an organization enables the website connector, limited to the domains you declare.
• Google Fonts, which your browser contacts directly to load typefaces on this website.

We do not sell personal data, we do not share it for advertising, and we do not train models on customer content.

6. Where data lives

Pooled accounts run in AWS us-east-1. Dedicated stacks run in the region and account you choose. Customer content on a dedicated stack does not leave that account except when your configured model provider or connector is called.

Our infrastructure is in the United States, so using the service means your data is processed there. Transfers from the EEA, the UK, or Switzerland rely on the European Commission's standard contractual clauses with each provider, together with the safeguards each of them documents. Our data processing addendum carries those clauses and their annexes.

7. How long we keep it

• Account and company data: while the account is open, then 90 days, except records we must keep for tax or legal reasons.
• Billing records: seven years.
• Customer content: per the retention you set for each organization, or until you delete the organization or stack.
• Website request logs: held by Cloudflare under its own retention. We keep no copy.
• Application logs and the audit trail: the life of the account, because the audit log is part of the product.
• Contact-form emails: kept in our mailbox until we clear the thread.
• Backups: rolled off within 35 days of deletion.

8. Security

Encryption in transit and at rest, KMS-managed keys, argon2id password hashing, optional multi-factor authentication, throttled sign-in attempts, role-based access with a single authority table for screens and API routes, per-company row scoping with row-level security on pooled deployments, and an audit log. Signed attestations mean a record cannot be altered without detection. The security page has the detail.

9. If there is a breach

If a security incident compromises personal information, we assess the scope promptly and notify affected customers and, where the law requires it, the relevant regulators, without undue delay. For incidents that meet the notification threshold we aim to tell you within 72 hours of becoming aware. Where you are the controller and the data reached us as customer content, we notify you so that you can meet your own obligations to the people affected.

10. Your rights

Depending on where you live you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to processing, and to complain to a supervisory authority. Account holders can do most of this in the Account and Company pages, and can export their records at any time. For anything else, email privacy@truthlock.io. We verify who is asking, then respond within 30 days, free of charge unless a request is repetitive or manifestly excessive. If your data reached us as customer content, we will refer you to the customer, who controls it, and help them respond.

Closing an account. An owner can close the company from the Company page, or ask us to. You have 30 days to export first. After that we delete customer content and account data on the schedule in section 7, and backups roll off within 35 days.

EEA and UK residents may additionally withdraw consent where processing rests on it, object to processing based on legitimate interests, and complain to a local supervisory authority.

California residents have the right to know what we collect, use, and disclose, to request deletion or correction, and not to be discriminated against for asking. We do not sell or share personal information as the CCPA defines those terms, and we do not use it for cross-context behavioral advertising. Write to privacy@truthlock.io with "California Privacy Rights" in the subject line.

11. De-identified and aggregated data

We produce counts from how the service is operated: verifications run, latency, error rates, spend per provider. These are about the system, not about people, and once aggregated they no longer identify anyone and fall outside this policy. Customer content is not part of this. We do not mine submissions, evidence, or standing records for statistics, benchmarks, or product research, and we do not train models on them.

12. Children

The service is sold to businesses and is not directed to anyone under 16. We do not knowingly collect their data. Account holders must be at least 18 under our terms. If you believe a child's data has reached us, write to privacy@truthlock.io and we will delete it.

13. Governing law

This policy, and any dispute about it, is governed by the laws of the State of Utah, United States, without regard to its conflict-of-laws provisions. Section 18 of the terms of service says how disputes are resolved.

14. Changes

When this policy changes, the effective date at the top changes. For material changes we give at least 30 days' notice and email account owners the change affects. Older versions are available on request.

15. Contact

Privacy questions, rights requests, and data-protection matters all reach the same place.

Iron Rod Systems LLC, dba Iron Rod AI™
privacy@truthlock.io
833-IRON-ROD (833-476-6763)

Security reports go to security@truthlock.io, and contractual questions to legal@truthlock.io.