Privacy policy

Who is responsible

VELM, a French single-shareholder simplified joint-stock company (SASU) with a share capital of €5,000, registered with the Paris Trade and Companies Register under number 104 221 841, operates Truviate and is the data controller for account data. For the contents of documents you upload, you (or your firm) remain the controller and VELM acts as processor on your instructions. Contact: support@truviate.com.

What we process

Account data

• Email address, name, workspace name and role.
• Authentication events, session identifiers and multi-factor enrolment status.
• Subscription status and billing identifiers issued by our payment processor. We do not store card numbers.

Uploaded documents

• Agreements and statements of work (PDF, DOCX).
• Time, expense and invoice exports (CSV, XLSX, PDF), which may contain names of your staff and your clients.

Derived data

• Billing terms proposed from an agreement and the rules you confirm from them.
• Findings, calculation steps, Evidence Trace entries and your confirm/reject decisions.

Usage data

• Product events (for example: preflight created, rule confirmed) with identifiers and timestamps.
• Error reports with technical context. Document contents, contract excerpts and amounts are excluded.

Why we process it

We do not sell personal data and do not use uploaded documents to train models.

• To provide the service: run preflights, show findings, keep an auditable record of decisions (performance of a contract).
• To operate accounts and subscriptions, and to send transactional email (performance of a contract, legal obligation for invoicing).
• To keep the service secure and working, and to understand which features are used (legitimate interest, limited to the minimum described above).

How long we keep it

• Raw uploaded files: until you delete them, and at most 30 days after upload, after which they are deleted automatically.
• Confirmed rules, findings, calculations and decisions: for as long as the preflight exists in your workspace. Deleting a preflight deletes them.
• Account data: for the life of the account, then removed within a reasonable period after closure, except where invoicing records must be kept by law.
• Usage and error data: for a limited rolling period appropriate to operations.

Who else is involved

We rely on a small number of processors, each bound by contract and used only for the role stated:

• Hosting and content delivery.
• Database and file storage.
• Identity and authentication.
• AI provider, for extraction of billing terms and matching proposals. Agreement text is sent for the duration of the request only.
• Payment processing.
• Transactional email.
• Product analytics and error monitoring, which receive no document contents.

Some processors may operate outside the European Economic Area; where they do, transfers rely on recognised safeguards such as standard contractual clauses. A current list of processors is available on request.

Your rights

Depending on where you are, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. Most of this you can do directly: delete files, delete preflights, or close your workspace. For anything else, write to support@truviate.com.

Cookies

We use cookies that are necessary to keep you signed in and to protect forms, and one cookie to remember your language. Analytics events, when enabled, are sent through our own domain and are not used for advertising.

Changes

We will update this page when our processing changes and note the date of the last revision here. See also the terms of service and the security overview.