Privacy Policy

This policy applies to:

• TrustLists public website and API at trustlists.org.
• TrustLists web app at app.trustlists.org.
• TrustLists Companion browser extension.

Account and authentication data

• Email address and basic profile identifiers from sign-in providers.
• Session/authentication tokens needed to keep you signed in.

Usage and product data

• Favorites, lookup usage counters, and SOC 2 analysis/report history.
• Basic operational logs for reliability, abuse prevention, and debugging.

AI lookup request data

• When you trigger AI Lookup, we process vendor/company query inputs you submit.
• We store lookup events and discovered trust-center candidates to improve workflows.

Payments are processed by Stripe. We do not store full card numbers or CVC values.

• We send Stripe the data needed to process your credit purchase transaction.
• We store billing-related metadata required to grant credits and reconcile payments (for example user ID, pack ID, credits, Stripe session identifiers).

• Provide directory search, AI lookup, favorites, and SOC 2 workflows.
• Authenticate users and secure access to paid features.
• Process payments and grant account credits.
• Operate, maintain, and improve product quality and abuse protections.

TrustLists Companion uses Chrome permissions to deliver extension functionality (for example side panel UI, auth/session sync, local caching, and opening trust-center links).

For AI lookup, user-submitted lookup inputs are sent to TrustLists APIs to return results and account usage updates.

We use third-party infrastructure and service providers, including:

• Stripe (payment processing)
• Supabase (data and auth infrastructure)
• OpenAI (AI lookup processing where applicable)
• Hosting and operational infrastructure providers (for app/site delivery)

• We retain account and transaction-related records as needed for operations and compliance.
• We retain product data while your account is active unless deletion is requested.
• We may retain limited logs for security, fraud prevention, and legal obligations.

We do not sell personal information. We share data only as necessary to operate the service, process payments, run AI features, comply with law, and protect users and the platform.

• You can request account data access, correction, or deletion.
• You can uninstall the extension at any time.
• You can contact us for privacy-related requests at privacy@trustlists.org.

We use reasonable administrative, technical, and organizational safeguards to protect data. No system is 100% secure, but we continuously improve our controls.

We may update this policy periodically. We will update the effective date above when changes are made.

For privacy questions, contact privacy@trustlists.org.