Legal

Privacy Policy

Last updated 28 September 2026

This policy explains what personal data Trugap handles, why, and what rights you have. It is written for UK GDPR and the Data Protection Act 2018.

1.Who we are

Trugap is run by SaaSili Ltd, trading as Trugap. Our registered office and contact address is Unit A, 82 James Carter Road, Mildenhall, IP28 7DE.

Company number: 14512976.

Email: steve.merry@trugap.app.

2.Our two roles

Controller. We decide how and why data is used for your account, billing, our website and our contact form. For that data we are the controller.

Processor. The deal information our customers enter, including details of buyer contacts, belongs to the customer. The customer is the controller and we process it on their instructions. Our Data Processing Addendum governs that processing.

3.What we collect and why

Data	Why we use it	Lawful basis
Account details: name, email address, password (stored hashed by our authentication provider), workspace name, role. If you sign in with Google, the name and email Google shares with us.	To create and run your account and workspace.	Contract
Billing details: plan, subscription status, billing address and tax ID if you give one. Card details are collected by Stripe and never reach our servers.	To take payment and keep billing records.	Contract and legal obligation
Deal and inspection content: opportunities, answers, evidence and notes you enter, which may include names, job titles and business contact details of buyer contacts.	To provide the inspection, scoring and analysis.	We process this as processor for the customer. The customer is responsible for its own lawful basis.
Usage data: product events such as inspection started or report viewed, stored with your user and workspace ID.	To understand how the product is used and improve it.	Legitimate interests
Public website visitor information: IP addresses, pages visited and company identification provided by Apollo.io.	To identify the companies that visit our website and understand business interest in Trugap, only if you opt in to Visitor identification.	Consent
Website analytics: pages visited and navigation measured by Google Analytics.	To see how the site is used, only if you opt in to Analytics.	Consent
Contact form submissions: name, email, company, role, team size, topic, CRM, message, and a one-way hash of your IP address.	To reply to you and to stop spam and abuse.	Legitimate interests
Support emails you send us.	To answer your question.	Legitimate interests

4.AI processing

Trugap scores the evidence first, using a fixed method. After scoring, the deal content is sent to an AI model to write the analysis. AI does not change the score.

We use AI models provided through Lovable's AI service, which currently routes requests to OpenAI.

Our AI providers do not use the content you submit to train their models. Inputs and outputs may be kept by the provider for up to 30 days for abuse and security monitoring, then deleted.

5.Buyer contacts named in deals

If a Trugap customer has entered your details as part of a sales opportunity, you are not our user. The customer decides what is entered and why.

The best route for any request is the company that entered your details. You can also write to steve.merry@trugap.app and we will pass your request to the right customer and help them respond.

6.Sub-processors

Provider	Purpose	Location
Lovable (Lovable Cloud, built on Supabase)	Website and app hosting, database, authentication and file storage	Sweden, EU
Lovable AI gateway	Routes analysis requests to the AI model provider	EU and United States
OpenAI	Generates the written analysis after scoring	United States
Stripe	Payments, subscriptions, invoices and tax calculation	Ireland (Stripe Payments Europe Ltd) and United States
Resend	Delivers contact form messages to our inbox	United States
Google	Website analytics, web fonts loaded by our pages, and Google sign-in if you choose it	United States
Apollo.io	Identifies the companies that visit our public website using visitor information such as IP addresses and pages visited	United States

7.International transfers

Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the recipient is certified under it.

8.How long we keep data

Account details: for as long as your account is open, then deleted within 30 days of closure.
Deal and inspection content: for as long as your account is open, then deleted within 30 days of closure.
Billing and invoice records: 6 years, to meet UK tax requirements.
Contact form messages: 12 months.
Product usage events: 24 months.
Backups: overwritten on a rolling basis within 30 days.

9.Security

Data in each workspace is kept apart by access rules enforced in the database, so one customer cannot read another customer's data. Roles inside a workspace limit what each user can see. Card details are handled by Stripe and never touch our servers. Contact form IP addresses are stored only as a one-way hash.

Data is encrypted in transit using TLS and at rest. Access to production data is restricted to authorised personnel, and database access is controlled by row-level security.

10.Your rights

You have the right to:

access the personal data we hold about you
have it corrected
have it erased
restrict how we use it
receive it in a portable format
object to how we use it
withdraw consent where we rely on consent

Email steve.merry@trugap.app. We will reply within one month.