What we collect, what we keep, and what we never hold.

Trucast Technologies Inc. is a Delaware corporation based in Armonk, New York. We operate the website at trucast.ai and Foundation, a read-mostly agent overlay for regulated firms. Questions about this policy go to privacy@trucast.ai.

This site and Foundation are not the same data relationship, and the policy treats them separately.

• This website. When you visit, subscribe, or send a contact form, Trucast is the controller of that information. We decide why it is collected and how long it is kept.
• Foundation. When your firm uses the product, Trucast is a processor of customer data. Your firm is the controller. We process what the engagement requires, on your instructions, and we do not use customer records for our own purposes.

Access to a system of record is still exposure even when nothing is copied. That is why Foundation is scoped, attributed, and revocable in your identity provider. It is also why this page does not pretend that “we store nothing” is the whole story.

We collect only what a given action requires.

• Contact. First name, last name, email, job title, company, institution type, area of interest, and the message you write. We use this to reply within one business day, from a person rather than a sequence, and to keep an ordinary record of the inquiry.
• Newsletter. Your email address, if you subscribe from the site or from On the Record. We use it to send the publication and related notes from Trucast. Every message includes an unsubscribe link. We do not buy lists or append data onto yours.
• Usage. Pages viewed, referrer, approximate location from the request, browser and device information, and timestamps. This is how we tell which pages are useful. It is not used to advertise to you, and it is not sold.
• Consent choice. If we ask whether analytics storage is allowed, your answer is stored in your browser as trucast-analytics-consent so we do not ask on every page. Clearing site data clears the choice.

We do not require an account to read this site. If you authenticate to an operator surface, a session cookie identifies that login for the life of the session.

Foundation reads live from your systems for the life of a request. It does not copy source content into a Trucast store, search index, or training set. It runs on Claude in your Anthropic organization, on Anthropic's zero-data-retention tier: prompts and model outputs are not retained by the model provider. Customer records, prompts, and outputs are not used to train Trucast models or anyone else's.

What Foundation keeps is the account of the work, a receipt rather than the record:

• Who: the named seat that asked
• What ran: the tool or method, and its version
• On what: a pointer to the source (for example a Salesforce record ID), not the field values
• Reproducibility: an inputs hash, so a computed number can be reproduced from the log
• When and which run: a timestamp and a correlation id
• Outcome: success or the kind of error, and any change that was approved

A proposed write can carry a short extract, the commitment or finding a named person is being asked to approve, for as long as that proposal is open. Once it is written to your system of record or declined, Foundation does not keep the extract. The durable thing on our side is the receipt: who approved, what was pointed at, and when. That is deliberate retention of provenance, not of your data.

Trucast's control plane sees the account of the work. It does not see the contents of your records. Our access to your environment, when it exists, is a named, scoped, audited seat on your roster, visible and revocable like any other operator.

Revoke the credential and access ends, including cached tokens and in-flight jobs. Because Foundation does not store your content, there is nothing to purge but the credential and the receipts your agreement says we should keep. Turn it off, and your systems are exactly as they were.

We do not run advertising, retargeting, or cross-site tracking. There is no ad pixel on this site, and advertising storage is denied in every region.

• Google Analytics 4 runs on the production marketing site (trucast.ai) only. It is not loaded on preview deployments or on the application domain. In the EEA, the United Kingdom, and Switzerland it starts with analytics storage denied; a cookie is written only if you accept. Elsewhere it runs by default. You can refuse, and you can clear the stored choice at any time.
• Vercel Analytics and Speed Insights measure traffic and performance. They do not set advertising cookies and are not used to build a marketing profile.
• Strictly necessary. The site may set a session cookie if you sign in to an operator surface, and your browser may hold the analytics consent value described above.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is no “do not sell” opt-out because that activity is not present to opt out of.

We use a short list of processors. The product list is also on /trust. A fuller schedule, with locations and the purpose of each, is available to customers under NDA.

On this website

• Vercel: hosting, edge delivery, Analytics, and Speed Insights. United States.
• Google: Analytics 4 on the production marketing site, subject to the consent rules above. United States.
• Resend: transactional mail and the newsletter list. United States.

In Foundation

• Anthropic: the model, running in your organization on the zero-data-retention tier. Your contract with Anthropic governs that account.
• Vercel, Supabase, Modal, WorkOS: the control plane, meaning hosting, data store for receipts and operator state, background work, and identity. Hosting is United States.
• Perplexity: public research only. It is not given your records, prompts, or extracts.

• To respond to a request you made, and to run the site
• To send On the Record and related notes you asked for
• To understand which pages are useful, and to keep the site working
• To detect abuse, protect the service, and meet a legal duty

Where a privacy law asks for a legal basis: we rely on the steps needed to answer you; on consent for the newsletter and for analytics storage in the EEA, the UK, and Switzerland; and on legitimate interests in operating a secure, understandable site where those interests are not overridden by yours.

We share personal information only in these cases:

• With the processors named above, under a contract that limits their use
• When the law requires it, or to respond to a lawful request we have reviewed
• If we sell or reorganize the company, under continuity of this policy or its successor
• With your direction, for example if your firm asks us to send a packet to counsel

We do not sell personal information. We do not rent the newsletter list.

• Contact inquiries: for as long as we need them to reply and to keep an ordinary business record, then deleted or de-identified.
• Newsletter: until you unsubscribe, or you ask us to delete the address.
• Analytics: per the provider's retention for the property. We do not build a separate marketing profile on top of it.
• Foundation receipts: retained as provenance, for the period in your agreement. Source content, prompts, outputs, and quoted snippets are not stored. A pending extract lives only while the proposal is open.

Hosting for the website and for Foundation's control plane is in the United States. If you are in the EEA, the UK, or Switzerland, that is an international transfer. The processor schedule and the transfer mechanism for each processor are available to customers on request, and under NDA where the detail requires it.

Customer records that Foundation reads do not move into a Trucast store in any region. They are resolved live from your systems and sent to the model in your Anthropic account for the life of the request.

Access to Foundation is a scoped credential you create and revoke. Operator actions are attributed. A login without a seat on the named roster is refused. We will run a revocation test with you: revoke the credential in your identity provider and watch access fail, including cached tokens and in-flight jobs.

SOC 2 Type I is complete. Type II observation is underway; the report is expected in 2027. Type I is a design snapshot, and we say so plainly. The report is available under NDA.

No list of measures makes a system safe. The test that matters is the one you run on your infrastructure, not a sentence about industry-standard controls.

We notify affected clients of a confirmed security incident without undue delay, and no later than 72 hours after confirmation. Your agreement may set a tighter clock or anchor notification to detection; where it does, the agreement controls.

Depending on where you are, you may have the right to access, correct, delete, or export personal information we hold as controller; to object to or restrict certain processing; to withdraw consent (that does not unwind processing that was lawful before); and to complain to a supervisory authority. California residents also have the rights to know, delete, and correct, and not to be discriminated against for exercising them. We do not sell or share personal information in the CCPA sense, and we do not use sensitive personal information to infer characteristics.

Email privacy@trucast.ai. We will need enough to find you and to confirm the request is yours. We will not require a portal or a phone tree.

If the information sits in Foundation as customer data, your firm is the controller. Ask your administrator. We will support that request under the agreement; we will not treat a Foundation receipt as if it were a marketing-site record.

The site and Foundation are for adults acting for a business. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

If we change this policy in a way that matters, we will post the new version here with a new effective date. A material change to how we handle customer data will also go to the contacts on the agreement.

Privacy questions: privacy@trucast.ai. Commercial questions: enterprise@trucast.app. Trucast Technologies Inc., Armonk, New York.

How Foundation handles data · Terms of Service