Privacy Policy

1. Introduction

Welcome to Trym Digital ("we," "us," "our," or "Company"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and services. This Privacy Policy explains our practices regarding data collection, usage, and protection.

By accessing and using our services, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy. If you do not agree with our practices, please do not use our services.

2. What Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Full name
• Company name (optional)
• Website information (monitored domains)
• Account creation date
• Last login information

2.2 Website Monitoring Data

When you authorize us to monitor your website, we collect:

• SEO metrics and analysis results
• Security scan outcomes
• Website performance data
• HTTP headers and SSL certificate information
• Publicly available website content metadata

2.3 Activity Data

We automatically collect:

• Login timestamps and frequency
• User presence and activity patterns
• Budget usage tracking (for admin features)
• Monthly usage statistics

2.4 Technical Information

Like most websites, we collect:

• IP addresses
• Browser type and version
• Device type and operating system
• Pages visited and time spent
• Referrer information

3. Instagram & Meta Integrations

3.2 What These Integrations Will Collect

When the Instagram and Meta integrations become available, we will collect (with your explicit consent):

• Account Information: Your Instagram business account profile data, followers count, and basic account details
• Post Metrics: Engagement rates, reach, impressions, likes, comments, and share counts
• Audience Data: Aggregated demographic information about your followers (age, location, language) - not individual-level data
• Content Performance: Performance analytics for posts, stories, and reels
• Hashtag Performance: Hashtag metrics and trending information relevant to your account
• Competitor Analysis: Publicly available data from competitor accounts (if you enable this feature)

3.3 Data NOT Collected

We will NOT collect or store:

• Direct messages or private communications
• Personal information of your followers (no email addresses, phone numbers, or private data)
• Login credentials or passwords
• Payment information for Instagram/Meta accounts

3.4 Permission & Consent

To use Instagram and Meta integrations, you will:

• Grant Trym Digital permission through Meta's official OAuth authentication
• Review and accept Meta's permissions dialog before connection
• Maintain control over the integration and can revoke access at any time through Instagram/Meta settings
• Receive a clear summary of what data we're accessing before authorization

3.5 How We Use Instagram Data

Data collected from Instagram and Meta will be used to:

• Generate performance analytics and insights
• Create recommendations for content strategy
• Provide competitive analysis reports
• Track hashtag performance and trends
• Generate historical trend reports
• Help optimize your social media strategy

3.6 Data Retention for Social Media

Instagram and Meta data will be retained as follows:

• Recent analytics: 90 days (continuously updated)
• Historical trends: 12 months (aggregated)
• Archive data: Available for export by user
• Upon account deletion: All associated data deleted within 30 days

4. How We Use Your Data

4.1 Service Delivery

We use your data to:

• Provide and maintain our services
• Monitor website performance and security
• Generate analytics and reports
• Track usage statistics and trends

4.2 Communication

We use your email to:

• Send account notifications (login alerts, password resets)
• Deliver requested reports and summaries
• Provide customer support responses
• Announce important service updates (security alerts, maintenance)

4.3 Improvement & Development

We use anonymized data to:

• Improve service quality and performance
• Develop new features
• Fix bugs and address issues
• Analyze usage patterns (aggregated, non-identifying)

4.4 Legal Compliance

We may use your data to:

• Comply with legal obligations
• Enforce our Terms of Service
• Protect against fraud and security threats
• Respond to lawful government requests

4.5 What We Will NOT Do

• Sell your personal data to third parties
• Share your data with marketing companies
• Use your data for purposes you haven't authorized
• Combine data with unrelated services without consent

5. Data Security

5.1 Security Measures

We implement industry-standard security practices:

• Encryption: All data transmitted via HTTPS/TLS encryption
• Database Security: Firebase Realtime Database with robust access controls
• Authentication: Firebase Authentication with secure token management
• API Security: Rate limiting, input validation, and protection against common attacks
• Access Control: Role-based permissions (admin vs. standard user)

5.2 Your Responsibilities

You are responsible for:

• Maintaining the confidentiality of your login credentials
• Using strong, unique passwords
• Logging out after using shared devices
• Notifying us of unauthorized access immediately

5.3 Data Breach Protocol

In the unlikely event of a security breach:

• We will notify affected users within 72 hours
• We will provide information about the breach and steps taken
• We will offer credit monitoring if applicable
• We will cooperate with relevant authorities

6. Your Rights

6.1 Access Your Data

You can:

• Request all your personal data
• Get a copy in a downloadable format
• Export all your historical data

6.2 Change or Delete Your Data

You can:

• Update your account information anytime
• Request we delete your personal data
• Delete your entire account

6.3 Control What We Collect

You can:

• Turn off optional emails
• Stop monitoring specific websites
• Disconnect social media connections
• Change privacy settings in your account

6.4 Revoke Access Anytime

For Instagram, Meta, or other connected services, you can disconnect them anytime in your account settings.

6.5 Legal Rights (EU, California, etc.)

If you're in the EU, California, or another jurisdiction with privacy laws:

• You can ask what data we have and why
• You can restrict how we use your data
• You can object to certain uses
• You can request a human review of any decisions we make about you

7. Cookies & Tracking

7.1 Browser Cookies

We use cookies for:

• Authentication: To remember your login session
• Preferences: To store your display and notification preferences
• Analytics: To understand how you use our service (via Google Analytics)

7.2 Types of Cookies

• Essential: Required for service functionality
• Analytical: Help us understand usage patterns
• Performance: Optimize loading and responsiveness

7.3 Cookie Management

You can:

• Disable cookies in your browser settings
• Clear cookies at any time
• Use private/incognito browsing mode
• Note: Disabling essential cookies may affect service functionality

7.4 Error monitoring

We use Sentry for privacy-scrubbed application error reporting. Sentry helps us identify and fix failures without intentionally collecting form values, authentication credentials, AI prompts, scan payloads, or full page URLs. Error data is sent to Sentry's EU infrastructure. We do not use Google Analytics or other third-party analytics trackers.

8. Third-Party Services

8.1 Service Providers

We use the following third-party processors to deliver our platform. Your data passes through these services only to the extent needed to run the product � it is never sold to them or used for their own marketing purposes.

• Firebase (Google): Realtime database, authentication, and data storage. Data is stored in Google Cloud infrastructure. Data residency region: please contact us to confirm � we are verifying our Firebase console configuration before publishing a specific region claim.
• OpenAI: AI-powered SEO and security analysis, health report generation, and the AI assistant. Your website URLs and scan data are sent to OpenAI to generate recommendations. OpenAI processes this under their API data usage policy (data is not used to train models under current API terms).
• Resend: Transactional email delivery. Your email address and name are passed to Resend to send account notifications, billing emails, and monthly summaries.
• Stripe: Payment processing and subscription management. Stripe handles all billing � we do not store card numbers. Your name, email, and subscription details are held by Stripe under their own privacy policy.
• Sentry: Application error monitoring. Privacy-scrubbed error reports and performance traces are sent to Sentry's EU infrastructure to help us identify and fix bugs. Sentry is configured to avoid capturing form values, authentication credentials, or full page URLs.
• DigitalOcean: Serverless functions that run our scanning, AI, and payment processes. Data processed by our functions passes through DigitalOcean's infrastructure.

8.2 Instagram & Meta

When you connect Instagram/Meta integrations, you also agree to Meta Platforms' Privacy Policy and Terms. Meta may process your data according to their policies.

8.3 Data Sharing

Your data is shared with these service providers only to the extent necessary to provide services. We:

• Use data processing agreements with all vendors
• Require vendors to maintain similar security standards
• Never share your data for their marketing purposes
• Ensure vendors comply with data protection laws

8.4 Links to Third Parties

Our platform may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before sharing information.

9. Children's Privacy

Trym Digital is not intended for children under 13 years old. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will:

• Delete the data immediately
• Not use it for any purpose
• Notify parents/guardians if feasible

For users between 13-18, we provide additional privacy protections and may require parental consent depending on jurisdiction.

10. Policy Changes

10.1 Updates to This Policy

We may update this Privacy Policy to reflect:

• Changes to our services
• New feature releases (like Instagram/Meta integrations)
• Changes in applicable laws
• Improvements in data protection practices

10.2 Notification

When we make material changes, we will:

• Update the "Last Updated" date at the top
• Notify you via email if changes significantly affect your privacy
• Require your consent for major changes

10.3 Your Options

If you disagree with policy changes, you can:

• Request deletion of your account
• Export your data before the change takes effect
• Contact us to discuss concerns

11. Security & Data Practices

What data we store and why

Trym Portal stores the following information to deliver the service:

• Account data � your name, email address, and plan details, held in Firebase and Stripe.
• Website and scan data � the URLs you add for monitoring, and the results of every SEO and security scan you run. Scan history accumulates over time and is not automatically deleted or pruned. If you want your data deleted, see our data deletion policy.
• Uptime monitoring data � status checks are recorded roughly every 5 minutes. History is capped at 288 records per monitored site (approximately 24 hours).
• Usage and quota data � monthly scan counts stored under your account to enforce plan limits.

Where your data is stored

Your data is stored in Google Firebase (database and authentication) and processed through DigitalOcean serverless functions. Firebase data residency region: we are confirming our exact Firebase console configuration before publishing a specific region � please contact us at [email protected] if you need to confirm data residency for compliance purposes. Error telemetry is sent to Sentry's EU infrastructure.

Data retention � current reality

Scan history (SEO and security results) is retained indefinitely in Firebase and is not automatically cleaned up. The dashboard applies display-only limits depending on your plan, but the underlying records remain. We are building automatic retention and cleanup � until that is live, your full scan history accumulates. You can request deletion of all your data at any time via our data deletion policy.

Is your data sold?

No. Your data is never sold to third parties or used for advertising. Third-party processors listed in section 8 receive your data only to the extent required to deliver the service (for example, your website URL is sent to OpenAI to generate scan recommendations). None of them receive your data for their own marketing or resale.

How to request deletion

To delete your account and all associated data, see our Data Deletion Policy for the step-by-step process. You can also email [email protected] with the subject "Account deletion request."

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

11.2 Regulatory Authorities

If you believe your rights have been violated, you have the right to file a complaint with your local data protection authority:

• EU: Your national data protection authority
• USA (California): California Privacy Protection Agency (CPPA)
• USA (Other States): Relevant state attorney general