Legal

Privacy Policy

Last updated: July 12, 2026

Truthbased (“we”, “us”) provides a governed fact store for brands: we crawl content you point us at, extract verifiable facts, hold them for your review, and serve the approved facts to AI systems and public pages. This policy explains what personal data we process to do that, and the rights you have over it. Truthbased is operated from Luxembourg and this policy is written to the standard of the EU General Data Protection Regulation (GDPR).

What we collect

  • Account data — your name, email address, and password hash (or, if you sign in with Google, the name and email Google shares with us). We never see or store your Google password.
  • Workspace content — the websites you ask us to crawl, the facts extracted from them, articles, and review decisions. This is business content about your brand; it should not contain personal data, and we do not mine it for any purpose other than providing the service.
  • Provider API keys — LLM keys you add (OpenAI, Anthropic, Perplexity, OpenRouter) are encrypted at rest with AES-256-GCM and used only to run the extractions, syntheses, and inspections you trigger.
  • Usage data — operational events (pages crawled, tokens consumed, plan quotas) tied to your workspace, used for quota enforcement and billing.
  • Cookies — a session cookie to keep you signed in. No advertising or cross-site tracking cookies.

What we do with it

We use your data solely to operate Truthbased: authenticate you, run the crawling and extraction pipeline you configure, send transactional email (workspace invitations, crawl notifications), enforce plan limits, and keep the service secure. We do not sell personal data, and we do not use your content to train models.

Processors we rely on

  • Hetzner Online GmbH (Germany/EU) — application and database hosting.
  • Resend — transactional email delivery.
  • Jina Reader — rendering of JavaScript-heavy pages during crawls (receives only the public URLs you asked us to crawl).
  • LLM providers you configure (OpenAI, Anthropic, Perplexity, OpenRouter) — receive the page content being processed, under your own account and keys.

Retention

Account and workspace data are kept while your account is active. If you delete a workspace or your account, the associated content is deleted from the live database; encrypted backups age out within 30 days. Usage records may be retained longer where required for accounting.

Your rights

Under the GDPR you can request access to, correction of, export of, or deletion of your personal data, object to or restrict processing, and lodge a complaint with your supervisory authority (in Luxembourg, the CNPD). To exercise any of these, contact us and we will respond within 30 days.

Contact

Privacy questions and requests: reach us on X at @vineetdevaiah or through your workspace’s support channel.

Changes

If we change this policy in a way that matters, we will note the new date above and, for significant changes, notify account owners by email.