This Privacy Policy explains what information Truffle collects, how we use it, how we protect it, and the choices you have. Truffle is operated by Two Trick Pony Enterprise, a sole proprietorship (*eenmanszaak*) registered in the Netherlands with the Chamber of Commerce under number 89010701, with its registered address at Lloyd Webberhof 15, Utrecht, Netherlands ("Truffle", "we", "us", or "our").

This policy applies to Truffle and the website at asktruffle.com.

What information we collect

Account information

When you create or use a Truffle account, we may collect information such as your name, email address, organization name, account details, and information needed to authenticate and manage your account.

Organization and user information

If you use Truffle as part of an organization, we may collect information about the organization and its users, such as names, email addresses, workspace identifiers, membership information, roles, and account activity.

Connected sources

Truffle allows organizations to connect sources such as GitHub repositories, documentation, API specifications, and other data sources.

Depending on the source and permissions you grant, this may include source code, file names, repository metadata, documentation, API specifications, commit information, and other content available through the connected source.

Questions and generated answers

We process questions submitted to Truffle and the resulting answers in order to provide the service. This may include conversation history and information retrieved from your connected sources.

AI provider credentials

Truffle may allow you to provide API credentials for third-party AI providers through our "Bring Your Own Key" functionality.

These credentials are stored securely and are used only to make requests to the provider on your behalf. We do not use your credentials for unrelated purposes.

You remain responsible for ensuring that you are authorized to provide and use those credentials.

Billing information

If you subscribe to a paid Truffle plan, payment information is processed by Stripe. We generally do not receive or store complete payment card numbers.

We may receive information from Stripe such as your billing details, subscription status, invoices, payment status, and limited payment information needed to manage your subscription.

Usage and technical information

We collect technical and usage information needed to operate, secure, and improve Truffle. This may include IP addresses, browser and device information, timestamps, request information, error logs, feature usage, and service performance information.

Analytics

We use PostHog to understand how people use Truffle and to improve the product. Depending on your interaction with the service, this may include information about pages visited, features used, events, approximate location derived from IP address, and technical information about your device or browser.

How we use information

We use information to:

provide and operate Truffle;
authenticate users and manage organizations;
connect to and index authorized data sources;
answer questions and generate requested outputs;
provide customer support;
process subscriptions and payments;
measure usage and enforce plan limits;
monitor performance and troubleshoot problems;
detect and prevent fraud, abuse, and security incidents;
improve and develop Truffle;
communicate with you about your account or the service; and
comply with applicable legal obligations.

Your code and customer content

Code, documentation, repositories, API specifications, messages, and other information that an organization connects to Truffle remain the property of that organization or its licensors.

We process this information only as necessary to provide Truffle and the functionality requested by the organization.

We do not sell customer code or other customer content.

We do not use customer code or customer content to train general-purpose artificial intelligence models.

Customer content may be processed by our infrastructure and AI providers where necessary to provide the service. The applicable providers are described below.

AI processing

Truffle uses artificial intelligence to answer questions and perform other requested tasks.

Depending on the organization's configuration, requests may be processed by Anthropic, OpenAI, or another AI provider made available through Truffle.

When Truffle uses an AI provider, information necessary to generate the requested response may be sent to that provider. This can include the question, relevant conversation context, and relevant portions of connected customer content.

We select providers and configurations intended to prevent customer content from being used to train general-purpose models. The privacy practices and terms of the applicable AI provider may also apply.

Bring Your Own Key

If you choose to connect your own AI provider credentials, Truffle uses those credentials to make requests to the provider you selected.

In this configuration, the applicable AI provider processes the request according to its own terms and privacy policies and the account or agreement associated with your credentials.

Truffle does not control how a third-party provider processes information under your own provider account.

Service providers

We use trusted third-party providers to operate Truffle. These providers may process personal data or customer content on our behalf where necessary to provide their services.

Our current principal service providers include:

Amazon Web Services (AWS) — hosting, compute, storage, and database infrastructure.
Upstash — caching and related infrastructure.
Qdrant — vector database and similarity-search infrastructure used for retrieving information from indexed sources.
Anthropic — AI model infrastructure used by Truffle.
OpenAI — AI model infrastructure and, where applicable, fallback or embedding services.
PostHog — product analytics and usage analysis.
Stripe — subscription management and payment processing.

We may add, replace, or remove service providers as Truffle evolves. Where required by applicable law, we will provide appropriate information about material changes to our subprocessors.

Third-party integrations

Truffle may integrate with third-party services such as GitHub and Slack.

When you authorize an integration, we access information according to the permissions granted to Truffle and use that information to provide the functionality you requested.

Third-party services have their own privacy policies and terms. We are not responsible for the privacy practices of services that we do not control.

Legal bases for processing

Where the General Data Protection Regulation ("GDPR") applies, we process personal data on one or more of the following legal bases:

Contract — where processing is necessary to provide Truffle or perform our agreement with you or your organization.
Legitimate interests — where necessary to operate, secure, improve, and develop our service, prevent abuse, or communicate with customers, while balancing those interests against your rights.
Legal obligation — where processing is required by law.
Consent — where we rely on your consent, for example where required for certain optional communications or analytics.

Data retention

We retain personal data and customer content for as long as necessary to provide the service, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements.

When an organization disconnects a data source, we may retain certain information for a limited period where necessary for backups, security, auditing, or legal obligations.

When an account or organization is closed, we may delete associated customer content and personal data, subject to legal obligations, legitimate business records, backups, and any applicable agreement.

International data transfers

Some of our service providers may process information outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we rely on an applicable legal mechanism for the transfer, such as an adequacy decision, Standard Contractual Clauses, or another mechanism permitted under applicable data protection law.

Security

We use reasonable technical and organizational measures designed to protect personal data and customer content against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include access controls, encryption, authentication, logging, monitoring, and other security practices appropriate to the nature of the information we process.

No internet-based service can guarantee absolute security.

Your rights

If the GDPR or another applicable data protection law applies to you, you may have rights including the right to:

request access to your personal data;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to certain processing;
receive certain personal data in a portable format; and
withdraw consent where processing is based on consent.

To exercise these rights, contact us at privacy@asktruffle.com.

If you use Truffle through an organization, that organization may control the account and certain personal data processed through it. In that case, you may also need to contact your organization to exercise your rights.

You also have the right to lodge a complaint with the data protection authority responsible for your country. In the Netherlands, this is the Autoriteit Persoonsgegevens.

Cookies and similar technologies

Truffle may use cookies and similar technologies that are necessary for authentication, security, session management, preferences, and analytics.

Where required by law, we will request consent before using non-essential cookies or similar technologies.

Children

Truffle is a business service and is not intended for children. We do not knowingly collect personal data from children in connection with the provision of the service.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in Truffle, our service providers, legal requirements, or our data practices.

When we make material changes, we will provide reasonable notice where appropriate and update the "Last updated" date at the top of this page.

Contact

Two Trick Pony Enterprise
Lloyd Webberhof 15
Utrecht
Netherlands

Privacy questions or requests? privacy@asktruffle.com