Privacy Policy

• Account information. When a customer creates a workspace, we collect the names, work email addresses, and login details of its team members, and the organization’s name and settings.
• Customer business data. Data a customer imports or connects, such as its customers, contacts, and orders from its accounting or ERP system, or from files it uploads.
• Prospect data. Business contact and company information (such as name, title, company, and business email address) that we source from third-party B2B data providers, such as Apollo.io, based on the criteria a customer sets.
• Connected mailbox data. When a customer connects a Google Workspace or Microsoft 365 mailbox, the data described in section 5.
• Usage data. Records of how the platform is used, such as sign-ins, actions taken in TruAris, and service logs.

We use information to provide and operate TruAris for our customers; to find and rank prospects; to draft, send, and track the outreach a customer approves; to link replies to conversations; to keep suppression lists accurate; to power AI-assisted features such as message drafts and reply translation and classification; to keep accounts secure; to respond to support requests; and to troubleshoot and improve the platform. We do not sell personal information and we do not use it for advertising.

TruAris uses Anthropic (Claude models) as its AI provider to draft messages, translate and classify replies, and suggest the next step. It receives only the data a feature needs, processes it to return a result to TruAris, and under its API terms does not use it to train its models. If we add or switch to another AI provider, we will update this policy before any data is sent to it.

We share information only with service providers that help us run TruAris, each bound by its own data protection terms:

• Amazon Web Services: hosting and storage.
• Vercel: hosting of the TruAris website and web app.
• Apollo.io and similar B2B data providers: prospect and company data.
• Anthropic: AI-assisted features (section 3).
• TrulyInbox: mailbox warm-up, for mailboxes where the customer turns it on (section 5).
• Google and Microsoft: the mailbox providers a customer connects. Google Workspace also delivers TruAris’s own notification emails.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply.

When a customer connects a Google Workspace or Microsoft 365 mailbox to TruAris, we access:

• the mailbox’s address, to confirm that the right account was connected;
• permission to send email from the mailbox, used only for outreach and replies the customer creates or approves in TruAris (including replies TruAris drafts and sends when the customer turns on automatic conversations), and for setup test messages between the customer’s own mailboxes;
• new messages that arrive in the mailbox: we read their headers (sender, recipients, subject, date, and message identifiers) to recognize replies, bounces, and unsubscribe requests, and we read the text of a message only to decide whether it is a reply to email the customer sent through TruAris and, for a message from an address the customer emailed through TruAris in the last 180 days, whether it asks the customer to stop writing;
• the mailbox’s list of folders, to tell incoming messages apart from copies of messages the customer sent.

We do not read attachments, and TruAris does not change, move, label, or delete any message in the mailbox. The one exception is the warm-up provider’s handling of its own warm-up messages, described under Warm-up below. When a Google mailbox is connected by signing in with Google or through Workspace delegation, TruAris asks only for permission to read messages, send messages, and see the mailbox’s labels. TruAris uses the labels permission only to read the mailbox’s list of folders, such as Inbox and Sent. It never creates, changes, or applies labels. A mailbox connected with an app password gives our mail sync service standard mail access, which TruAris uses only as described here.

How we use it. Only to provide TruAris’s features to the customer who connected the mailbox: sending the customer’s outreach from its own address, recognizing replies and stopping follow-ups when someone answers, recording bounces, unsubscribe requests, and written requests to stop so we stop writing to those addresses, showing replies to the customer’s team, and confirming that a newly connected mailbox is set up correctly. The only use that reaches other customers is the shared bounce list described under What we keep.

What we keep. Replies to the customer’s outreach, and the details of bounces and unsubscribe requests, are stored in the customer’s TruAris records. A reply TruAris cannot match to one conversation stays there for the customer’s team to place by hand, and is deleted 30 days after it arrived if no one places it. When an email bounces permanently, for example because the address does not exist, TruAris also adds the address to a shared bounce list, with the date of the first bounce and where it was found, so that no TruAris customer sends to it again. The list holds no message content. For any other message, we keep only an identifier and the fact that it was not a reply, and we delete even that after 30 days. When we check a message that is not a reply for a request to stop, we keep only the result and the AI’s one-line reason, never the message’s text. Mailbox passwords and access tokens are held only by our mail sync service, encrypted, and never in TruAris’s main database.

Warm-up. When a customer turns on warm-up for a mailbox, the mailbox owner connects it to TruAris’s warm-up provider, TrulyInbox, by signing in with Google or Microsoft on a page TrulyInbox hosts. TruAris never handles the mailbox’s password for this. The provider receives the mailbox’s address and access to the mailbox, and uses that access only to send, receive, and organize warm-up messages. It exchanges a small number of warm-up messages with other mailboxes in its network, moves its own warm-up messages out of spam, and files them in a separate folder, apart from the customer’s mail. It processes the mailbox under its own privacy and data protection terms. Turning warm-up off or disconnecting the mailbox removes the mailbox from the provider.

Sharing. We do not sell this data or use it for advertising. The text of replies is sent to our AI provider, Anthropic, to translate replies, classify their sentiment, suggest or decide the next step, and draft answers for the customer. The text of other messages from addresses the customer emailed through TruAris in the last 180 days is sent to Anthropic only to check whether they ask the customer to stop writing. Under Anthropic’s API terms, the data is not used to train its models and is deleted within 30 days. Amazon Web Services hosts TruAris. The warm-up provider receives what is described under Warm-up, for mailboxes with warm-up turned on. No one else receives mailbox data, unless the law requires it.

What we don’t do. We do not use this data to build or train generalized AI or machine learning models, and no person reads it except members of the customer’s own organization, or TruAris staff with the customer’s permission, for security, or to comply with the law.

Limited Use. TruAris’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and protection. TruAris runs in Amazon Web Services in the United States. Data is encrypted when it travels between you, TruAris, and the mail providers, and encrypted where it is stored. Mailbox credentials are encrypted with AES-256. Access to an organization’s data requires a signed-in member of that organization and is checked again inside the database.

Retention and deletion. Replies and conversation records stay while the customer uses TruAris. When an administrator disconnects a mailbox, TruAris deletes its credentials at once and withdraws its access at Google. Deleting a mailbox from TruAris deletes the data it produced. When a customer closes its account, its data is deleted within 30 days. Service logs are kept for 14 days. Anyone can ask for their data to be deleted by emailing support@truaris.com.

Revoking access. An administrator can disconnect a mailbox in TruAris at any time. Access can also be removed at the provider: in your Google Account (Security, Third-party apps with account access) for a mailbox connected by signing in with Google; in the Google Admin console (Security, API controls, Domain-wide delegation) for Workspace delegation; by deleting the app password for a mailbox connected with one; and for Microsoft 365, by an administrator removing TruAris under Enterprise applications in Microsoft Entra.

We protect data with encryption in transit and at rest, access controls that keep each organization’s data separate, and staff access that is restricted and logged. No system is perfectly secure; if a breach affects your data, we will notify you as the law requires.

We keep account and customer data while the customer’s account is active and as needed to provide the service, meet legal obligations, and resolve disputes. When a customer closes its account, we delete its data within 30 days, except where the law requires us to keep it. While an account is active, its unsubscribe and suppression records are kept so it never contacts an address that asked to stop.

Every outreach email sent through TruAris includes an unsubscribe link and supports one-click unsubscribe. Unsubscribing adds the address to the sending organization’s suppression list, and TruAris will not send outreach to it again. You can also email support@truaris.com and we will add your address for you.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to its use. Email support@truaris.com. If we hold your information on behalf of one of our customers, we will pass your request to that customer and help them respond.

We use only the cookies and similar storage needed to keep you signed in and to run the platform. We do not use advertising cookies.

Our own page-visit analytics store a random session identifier in your browser’s local storage and send TruAris, and only TruAris, the page address and title, the referring page, your browser and device details, the window size, and the time of each visit, plus a short signal every 30 seconds while the page is open, to measure time on the page. We do not use third-party analytics or advertising tools.

TruAris’s servers and data are hosted in the United States (Amazon Web Services, US West), and the website and web app are served by Vercel. By using TruAris, customers understand their data is processed in the United States.

TruAris is a business service and is not meant for anyone under 16.

We will post changes on this page and update the date above. If a change is significant, we will tell customers by email or in the platform.

TruStack Technologies Inc., 1914 Thomes Ave., Suite 2-3417, Cheyenne, WY 82001, United States. Email: support@truaris.com.