Privacy Policy

Last updated: July 2026

1. Who We Are

TrustCloud operates SA Analyzer at https://www.trustcloud.ai. We are the Data Controller for personal data collected through this service. Contact us at akshay@trustcloud.ai.

2. What Data We Collect

To use the analyzer you first upload a security questionnaire. We then process:

• Uploaded file contents — the text is extracted and analysed to generate your report (see Section 5). The file itself is deleted immediately after extraction.

After the analysis is complete, you may choose to unlock the full report and PDF by providing:

• Full name — to personalise your report
• Email address — to give you access to, and (where enabled) send you, your full report

Providing your name and email is optional — you can view the summary analysis without it. We do not collect IP addresses for tracking, set advertising cookies, or build user profiles.

3. Lawful Basis for Processing

We process your personal data on the basis of our legitimate interests (Article 6(1)(f) GDPR): to provide the analysis you have requested, to give you access to and deliver your report, and to understand and improve usage of the service, and to produce anonymous, aggregated quality statistics and benchmarks. We have assessed that this processing is necessary for these purposes and is not overridden by your interests or fundamental rights. You may object to this processing at any time (see Section 8).

4. How We Use Your Data

• To generate your security questionnaire quality report
• To give you access to the full report and PDF, and — where email delivery is enabled — to send it to you
• To maintain internal usage and cost records for operating and improving the service
• To benchmark your result against aggregate statistics, and to publish anonymous, aggregated insights (see Section 5)
• To record optional section feedback (thumbs up/down) you choose to give, to improve output quality
• We do not sell, rent, or share your data with third parties for marketing

5. Aggregate Statistics, Benchmarking & Feedback

To operate and improve the service we retain the quality scores produced for each analysis (the overall score and grade, the per-dimension scores, and the general category headings of any gaps identified) together with the document type. We use this in three ways:

• Benchmarking: to show how your result compares with the wider set of assessments we have analyzed (for example, “better than 72% of assessments”). This comparison uses numeric scores only — never the content of any document.
• Aggregate insights: we may publish anonymous, aggregated statistics — such as score distributions, average scores per dimension, and the most common gaps — on a public page. These are pooled across many assessments; no figure is derived from, or attributable to, any single submission, company, file, or person, and aggregates are only published once a category contains enough assessments to prevent re-identification.
• Feedback: if you use the thumbs-up / thumbs-down controls on a report section, we record that rating and the section it relates to, to measure and improve output quality. No additional personal data is recorded with your feedback.

Scores and feedback used for benchmarking and aggregate insights are not linked to your name or email in any published output. To have your associated records removed, see Section 9.

6. Third-Party Processing: OpenAI

The text extracted from your uploaded file is sent to OpenAI (OpenAI, L.L.C. (USA)) via their API to generate the analysis. This constitutes an international transfer of data to the United States, carried out under the provider's data processing terms, which rely on Standard Contractual Clauses (SCCs) as the transfer mechanism.

OpenAI's data handling: https://openai.com/policies/api-data-usage-policies

Your uploaded file is deleted from our servers immediately after text extraction. The extracted text is sent to OpenAI to produce the analysis and is not stored by us afterwards.

7. Cookies

We use one essential cookie only: a PHP session cookie (PHPSESSID) that temporarily holds your analysis result so it can be displayed after processing. This cookie:

• Is essential for the site to function — no consent is required under PECR/ePrivacy for essential cookies
• Contains no personal data — only a random session identifier
• Expires when you close your browser
• Is not used for tracking, analytics, or advertising

We do not use Google Analytics, advertising pixels, or any other tracking cookies.

8. Data Retention

• Uploaded files: Deleted immediately after text extraction (within seconds of upload)
• Extracted questionnaire text: Sent to OpenAI and not retained by us
• Usage records: If you provide your name and email, they may be stored alongside operational metadata (file name, quality scores including per-dimension scores and gap categories, model, token/cost usage) in our usage log for service operation, benchmarking and analytics. Any section feedback you give is stored separately and is not linked to your name or email.
• Session data: Cleared when you close your browser

9. Your Rights Under GDPR

If you are in the EU/EEA or UK, you have the right to:

• Access — request a copy of any personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request that we limit processing of your data
• Portability — request your data in a portable format
• Object — object to processing carried out on the basis of our legitimate interests

To exercise any right, email akshay@trustcloud.ai. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority (e.g., the ICO in the UK, or your EU supervisory authority).

10. Security

We use HTTPS for all data in transit. Uploaded files are stored only in a secure temporary directory and deleted immediately after processing. We do not maintain a database of your questionnaire content.

11. Changes to This Policy

We may update this policy. The "Last updated" date at the top will reflect any changes. Continued use of the service constitutes acceptance of the updated policy.

12. Contact

TrustCloud
Your registered company address here
akshay@trustcloud.ai