TTruefold

Privacy Policy

Last updated: May 24, 2026

This Privacy Policy explains how Truefold(“Truefold,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use the Truefold application at app.truefold.aiand related services (the “Service”). Truefold is a data-management platform that connects to your data warehouse and marketing and commerce platforms to automatically generate a semantic layer (a documented map of your metrics and dimensions) with an administrative interface.

If you have questions about this policy or your data, contact us at privacy@truefold.ai.

1. Information we collect

Account information

When you create an account we collect your name, email address, organization name, and an authentication credential (your password is hashed and managed by our authentication provider; we never see it in plaintext).

Connection credentials

To provide the Service you connect data sources. Depending on the source, this includes a Google BigQuery service-account key, OAuth access and refresh tokens (for Google Ads, Meta, and Shopify), or an API key (for Klaviyo). These credentials are encrypted at rest and are used only to access the accounts you authorize on your behalf.

Data accessed from your connected sources

How we handle the data in a connected source depends on the source type:

  • Your own data warehouse (e.g. Google BigQuery). We read schema metadata (table names, column names, and data types) and a limited number of sample values to build and maintain your semantic layer. We do not copy or warehouse your full datasets — they stay in your warehouse and we query them in place when you ask.
  • Marketing and commerce platforms (Google Ads, Meta, Shopify, Klaviyo). For these sources we import and store the data you authorize — such as campaigns, performance metrics, orders, and events — in Truefold-controlled Google BigQuery, in a dataset isolated to your organization. We do this to build your semantic layer over that data and run the analytics you request without repeatedly calling the source. We import only what is needed to provide the Service.

Usage and technical data

We collect application logs, IP address, browser and device information, and records of actions taken in the Service for security, debugging, and product improvement. We do not log credentials, tokens, or full query results.

2. Google user data and Limited Use

When you connect Google Ads, you authorize Truefold to access certain Google account data through the Google Ads API using the scopes shown on the consent screen. We use this data only to provide the features you request — generating and maintaining your semantic layer and running the analytical queries you initiate.

Truefold’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data received from Google APIs is:

  • used only to provide or improve user-facing features that are prominent in the Service;
  • not transferred or sold to third parties, except to the sub-processors listed below who process it on our behalf to operate the Service, or where required for security or to comply with applicable law;
  • not used for advertising purposes; and
  • not read by humans unless we have your consent, it is necessary for security or to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

3. How we use information

  • To provide, operate, and maintain the Service, including generating your semantic layer;
  • To authenticate you and secure your account and connections;
  • To respond to support requests and communicate with you about the Service;
  • To monitor, debug, and improve reliability, performance, and security;
  • To comply with legal obligations and enforce our terms.

4. Sub-processors and sharing

We do not sell your personal information. We share data only with service providers who process it on our behalf under contractual confidentiality and security obligations:

  • Google Cloud (BigQuery, Key Management Service) — data warehouse access and credential encryption;
  • Supabase — authentication and application database;
  • Vercel — frontend hosting;
  • Railway — backend application hosting;
  • AI/LLM providers (e.g., Anthropic) — schema metadata and a limited number of sample values may be sent to a large-language-model provider to automatically generate the descriptions, metrics, and dimensions in your semantic layer.

We may also disclose information if required by law, to protect our rights or the safety of users, or in connection with a merger or acquisition (with notice to you where required).

5. Data retention

We retain account information, connection credentials, generated semantic-layer content, and any data imported from your connected sources for as long as your account is active. Disconnecting a source stops further syncing; to erase the credentials and imported data for a source, or your whole account, follow our Data Deletion instructions, which we process within 30 days. We may retain limited records where necessary to comply with legal obligations or resolve disputes.

6. Security

We protect your information with encryption of credentials at rest, encryption in transit, row-level access controls scoped to your organization, and least-privilege access for internal systems. No method of transmission or storage is completely secure, but we work to protect your data and continually improve our safeguards.

7. Your rights and choices

You may access, correct, export, or delete your information. You can disconnect a data source at any time from within the Service, which stops any further syncing from that source. To permanently delete the stored credentials and any imported data for a source — or your account and all associated data — follow our Data Deletion instructions or email privacy@truefold.ai. Depending on your location, you may have additional rights under applicable data-protection laws.

8. International data transfers

Truefold and its sub-processors may process and store information in countries other than the one in which you are located. Where required, we rely on appropriate safeguards for such transfers.

9. Children

The Service is not directed to individuals under 18, and we do not knowingly collect information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service.

11. Contact us

Questions or requests regarding this policy or your data can be sent to privacy@truefold.ai.