Privacy Policy

itstru.ai ("we", "us", "itstru") operates the website at itstru.ai and the validation service offered through it. We are based in Canada and our contact email is support@itstru.ai.

This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have. We aim to be plain-spoken. If something is unclear, email us and we will explain it.

1. What we collect

We only collect what we need to deliver the service:

• Contact info you give us: name, email, phone number, business / app name, and the description of your idea you submit through the questionnaire.
• Account info: if you log in to the client portal, we store a hashed password and session token. We never see or store your raw password.
• Payment info: processed entirely by Stripe. We receive a Stripe customer ID, the last four digits of the card, and the amount paid. We never see or store full card numbers.
• Booking info: the consultation date and time you choose, stored both on our database and in our Google Calendar.
• Email correspondence: any messages you send to support@itstru.ai.
• Basic technical data: standard server logs (IP address, browser, page accessed, timestamp) used to keep the site running and detect abuse.

We do not use ad-tracking pixels, run third-party advertising scripts, or sell your information.

2. Why we collect it

• To deliver the service you paid for (consultation, research, prototype).
• To process your payment and issue refunds.
• To send you transactional email (booking confirmations, deliverable-ready notifications, password resets).
• To respond to your support requests.
• To meet our legal and tax obligations.

Our legal bases are contract (delivering what you bought), legitimate interest (running and securing the site), and legal obligation (tax, accounting). Where consent is required, we ask for it explicitly.

3. Who we share it with

We use a small number of vetted service providers ("sub-processors") to run the service. They only receive the data they need to do their job, and they are contractually bound to protect it.

Some of these providers store data outside Canada. By using the service you acknowledge this cross-border transfer. We choose reputable providers and rely on the contractual protections they offer to keep your data safe in transit and at rest.

We do not share your information with anyone else, except where required by law (court order, regulator) or to protect our legal rights.

4. AI generation and your project data

The questionnaire you submit, plus context we generate from it, is sent to Anthropic's API to produce your market research, business summary, and clickable prototype. Anthropic processes this data on our behalf and, under their commercial API terms, does not use it to train their models.

We retain copies of your questionnaire and the generated deliverables in our database so we can deliver them to you, support you afterwards, and improve our process. They are not shared publicly or with other clients.

5. How long we keep it

• Active client data (questionnaire, deliverables, account): kept for as long as you have an active relationship with us.
• Inactive accounts: kept for up to 7 years from your last interaction so we can meet Canadian tax-record-keeping obligations and answer follow-up questions about past work.
• Payment records: kept for 7 years per Canadian tax law.
• Server logs: rotated and deleted within 90 days.

You can ask us to anonymize or remove your account data sooner — see Your rights below.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal information (subject to records we are legally required to keep, such as payment receipts).
• Withdraw consent for marketing email at any time (every marketing email contains an unsubscribe link).
• Port your data — get a copy in a portable format.
• Object to certain processing.
• Know if automation is involved. A human reviews every deliverable before it is sent — no decision about you is fully automated.

To exercise any of these rights, email support@itstru.ai from the address on file. We respond within 30 days.

7. If you're in the U.S.

itstru.ai is based in Canada, but we're happy to work with clients in the United States and we want you to feel comfortable here. The same rights listed above — access, correction, deletion, a copy of your data, and opting out of marketing — apply to you. Just email us and we'll take care of it.

We do not sell your personal information. We do not share it for advertising. We do not use your information to train third-party AI models.

8. Email

Transactional email — receipts, booking confirmations, deliverable notifications, and other messages directly tied to your project — is part of the service. We don't send unsolicited marketing email. If we ever send something promotional, it will clearly say so and include a one-click unsubscribe link, which we honor promptly.

9. Cookies

We use a small number of strictly necessary cookies to keep you signed in to the client portal and to maintain your session through Stripe checkout. We do not use advertising cookies, analytics cookies, or third-party tracking pixels.

10. Security

Data is encrypted in transit (HTTPS) and at rest by our database and hosting providers. Passwords are stored hashed with industry-standard algorithms. Access to production systems is restricted to authorized personnel. No system is perfectly secure, so if we ever discover a breach affecting your data we will notify you and the relevant regulators without unreasonable delay.

11. Children

The service is intended for adults building businesses. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. International users

itstru.ai is operated from Canada and our service providers are based in Canada, the United States, and the European Union. By using the service, you understand that your information may be processed in any of these places. We choose providers that take privacy seriously and we hold them to the same standards we hold ourselves to.

13. Changes to this policy

If we make a material change, we will update the "Last updated" date at the top of this page and, for substantive changes affecting active clients, email you. Continued use of the service after a change means you accept the updated policy.

14. Contact and complaints

Privacy questions, requests, or complaints: support@itstru.ai. We acknowledge requests within 5 business days and respond within 30 days.

If you are not satisfied with our response, you can contact:

• Office of the Privacy Commissioner of Canada — priv.gc.ca
• Commission d'accès à l'information du Québec (for Quebec residents) — cai.gouv.qc.ca
• For residents of other countries, your local data protection authority.