{ "kind": "privacy", "version": "2026-10-19", "revision": 1, "locale": "en", "title": "Privacy Policy", "effective": "2026-10-19", "sourceRecordedAt": null, "url": "https://trumpets.ai/privacy/2026-10-19", "source": null, "sha256": "133c22138bb75604f9c41d7431602e99c784449de2f9387e778ce043c06abc1e", "text": "Privacy Policy\n\nVersion: 2026-10-19\nEffective: October 19, 2026\n\nThis Privacy Policy, version 2026-10-19, explains how Piotr Hasooni-Abood, conducting business under the name SMASHING DIVS, processes personal data when you visit Trumpets, use the platform or its API, or use a Trumpets-powered App operated by us. It also explains when we act only on a customer's instructions and what rights you have.\n\n1 · Scope and controller\n\nThe controller for the processing described in this Policy is Piotr Hasooni-Abood, conducting business under the name SMASHING DIVS, EU VAT ID PL9930619827, Stanisława Moniuszki 26, 33-100 Tarnów, Poland. In this Policy, \"SMASHING DIVS\", \"Trumpets\", \"we\", and \"us\" refer to that operator. This Policy is also available in Polish (https://trumpets.ai/pl/polityka-prywatnosci/2026-10-19).\n\nThis Policy covers trumpets.ai, the Trumpets Dashboard, agent and workflow runtime APIs, and company-operated products that link here, including Trumpets-powered Apps (together, the \"Services\"). A third-party website, model, connector, or service has its own privacy terms when you use it independently or connect it under your own account.\n\nQuestions and data protection requests can be sent to hello@trumpets.ai.\n\n2 · Our data protection roles\n\nWe act as a controller when we decide why and how to process account, subscription, billing, security, support, product usage, website, and marketing data. We also normally act as controller for Customer Content that an individual Consumer submits about themselves to receive a Service for personal or household purposes. This Policy describes that processing.\n\nWe normally act as a processor when a business, professional, or organization uses the Services to process personal data contained in prompts, files, knowledge sources, workflow inputs, tool results, or generated outputs (\"Customer Content\"). That customer decides the purpose of the processing and is the controller, or is itself a processor authorized by another controller. Our Data Processing Addendum in the Terms of Service (https://trumpets.ai/terms#data-processing-addendum) applies to that processing.\n\nIf your personal data was submitted by one of our customers, direct your request to that customer first. We will assist the customer as required by data protection law.\n\n3 · Personal data we process\n\nThe data depends on the Service and features you use.\n\n- Account and identity data. Name, email address, authentication identifiers, email verification status, preferred language, organization, role, invitations, and profile settings. If you sign in with Google or another identity provider, we receive the identifiers and profile information that provider makes available for authentication. We also keep append-only evidence of the Terms version you accepted, the acceptance time, method, and locale.\n- Workspace and configuration data. Organizations, projects, agents, system instructions, workflows, schedules, processors, validators, API keys, model choices, tool and MCP connections, and team permissions.\n- Customer Content. Prompts, messages, model responses, documents, images, audio, knowledge sources, training and evaluation assets, embeddings, generated files, feedback, run inputs, tool results, and other material processed at your direction.\n- App-specific content. Depending on the App, this can include legal drafts and matter sources, manuscripts and narration projects, voice samples, resumes, job postings, interview dates, practice answers, research notes, and generated coaching or analysis.\n- Integration data. Connection status, the selected integration and its permissions, account references, the files, pages, or channels an owner or administrator permits, Agent selections, and content retrieved from or sent to a service you connect. For integrations connected through Pipedream (Google Workspace, Notion, and Slack), Pipedream holds the OAuth grant and its access and refresh tokens; Trumpets stores an opaque account reference, not the tokens. A read-only Cloud Connection can process cloud account, project, tenant, subscription, region, role, role-assignment, service-account, and resource identifiers, along with resource names, types, locations, labels, tags, and optional cost metadata returned by GCP, Azure, or AWS. For Google Cloud, reads use a service account you create in your own project, reached through short-lived delegated impersonation via a Trumpets broker identity - we never hold a service-account key, and the broker cannot read your projects by itself. Setup proof data and encrypted connector credentials, such as those for an MCP server you connect, are also processed where the provider flow requires them.\n- Billing and transaction data. Plan and Usage Points balances, subscription status, usage, transaction and invoice references, Stripe customer, checkout, PaymentIntent, and saved payment-method identifiers, currency, tax status, and payment outcome. For a paid checkout or Auto-recharge authorization, we record the approved package terms and limits, the versioned express request for immediate performance, the withdrawal acknowledgement, and the automatic-charge authorization shown before payment. Card details are collected by Stripe, not stored by us in full.\n- Usage, device, and log data. IP address, browser and device information, timestamps, pages and features used, run and step logs, model and token usage, latency, errors, security events, and audit records.\n- Support data. Messages with us and information you choose to include in an issue report. An App issue report may include the current sanitized page URL, recent console messages, technical context, and, only when you choose it, a screenshot.\n- Marketing data. Newsletter email, subscription and unsubscribe status, consent record, signup source, and campaign attribution data. We use double opt-in for the newsletter.\n\n4 · Where data comes from\n\n- Directly from you when you register, configure, upload, connect, buy, or contact us.\n- From your organization's administrators and colleagues when they invite you, assign a role, share workspace material, or configure an integration.\n- From identity, payment, cloud, analytics, model, and integration providers involved in delivering a feature, including Pipedream when you connect an integration through it.\n- From public sources when a feature performs web or company research, including a URL, public page, or Google Search result requested by a user.\n- Automatically from your browser, device, and use of the Services.\n\n5 · Purposes and legal bases\n\n- Provide the Services and manage accounts. To register users, authenticate access, create workspaces, execute requested agents and workflows, store content, run integrations, provide support, and administer paid plans. The basis is performance of a contract or steps requested before a contract (Article 6(1)(b) GDPR). For users of a business customer, the basis is our legitimate interest in delivering and administering that customer's service (Article 6(1)(f)).\n- Bill and keep required records. To process payments, allocate usage, prevent duplicate or fraudulent transactions, issue records, and meet tax and accounting duties. The bases are contract, legal obligation (Article 6(1)(c)), and our legitimate interest in protecting revenue and resolving disputes.\n- Secure, troubleshoot, and improve reliability. To prevent abuse, investigate incidents, debug failures, measure performance, audit administrator actions, and improve the Services using operational or aggregated metrics. The basis is our legitimate interest in providing a secure and reliable service. We do not use this basis to repurpose Customer Content for unrelated model training.\n- Communicate about the Service. To send verification, invitation, security, billing, support, and material service notices. The bases are contract and our legitimate interest in administering the Services.\n- Newsletter and optional marketing. To send material you requested. The basis is consent (Article 6(1)(a)). You can withdraw consent at any time without affecting earlier lawful processing.\n- Web analytics. To understand visits and conversions where the analytics feature is enabled. Google Analytics and PostHog code, storage, and measurement requests are activated only after your consent (Article 6(1)(a) GDPR, together with the Polish rules on storing information on terminal equipment).\n- Legal compliance and claims. To respond to lawful requests, enforce agreements, and establish, exercise, or defend legal claims. The bases are legal obligation and legitimate interests.\n\nLegitimate interests\n\nWhere we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against the impact on individuals. You may object as explained in section 13.\n\n6 · Customer Content and AI processing\n\nThe Services send the instructions, context, files, tool results, or other content needed for a requested operation to the selected model or tool provider. Depending on the feature, processing can include generation, extraction, classification, embedding, search grounding, document creation, image generation, audio generation, or evaluation.\n\nWe do not use Customer Content to train our own general-purpose model. We do not offer provider training on Customer Content as a Trumpets product feature. Model providers can retain content or metadata for limited security and abuse-monitoring purposes, and their treatment varies by provider, selected model, commercial plan, and privacy configuration. The provider can also change when you select a different model. Do not assume that every model or connector has identical retention or data residency.\n\nGoogle Search grounding and other web research features send the query and necessary context to the search provider. Search processing is not guaranteed to remain in the EEA, even where the rest of an App uses an EU-configured database or cloud region. Customer-selected connectors and MCP tools receive the data needed to perform the requested tool call. When you connect a remote MCP server to an agent, tool arguments drawn from the run's content are sent to that server, which you select and which processes the data under its own terms.\n\nA Cloud Connection is owned by the customer organization, not by the administrator who connects it. Every organization member or API key already authorized to run the connected agent can cause that agent to read the selected cloud estate during interactive, workflow, scheduled, or API-key execution. Trumpets queries the provider when the agent uses a cloud tool or an administrator verifies access; it does not create a periodic copy of the cloud inventory.\n\nCustomer Content may contain personal data about other people, including sensitive data or data about criminal allegations. The customer is responsible for a lawful basis, transparency, minimization, retention, and any required data protection impact assessment. Do not use the Services for biometric identification, medical diagnosis, or solely automated decisions with legal or similarly significant effects unless a separate written agreement and all required safeguards are in place.\n\n7 · Google user data and Limited Use\n\nGoogle Workspace connects once for an Organization, from the Extensions page, through Pipedream Connect. It is not yet available in production; this section describes how it works where it is enabled. Trumpets requests only Google's drive.file permission and, if Calendar is enabled, read-only Calendar access (calendar.readonly), which Trumpets uses only for your primary calendar. With drive.file, Trumpets can open only the Drive files you pick in Google's own file picker; it cannot list or browse your Drive. An Agent uses the connection only after an Agent editor enables it for that Agent.\n\nPicked files are imported into the Knowledge Base of the Agents you enable, so the Agent can answer from them. With Calendar enabled, an enabled Agent can check availability and list upcoming events on your primary calendar during a run, and a calendar snapshot you configure can be imported into its Knowledge Base.\n\nTrumpets' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Data obtained from Google APIs is used only to provide the features you enabled. We do not sell Google user data, do not use it for advertising, do not transfer it except as needed to provide the feature or where required by law, and do not allow humans to read it except with your explicit consent, for security or abuse investigations, or where required by law. Google user data is not used to train our own general-purpose models.\n\nPipedream holds the Google OAuth grant and its access and refresh tokens; Pipedream states that it encrypts credentials at rest and hosts its service on Amazon Web Services in the United States. Requests to Google pass through Pipedream. Disconnecting in Trumpets removes the connection, the permitted files, and Agent selections in Trumpets. It does not revoke the grant at Google, and it does not delete the account record Pipedream holds; files already imported stay in the Knowledge Base until you remove them there. Revoke the grant at your Google Account permissions page (https://myaccount.google.com/permissions), and contact us if you want the Pipedream account record deleted.\n\nAn earlier native Google Workspace connection stored encrypted Google access and refresh tokens in Trumpets. Retiring it deletes those stored tokens without sending a revocation request to Google, so a grant you gave it stays listed in your Google Account until you remove it there.\n\n8 · Recipients and service providers\n\nWe disclose data only where needed for the purposes above, including to:\n\n- Supabase for authentication, PostgreSQL databases, storage, and related backend services.\n- Google for Google Cloud and Firebase hosting, Gemini model and file processing, embeddings, Google Search grounding, and Google Analytics where the relevant feature is enabled.\n- PostHog for consented web analytics on trumpets.ai and the Dashboard: page views, signups, and form conversions.\n- Amazon Web Services for keyless AWS role federation, CloudTrail security records, and hosting versioned CloudFormation templates used to create customer read-only roles when the AWS Cloud Connection is enabled.\n- OpenRouter and the model hosting providers it routes to for requests to a selected non-Gemini model. The company that develops a model is not necessarily the company that runs it: OpenRouter sends each request to a hosting provider (an endpoint) for that model. Platform requests require zero-data-retention endpoints and disable fallback to other endpoints. Some models are pinned to one named hosting provider; for others, OpenRouter chooses among the endpoints that meet these rules. The Subprocessor Register lists the routing rule and the current endpoint list for each model.\n- Pipedream for connecting Google Workspace, Notion, and Slack to an Organization: it holds the OAuth grant and credentials and relays requests to those services. This integration is not yet available in production.\n- LiveKit for realtime audio transport and SIP call ingress while a Voice Session is connected.\n- Stripe for checkout, subscriptions, invoices, tax-related payment information, and fraud prevention. Stripe processes payment data on our behalf and is also an independent controller for its own purposes, such as fraud prevention, financial regulation, and its legal obligations, under the Stripe Privacy Policy (https://stripe.com/privacy).\n- Sendinblue SAS (Brevo) for transactional email, support notification delivery, newsletter contact lists, and campaign delivery.\n- Zoho for hosting the support and hello mailboxes that receive contact requests, startup applications, and support correspondence.\n- Customer-selected integrations such as Google Workspace, Notion, Slack, GCP, Azure, or AWS cloud estates, MCP servers, or other tools you connect. The service you connect processes the data sent to it under its own terms, and your agreement with that provider also applies.\n- Professional advisers, authorities, and transaction parties when reasonably necessary for legal compliance, claims, audits, financing, or a corporate transaction, subject to appropriate confidentiality and legal safeguards.\n\nWe do not sell personal data. We do not disclose Customer Content to data brokers or third-party advertisers.\n\nThe current principal provider list, purposes, locations, transfer safeguards, and a change log are published in our Subprocessor Register (https://trumpets.ai/subprocessors).\n\n9 · International transfers\n\nSome providers, model endpoints, support operations, or search features process data outside Poland or the EEA. The destination can depend on the selected model, feature, customer configuration, and provider routing. OpenRouter and Pipedream are based in the United States, and a model hosting provider can be located in another country, as shown for each endpoint on OpenRouter's endpoint list.\n\nWhere GDPR requires a transfer mechanism, we use the mechanism applicable to the recipient and transfer, such as an adequacy decision or European Commission Standard Contractual Clauses, together with supplementary measures where required. You may ask us for information about the mechanism relevant to your data and a copy of applicable safeguards, subject to lawful redactions.\n\n10 · Retention and deletion\n\nWe keep personal data only for as long as needed for the purpose for which it was collected, taking account of the account or contract lifecycle, customer instructions, security needs, backup cycles, disputes, and legal duties. The main criteria are:\n\n- Pending accounts. An unverified pending account is eligible for automated deletion after seven days if it has no active verification token.\n- Account and Customer Content. Kept while the account or customer agreement is active and until content is deleted through an available feature or a verified deletion or closure request is completed, unless law or a dispute requires limited retention. The Dashboard and current company-operated Apps provide portable JSON export and account deletion controls. Shared-organization content is not deleted by one member; ownership must be resolved first. You can also contact us.\n- Short-lived operational records. Expired verification records are removed after 30 days, expired rate-limit counters after one day, expired unconfirmed newsletter signups after 30 days, and completed internal cleanup jobs after 90 days. The retention job runs daily and records its outcome.\n- Support records. Support messages, screenshots, and console excerpts sent to us are kept while the case is open and normally for 180 days after it closes. Issue reports filed in a company-operated App are kept until they are closed and are then deleted automatically no later than 24 months after they were filed.\n- Security and access logs. Normally kept for 12 months unless an investigation, a legal duty, or a proportionate security need requires longer.\n- Cloud Connections. An incomplete Cloud Connection Setup expires after 24 hours, and consumed setup records are removed after a further 24 hours. Disconnecting removes the agent's connection but retains the organization's cloud-estate claim to prevent another customer from claiming the same project, subscription, or account. That claim is removed when the organization is deleted or through a support-controlled transfer process. Provider-side roles and permissions remain until the customer revokes them at the provider.\n- Connected integrations. Connection records, permitted sources, and Agent selections in Trumpets are kept until an owner or administrator disconnects the integration or the organization is deleted. Content imported into a Knowledge Base stays until it is removed there or the organization is deleted. Disconnecting does not delete the grant at the connected service or the account record held by Pipedream; see section 7.\n- Billing, tax, consent, and contract records. Kept for the period required by applicable accounting and tax law and until relevant limitation periods expire. Terms acceptance, paid-checkout evidence, and Auto-recharge authorization evidence are normally removed six years after the evidence was recorded. An affected record may be kept longer only where a mandatory rule or documented active claim requires it.\n- Emails. Delivery records for transactional email are normally kept for 180 days after delivery or final failure unless they relate to a contract, complaint, or claim. Order confirmations, which carry the purchase and contract information, are kept for up to six years after the purchase.\n- Newsletter records. Kept while subscribed. After unsubscribe, we may keep the minimum suppression and consent record needed to respect the opt-out and demonstrate compliance.\n- Analytics data. Google Analytics deletes user-level and event-level data after the retention period set for our Google Analytics property; reports built from aggregated data can remain afterwards. PostHog deletes events after the retention period of our PostHog project. Our retention schedule requires the shortest period that supports the measurement purpose and an annual review. Browser identifiers are covered in section 12.\n\nDeletion from active systems may not immediately remove encrypted backup copies. A backup is isolated from ordinary use and expires through the documented backup rotation, currently configured not to exceed 35 days unless a legal hold applies. Restored data is re-subjected to deletion controls. We may retain anonymized data that can no longer identify a person.\n\n11 · Security\n\nWe use technical and organizational measures intended to protect personal data in view of the risk. They include TLS in transit, authentication and scoped credentials, role and tenant access controls, database row-level security, restricted administrative access, audit and operational logging, environment-separated secrets, application-layer authenticated encryption for connector credentials Trumpets stores, credential key versioning and rotation, backups, dependency and vulnerability review, and incident handling procedures.\n\nNo online service is completely secure. Keep passwords, API keys, integration tokens, and devices confidential, use the narrowest integration permissions available, and tell us promptly if you suspect unauthorized access.\n\n12 · Cookies, local storage, and analytics\n\nThe Services use storage that is necessary for authentication, security, session continuity, and remembering settings. These functions cannot be switched off where they are required to provide the Service you requested.\n\nWhere Google Analytics or PostHog is enabled, a consent banner lets you accept or decline analytics. The banner names the purpose and the tools it covers: Google Analytics and PostHog on trumpets.ai and the Dashboard, and Google Analytics in Apps and on App websites. We do not load either tool's code, create the Google Analytics data layer, set analytics identifiers, or send measurement requests before you accept. Accepting allows Google Analytics to set identifiers such as _ga cookies and PostHog to keep a random identifier in browser storage. They measure page views, campaign attribution, approximate region, device and browser information, signups, and form conversions; Google Analytics also measures checkout events. PostHog runs only on trumpets.ai and the Dashboard, without session recording, heatmaps, or automatic click capture, and we never send it your name or email address. We sanitize reported page and referrer URLs, including the defaults Google Analytics uses for its automatic events, so ordinary query parameters, invitation tokens, newsletter tokens, and prefilled emails are not sent.\n\nDeclining or ignoring the banner means analytics remains off and does not limit product features. Advertising storage, advertising user data, and ad personalization are not enabled by the Service's analytics control.\n\nYour choice is stored in your browser as a small record of the choice, the purpose and tools it covers, the version of this notice, and the time you made it; we do not keep a copy on our servers. We ask again after 12 months, and earlier when we add a tool or change the purpose. A choice made before that information was recorded, including a choice made before PostHog was added, no longer counts, and the banner asks again. Each website stores its own choice; open tabs of the same website follow a change made in another tab.\n\nYou can change your choice through Cookie settings on a website footer or Cookie preferences in an App or the Dashboard. Withdrawing consent stops analytics, removes the PostHog identifier, and expires Google Analytics cookies for that domain. Because Google Analytics code that has already loaded cannot be unloaded, the page reloads without it; another open tab stops sending analytics at once and reloads at its next navigation. Measurements already sent cannot be recalled.\n\nGoogle sets _ga cookies with a default lifetime of two years from your most recent visit, and browsers can shorten it; PostHog's identifier stays in your browser's local storage until you withdraw consent, your choice expires, or you clear the storage. You can also restrict storage in your browser.\n\n13 · Your rights\n\nSubject to the conditions and exceptions in data protection law, you may:\n\n- ask whether we process your personal data and obtain access and a copy;\n- correct inaccurate or incomplete personal data;\n- request erasure or restriction of processing;\n- receive personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where portability applies;\n- object to processing based on legitimate interests, including profiling on that basis, and object at any time to direct marketing;\n- withdraw consent at any time for future processing based on consent; and\n- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, or another competent supervisory authority. See the UODO information for individuals (https://uodo.gov.pl/en/p/for-citizens).\n\nSend a request to hello@trumpets.ai. We may need to verify your identity and clarify the scope. We normally respond within one month. GDPR permits an extension of up to two further months for a complex or numerous request, in which case we will tell you within the first month.\n\nWhere available, you can also use Download my data or Delete my account in account settings. Those controls do not replace your broader GDPR rights or your right to contact us, and an export may exclude another person's data or shared content you do not control.\n\nRights are not absolute. For example, we may retain information required by law or needed to establish, exercise, or defend legal claims. Exercising a right is free unless a request is manifestly unfounded or excessive.\n\n14 · Automated decisions and AI outputs\n\nSMASHING DIVS does not use account, billing, support, or marketing data to make a decision about you based solely on automated processing that produces legal or similarly significant effects. Fraud and security signals may flag activity for restriction or review, but you can contact us to contest a decision.\n\nAI outputs generated at a user's request are probabilistic assistance, not a decision made by SMASHING DIVS about a person. A customer that uses an output in employment, legal, financial, health, or another significant context is responsible for human review and for any transparency, lawful-basis, fairness, and contestability duties.\n\n15 · Children\n\nThe Services are intended for adults and are not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create an account. If you believe a child has provided personal data to us, contact us so we can assess and remove it where required.\n\n16 · Changes to this Policy\n\nWe may update this Policy to reflect changes in the Services, providers, or law. We will post the new version here and update the effective date. Earlier versions stay available unchanged at their own addresses, listed at trumpets.ai/legal/index.json (https://trumpets.ai/legal/index.json). If a change materially affects how we use personal data, we will provide a more prominent notice where required. An earlier version continues to govern processing that law does not permit us to change retroactively without a new legal basis.\n\n17 · Contact\n\nPiotr Hasooni-Abood, conducting business under the name SMASHING DIVS\nEU VAT ID: PL9930619827\nStanisława Moniuszki 26\n33-100 Tarnów, Poland\nEmail: hello@trumpets.ai\n", "html": "

Privacy Policy

Version: 2026-10-19
Effective: October 19, 2026

This Privacy Policy, version 2026-10-19, explains how Piotr Hasooni-Abood, conducting business under the name SMASHING DIVS, processes personal data when you visit Trumpets, use the platform or its API, or use a Trumpets-powered App operated by us. It also explains when we act only on a customer's instructions and what rights you have.

1 · Scope and controller

The controller for the processing described in this Policy is Piotr Hasooni-Abood, conducting business under the name SMASHING DIVS, EU VAT ID PL9930619827, Stanisława Moniuszki 26, 33-100 Tarnów, Poland. In this Policy, "SMASHING DIVS", "Trumpets", "we", and "us" refer to that operator. This Policy is also available in Polish.

This Policy covers trumpets.ai, the Trumpets Dashboard, agent and workflow runtime APIs, and company-operated products that link here, including Trumpets-powered Apps (together, the "Services"). A third-party website, model, connector, or service has its own privacy terms when you use it independently or connect it under your own account.

Questions and data protection requests can be sent to hello@trumpets.ai.

2 · Our data protection roles

We act as a controller when we decide why and how to process account, subscription, billing, security, support, product usage, website, and marketing data. We also normally act as controller for Customer Content that an individual Consumer submits about themselves to receive a Service for personal or household purposes. This Policy describes that processing.

We normally act as a processor when a business, professional, or organization uses the Services to process personal data contained in prompts, files, knowledge sources, workflow inputs, tool results, or generated outputs ("Customer Content"). That customer decides the purpose of the processing and is the controller, or is itself a processor authorized by another controller. Our Data Processing Addendum in the Terms of Service applies to that processing.

If your personal data was submitted by one of our customers, direct your request to that customer first. We will assist the customer as required by data protection law.

3 · Personal data we process

The data depends on the Service and features you use.

4 · Where data comes from

5 · Purposes and legal bases

Legitimate interests

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against the impact on individuals. You may object as explained in section 13.

6 · Customer Content and AI processing

The Services send the instructions, context, files, tool results, or other content needed for a requested operation to the selected model or tool provider. Depending on the feature, processing can include generation, extraction, classification, embedding, search grounding, document creation, image generation, audio generation, or evaluation.

We do not use Customer Content to train our own general-purpose model. We do not offer provider training on Customer Content as a Trumpets product feature. Model providers can retain content or metadata for limited security and abuse-monitoring purposes, and their treatment varies by provider, selected model, commercial plan, and privacy configuration. The provider can also change when you select a different model. Do not assume that every model or connector has identical retention or data residency.

Google Search grounding and other web research features send the query and necessary context to the search provider. Search processing is not guaranteed to remain in the EEA, even where the rest of an App uses an EU-configured database or cloud region. Customer-selected connectors and MCP tools receive the data needed to perform the requested tool call. When you connect a remote MCP server to an agent, tool arguments drawn from the run's content are sent to that server, which you select and which processes the data under its own terms.

A Cloud Connection is owned by the customer organization, not by the administrator who connects it. Every organization member or API key already authorized to run the connected agent can cause that agent to read the selected cloud estate during interactive, workflow, scheduled, or API-key execution. Trumpets queries the provider when the agent uses a cloud tool or an administrator verifies access; it does not create a periodic copy of the cloud inventory.

Customer Content may contain personal data about other people, including sensitive data or data about criminal allegations. The customer is responsible for a lawful basis, transparency, minimization, retention, and any required data protection impact assessment. Do not use the Services for biometric identification, medical diagnosis, or solely automated decisions with legal or similarly significant effects unless a separate written agreement and all required safeguards are in place.

7 · Google user data and Limited Use

Google Workspace connects once for an Organization, from the Extensions page, through Pipedream Connect. It is not yet available in production; this section describes how it works where it is enabled. Trumpets requests only Google's drive.file permission and, if Calendar is enabled, read-only Calendar access (calendar.readonly), which Trumpets uses only for your primary calendar. With drive.file, Trumpets can open only the Drive files you pick in Google's own file picker; it cannot list or browse your Drive. An Agent uses the connection only after an Agent editor enables it for that Agent.

Picked files are imported into the Knowledge Base of the Agents you enable, so the Agent can answer from them. With Calendar enabled, an enabled Agent can check availability and list upcoming events on your primary calendar during a run, and a calendar snapshot you configure can be imported into its Knowledge Base.

Trumpets' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google APIs is used only to provide the features you enabled. We do not sell Google user data, do not use it for advertising, do not transfer it except as needed to provide the feature or where required by law, and do not allow humans to read it except with your explicit consent, for security or abuse investigations, or where required by law. Google user data is not used to train our own general-purpose models.

Pipedream holds the Google OAuth grant and its access and refresh tokens; Pipedream states that it encrypts credentials at rest and hosts its service on Amazon Web Services in the United States. Requests to Google pass through Pipedream. Disconnecting in Trumpets removes the connection, the permitted files, and Agent selections in Trumpets. It does not revoke the grant at Google, and it does not delete the account record Pipedream holds; files already imported stay in the Knowledge Base until you remove them there. Revoke the grant at your Google Account permissions page, and contact us if you want the Pipedream account record deleted.

An earlier native Google Workspace connection stored encrypted Google access and refresh tokens in Trumpets. Retiring it deletes those stored tokens without sending a revocation request to Google, so a grant you gave it stays listed in your Google Account until you remove it there.

8 · Recipients and service providers

We disclose data only where needed for the purposes above, including to:

We do not sell personal data. We do not disclose Customer Content to data brokers or third-party advertisers.

The current principal provider list, purposes, locations, transfer safeguards, and a change log are published in our Subprocessor Register.

9 · International transfers

Some providers, model endpoints, support operations, or search features process data outside Poland or the EEA. The destination can depend on the selected model, feature, customer configuration, and provider routing. OpenRouter and Pipedream are based in the United States, and a model hosting provider can be located in another country, as shown for each endpoint on OpenRouter's endpoint list.

Where GDPR requires a transfer mechanism, we use the mechanism applicable to the recipient and transfer, such as an adequacy decision or European Commission Standard Contractual Clauses, together with supplementary measures where required. You may ask us for information about the mechanism relevant to your data and a copy of applicable safeguards, subject to lawful redactions.

10 · Retention and deletion

We keep personal data only for as long as needed for the purpose for which it was collected, taking account of the account or contract lifecycle, customer instructions, security needs, backup cycles, disputes, and legal duties. The main criteria are:

Deletion from active systems may not immediately remove encrypted backup copies. A backup is isolated from ordinary use and expires through the documented backup rotation, currently configured not to exceed 35 days unless a legal hold applies. Restored data is re-subjected to deletion controls. We may retain anonymized data that can no longer identify a person.

11 · Security

We use technical and organizational measures intended to protect personal data in view of the risk. They include TLS in transit, authentication and scoped credentials, role and tenant access controls, database row-level security, restricted administrative access, audit and operational logging, environment-separated secrets, application-layer authenticated encryption for connector credentials Trumpets stores, credential key versioning and rotation, backups, dependency and vulnerability review, and incident handling procedures.

No online service is completely secure. Keep passwords, API keys, integration tokens, and devices confidential, use the narrowest integration permissions available, and tell us promptly if you suspect unauthorized access.

12 · Cookies, local storage, and analytics

The Services use storage that is necessary for authentication, security, session continuity, and remembering settings. These functions cannot be switched off where they are required to provide the Service you requested.

Where Google Analytics or PostHog is enabled, a consent banner lets you accept or decline analytics. The banner names the purpose and the tools it covers: Google Analytics and PostHog on trumpets.ai and the Dashboard, and Google Analytics in Apps and on App websites. We do not load either tool's code, create the Google Analytics data layer, set analytics identifiers, or send measurement requests before you accept. Accepting allows Google Analytics to set identifiers such as _ga cookies and PostHog to keep a random identifier in browser storage. They measure page views, campaign attribution, approximate region, device and browser information, signups, and form conversions; Google Analytics also measures checkout events. PostHog runs only on trumpets.ai and the Dashboard, without session recording, heatmaps, or automatic click capture, and we never send it your name or email address. We sanitize reported page and referrer URLs, including the defaults Google Analytics uses for its automatic events, so ordinary query parameters, invitation tokens, newsletter tokens, and prefilled emails are not sent.

Declining or ignoring the banner means analytics remains off and does not limit product features. Advertising storage, advertising user data, and ad personalization are not enabled by the Service's analytics control.

Your choice is stored in your browser as a small record of the choice, the purpose and tools it covers, the version of this notice, and the time you made it; we do not keep a copy on our servers. We ask again after 12 months, and earlier when we add a tool or change the purpose. A choice made before that information was recorded, including a choice made before PostHog was added, no longer counts, and the banner asks again. Each website stores its own choice; open tabs of the same website follow a change made in another tab.

You can change your choice through Cookie settings on a website footer or Cookie preferences in an App or the Dashboard. Withdrawing consent stops analytics, removes the PostHog identifier, and expires Google Analytics cookies for that domain. Because Google Analytics code that has already loaded cannot be unloaded, the page reloads without it; another open tab stops sending analytics at once and reloads at its next navigation. Measurements already sent cannot be recalled.

Google sets _ga cookies with a default lifetime of two years from your most recent visit, and browsers can shorten it; PostHog's identifier stays in your browser's local storage until you withdraw consent, your choice expires, or you clear the storage. You can also restrict storage in your browser.

13 · Your rights

Subject to the conditions and exceptions in data protection law, you may:

Send a request to hello@trumpets.ai. We may need to verify your identity and clarify the scope. We normally respond within one month. GDPR permits an extension of up to two further months for a complex or numerous request, in which case we will tell you within the first month.

Where available, you can also use Download my data or Delete my account in account settings. Those controls do not replace your broader GDPR rights or your right to contact us, and an export may exclude another person's data or shared content you do not control.

Rights are not absolute. For example, we may retain information required by law or needed to establish, exercise, or defend legal claims. Exercising a right is free unless a request is manifestly unfounded or excessive.

14 · Automated decisions and AI outputs

SMASHING DIVS does not use account, billing, support, or marketing data to make a decision about you based solely on automated processing that produces legal or similarly significant effects. Fraud and security signals may flag activity for restriction or review, but you can contact us to contest a decision.

AI outputs generated at a user's request are probabilistic assistance, not a decision made by SMASHING DIVS about a person. A customer that uses an output in employment, legal, financial, health, or another significant context is responsible for human review and for any transparency, lawful-basis, fairness, and contestability duties.

15 · Children

The Services are intended for adults and are not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create an account. If you believe a child has provided personal data to us, contact us so we can assess and remove it where required.

16 · Changes to this Policy

We may update this Policy to reflect changes in the Services, providers, or law. We will post the new version here and update the effective date. Earlier versions stay available unchanged at their own addresses, listed at trumpets.ai/legal/index.json. If a change materially affects how we use personal data, we will provide a more prominent notice where required. An earlier version continues to govern processing that law does not permit us to change retroactively without a new legal basis.

17 · Contact

Piotr Hasooni-Abood, conducting business under the name SMASHING DIVS
EU VAT ID: PL9930619827
Stanisława Moniuszki 26
33-100 Tarnów, Poland
Email: hello@trumpets.ai

" }