Privacy Policy
This policy explains what personal data nTrust.ai collects through this website, why we collect it, who processes it, how long we keep it, and the rights you can exercise over it.
1. Who is responsible for your data
nTrust.ai ("nTrust", "we", "us") is the controller of the personal data described in this policy. For any privacy question or request, contact ceo@ntrust.ai. We respond to verified data protection requests within 30 days.
2. What we collect, and why
We deliberately minimise what we collect. This website is a marketing and enquiry surface — it is not a customer data platform.
| Data | When | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Name, business email, company name | When you submit the contact form | To identify you and reply to your enquiry | Consent (6(1)(a)); steps prior to a contract (6(1)(b)) |
| Message content you write | When you submit the contact form | To understand and answer your request | Consent (6(1)(a)); legitimate interests (6(1)(f)) |
| Product interests you select | When you submit the contact form | To route your enquiry and prioritise rollout cohorts you asked about | Consent (6(1)(a)) |
| IP address | Automatically, on submission | Abuse prevention, rate limiting and security of the intake endpoint | Legitimate interests (6(1)(f)) — security |
| Technical request data (user agent, timestamps, edge logs) | Automatically, on any request | Operating, securing and debugging the service | Legitimate interests (6(1)(f)) — security and availability |
What we do not collect
- We do not run advertising or cross-site tracking cookies on this site.
- We do not collect payment card data on this site — no card data is ever entered here.
- We do not ask for, and ask that you do not send, special category data (health, biometric, political, religious, or similar) through the contact form.
- We do not sell, rent, or trade personal data to anyone, for any purpose.
3. How enquiry data is protected in transit and at rest
Contact submissions are handled by a hardened serverless endpoint, not by a third-party form widget. Specifically:
- Field-level pseudonymisation. Identifying fields (name, email, company, message, IP) are scrubbed and replaced with keyed pseudonymous references before the lead record is written. The key is a dedicated HMAC-SHA-256 secret held only in our production secret store — it is not derived from any other credential, and it is never stored alongside the data it protects.
- No plaintext lead store. Pseudonymous references are one-way at the storage layer; recovering the underlying value requires the HMAC key.
- Encrypted transport. All traffic to this site is served over TLS via our edge provider.
- Least-privilege access. Only personnel who must answer enquiries have access to them.
- Audit trails. Delivery and failure events are logged for reliability and security monitoring. Logs contain pseudonymous references, not raw personal data.
4. Who we share data with (sub-processors)
We use a small number of infrastructure providers to run this site and deliver your enquiry. They act on our instructions under data processing agreements.
| Provider | Role | Data involved |
|---|---|---|
| Cloudflare | Edge hosting, CDN, DNS, security | Technical request data, edge logs |
| SendGrid (Twilio) | Transactional email delivery of enquiries | Name, email, company, message — as needed to deliver the notification |
| GitHub | Source control and build pipeline | No production personal data; code only |
We may also disclose data where we are legally required to do so, or where necessary to establish, exercise or defend legal claims. We do not disclose data to advertisers or data brokers.
International transfers
Our providers operate globally. Where personal data is transferred outside the EEA or the UK, we rely on an appropriate transfer mechanism — the UK/EEA Standard Contractual Clauses and, where applicable, the UK Addendum — together with provider security commitments.
5. How long we keep data
- Enquiries that do not become a customer relationship: retained for up to 24 months from last contact, then deleted.
- Enquiries relating to an active or prospective engagement: retained for the duration of the relationship plus the period required by applicable law and our contractual record-keeping obligations.
- Security and edge logs: short retention, typically under 30 days, unless retained for an active security investigation.
Where you withdraw consent, we delete the associated enquiry data unless we have a separate lawful basis or a legal obligation to retain it.
6. Your rights
Depending on where you live, you may have some or all of the following rights. We honour these requests for all users regardless of jurisdiction, where technically feasible:
- Access — a copy of the personal data we hold about you.
- Rectification — correction of inaccurate data.
- Erasure — deletion of your data ("right to be forgotten").
- Restriction — limits on how we process your data.
- Portability — a machine-readable export of data you provided to us.
- Objection — objection to processing based on our legitimate interests.
- Withdraw consent — at any time, without affecting the lawfulness of processing already carried out.
- Non-discrimination — we will not degrade service because you exercised a privacy right (CCPA/CPRA).
- Opt out of sale or sharing — we do not sell or share personal data, so there is nothing to opt out of; this statement is provided for completeness under CCPA/CPRA.
To exercise any right, email ceo@ntrust.ai with the subject "Privacy Request". We verify identity before acting, and we will not charge a fee for a reasonable request. If you are in the EEA or UK and are dissatisfied with our response, you may lodge a complaint with your local supervisory authority.
7. Cookies and local storage
This site does not use advertising or analytics tracking cookies. Where cookies or local storage are used, they are strictly necessary for the site to function or to remember a form-interaction preference on your own device. Because we deploy no non-essential tracking, no consent banner is required or shown.
8. Automated decision-making and AI systems
We build AI governance and security products, so we hold ourselves to the same standard we sell.
- Enquiries submitted through this site are not subjected to automated decision-making that produces legal or similarly significant effects about you.
- Enquiry routing and prioritisation is human-reviewed; a person reads and answers every substantive enquiry.
- Where our products use automated processing on a customer's behalf, that processing is governed by the customer agreement, is logged for traceability, and is subject to human oversight — consistent with our alignment to the NIST AI Risk Management Framework and the transparency and human-oversight obligations of the EU AI Act.
- We do not use your enquiry content to train general-purpose models, and we do not transfer it to third parties for that purpose.
9. Security incidents
We maintain incident response procedures consistent with our ISO 27001 and SOC 2 control mapping. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, notify affected individuals directly.
10. Children
This site is intended for business users. It is not directed to children, and we do not knowingly collect data from anyone under 16. If you believe a child has submitted data, contact us and we will delete it.
11. Changes to this policy
We may update this policy to reflect changes in our processing or the law. The "Last updated" date above always reflects the current version. Material changes affecting how we use your data will be communicated to active contacts before they take effect.
12. Contact
Privacy questions, requests, and complaints: ceo@ntrust.ai.
See also our Terms of Use.