Privacy Policy

Last updated: 19 October 2026

ThreatTrail is an AI-assisted workspace for security investigations. Because you may upload sensitive evidence, this policy explains plainly what we collect, how it is processed, and who else touches it.

1. What we collect

• Account data: your name, email address and a password hash if you register with a password, or your Google account identifier, name and email if you sign in with Google. We never receive your Google password.
• Evidence you upload: the files themselves, their names and sizes, and the text we extract from them. Archives you upload are unpacked and their contents are treated as evidence files.
• Your conversations and reports: the questions you ask, the answers generated, and any reports you create.
• Usage records: token counts for each AI operation, used to enforce your plan limits and show your usage.
• Purchase records: the plan you bought, the amount, currency, status and our payment provider's reference. We do not see or store your card details.
• Technical data: standard server logs such as IP address, request time and errors, used to run and secure the service.

2. How we use it

• To provide the service: store your evidence, index it, and answer your questions with citations to your sources.
• To enforce plan limits, process payments, and keep your account secure.
• To fix problems and prevent abuse.

We do not sell your data, and we do not use your evidence or conversations to advertise to you.

3. How your evidence is processed

To answer questions, we split extracted text into passages, convert them into numerical representations (embeddings) and store those in a vector database. When you ask a question, the most relevant passages are sent together with your question to a third-party AI model, which writes the answer. Evidence text, your questions and the generated answers therefore leave our servers and are processed by these AI providers.

Do not upload data you are not authorized to share, or that you are not permitted to send to third-party processors under your own legal or contractual obligations.

4. Who we share data with

We share data only with service providers needed to run ThreatTrail:

• AI model providers (currently Tristack and, for some embedding work, OpenRouter) receive evidence text, questions and prompts to generate answers and embeddings.
• Google, if you choose Google sign-in.
• Dodo Payments, our payment processor and merchant of record, which handles checkout, tax and invoicing. Dodo's own privacy policy governs the payment details you give it.
• Infrastructure providers that host our application, database and file storage.

We may also disclose information if required by law or to protect the rights, safety or security of our users and the service.

5. Storage and security

Each investigation's evidence is kept in its own workspace and is accessible only through the account that created it. Passwords are stored as hashes, and traffic to the service is encrypted in transit. No system is perfectly secure, and we cannot guarantee absolute security.

6. Retention and deletion

We keep your account data and evidence for as long as your account is active so you can keep working on your investigations. You can delete files and investigations yourself in the app. To delete your account and the data associated with it, email us at support@threattrail.com. Purchase and billing records may be kept for as long as needed to meet tax, accounting and legal obligations. Data already sent to AI providers is subject to their retention terms.

7. Your choices and rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact us at support@threattrail.com. We will respond within a reasonable time and may need to verify your identity first.

8. International transfers

We operate from India and our providers may process data in other countries. By using ThreatTrail you understand that your data may be transferred to, and processed in, countries other than your own.

9. Children

ThreatTrail is intended for professional use and is not directed at children under 18.

10. Changes to this policy

We may update this policy as the service changes. When we make material changes we will update the date above and, where appropriate, notify you in the app or by email.

11. Contact

Questions or requests: support@threattrail.com