Privacy
Privacy Policy
Last updated: [DD Month YYYY]
1. About this policy
This Privacy Policy explains how TreTrove (“TreTrove”, “we”, “us”, “our”) collects, uses, stores, shares and protects personal data when you visit this website or join our First Release list. It also explains the choices and rights you have.
TreTrove is preparing to launch, first in India and later in Europe. We have written this policy to meet the requirements of the data protection laws that apply to us in the places we operate, including India’s Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”), and, where it applies, the EU General Data Protection Regulation (the “GDPR”) and equivalent European laws. Where a law gives you stronger protection, we follow it.
In this policy, “personal data” means any information that relates to an identified or identifiable person. Under the DPDP Act we act as a “Data Fiduciary”; under the GDPR we act as a “controller”.
2. Who we are and how to reach us
[Registered company name, e.g. TreTrove Private Limited][Registered office: building, street], [City, State, PIN code]
Email: [privacy@tretrove.com]
Grievance Officer (India)
For any question, request or complaint about your personal data, you can contact our Grievance Officer:
[Name of Grievance Officer][Postal address in India]
Email: [privacy@tretrove.com]
Representative in the European Union
[Name and address of EU representative — or delete if TreTrove has an EU establishment]
3. At a glance
- The only information we ask you for is your email address, and only if you choose to join the First Release list.
- We use it only to send you news about the TreTrove launch and early-access opportunities.
- We never sell your personal data and never share it for advertising.
- Every email we send has an unsubscribe link, and you can ask us to delete your data at any time.
- We do not use advertising or cross-site tracking cookies. Analytics, if used, only runs after you allow it.
4. Information we collect
4.1 Information you give us
- Email address: when you join the First Release list. Providing it is voluntary. If you do not provide it, you can still use the website; you simply won’t receive launch emails.
- Your messages: if you email us, we receive your email address, the content of your message and anything you choose to include.
4.2 Information collected automatically
- Technical and log data: when you visit, our hosting provider automatically processes technical information your browser sends, such as your IP address, date and time of the request, the page requested, referring page, browser type and version, operating system and device type. This is needed to deliver the website and keep it secure.
- Signup records: when you join the list, we record the date and time of your signup and that you joined through this website, so we can demonstrate that you asked to receive our emails.
- Spam and abuse protection: to stop automated abuse of the signup form, we temporarily store a one-way, salted “hash” of your IP address and email address. The original values cannot be read back from the hash.
- Bot protection (Cloudflare Turnstile): when you submit the signup form, Cloudflare Turnstile checks that the request comes from a person and not an automated program. To do this it processes technical signals from your browser and device, such as your IP address, browser characteristics and how the page was interacted with. It does not use advertising cookies or build a profile of you, and we receive only a pass/fail result.
- Email engagement: our email provider may record whether our emails are delivered, opened or clicked, to help us send relevant emails and maintain good deliverability. [Confirm, and describe how to switch this off in your email platform if you prefer not to track opens.]
- Preferences on your device: your browser may store small settings, such as whether you have already seen the opening animation and your analytics choice (see section 13).
- Analytics (only with your permission): see section 13.
4.3 Information we do not collect
We do not ask for your name, phone number, postal address, payment details, date of birth or any sensitive personal data, and we ask you not to send us such information. This website does not sell products or process payments.
5. How and why we use your information
| Purpose | Data used | Legal basis |
|---|---|---|
| Sending you launch news and early-access opportunities | Email address, signup records | Your consent (DPDP Act, s. 6; GDPR Art. 6(1)(a)) |
| Keeping an internal record of who has joined, so we can manage the list and honour your choices | Email address, signup and unsubscribe records | Your consent, and our legal obligation to be able to demonstrate it (GDPR Art. 7(1)) |
| Delivering the website and protecting it against misuse, fraud, spam and attacks | Technical and log data, hashed IP and email, bot-protection signals | Necessary to provide the service you request and to keep it secure (GDPR Art. 6(1)(f), legitimate interests); uses permitted under applicable Indian law |
| Replying to your messages and requests | Email address, message content | Your request and consent; for rights requests, our legal obligation |
| Understanding visits in aggregate (optional) | Anonymous usage statistics | Your consent (GDPR Art. 6(1)(a); ePrivacy rules) |
| Complying with law and responding to lawful requests from authorities | Only the data required | Legal obligation |
We will not use your personal data for a new purpose that is incompatible with these purposes without telling you and, where required, asking for your consent. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
6. How the First Release list works
- You join by entering your email address and pressing “Join the First Release”. The statement next to the button explains what you are agreeing to. We never use pre-ticked boxes.
- Your address is added to our list and you see a confirmation on screen. [If double opt-in is enabled: we first send you an email with a confirmation link, and you are only added once you click it.]
- We will email you only when there is something worth sharing about the launch, such as release announcements and early-access opportunities. We do not send third-party advertising.
- You can unsubscribe at any time through the link in every email or by writing to [privacy@tretrove.com]. Unsubscribing is free and takes effect promptly.
7. Who we share your information with
We do not sell, rent or trade your personal data. We share it only with the service providers that help us run this website and our email list. They act on our instructions under contracts that require them to keep it secure and confidential and to use it only to provide their service to us (data processing agreements under Art. 28 GDPR and equivalent terms under the DPDP Act).
| Provider | Service | Location of processing |
|---|---|---|
| [Vercel Inc.] | Website hosting and delivery | [Global edge network; confirm regions] |
| [Brevo (Sendinblue SAS)] | Storing the First Release list, sending emails, unsubscribe handling | [European Union; confirm] |
| [Upstash, Inc.] | Temporary, hashed records for spam and abuse protection | [Region you select, e.g. EU or India] |
| [Cloudflare, Inc.] | Turnstile bot protection on the signup form | [Global network; confirm] |
| [Plausible Insights OÜ] (only if analytics is enabled) | Privacy-friendly, cookie-free visit statistics | [European Union] |
We may also disclose personal data where we reasonably believe it is necessary:
- to comply with applicable law, regulation, court order or a lawful request from a public authority;
- to protect the rights, safety or property of TreTrove, our visitors or others, or to prevent fraud or abuse;
- in connection with a merger, acquisition or sale of all or part of our business, in which case the recipient will be bound to treat your data in line with this policy, and we will tell you in advance.
8. International transfers
Because our service providers operate internationally, your personal data may be processed outside the country where you live, including in India, the European Union and the United States.
- From India: we transfer personal data outside India only as permitted under the DPDP Act and will not transfer it to any country or territory the Government of India has restricted.
- From the EU/EEA: where personal data is transferred to a country without an EU “adequacy decision”, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or, for certified US providers, the EU–US Data Privacy Framework. You can ask us for more information about these safeguards.
9. How long we keep your information
| Data | Retention |
|---|---|
| Email address on the First Release list | Until you unsubscribe or ask us to delete it, or until the list is no longer needed. [If no launch communication has been sent within 24 months, we will delete the list.] |
| Signup and unsubscribe records | For as long as needed to demonstrate consent and to honour your unsubscribe request, and no longer than [3 years] after you unsubscribe, unless the law requires otherwise. |
| Hashed spam-protection records | Automatically deleted after no more than 1 hour. |
| Website technical logs | [As set by our hosting provider, typically a few days to [30] days], unless needed to investigate a security incident. |
| Your messages to us | As long as needed to deal with your enquiry, and then for up to [2 years] for our records. |
When personal data is no longer needed, we delete it or make it anonymous. Under the DPDP Act, we will also erase your data when you withdraw consent or when the purpose for which it was collected is no longer being served, unless we are required by law to keep it.
10. How we protect your information
We use reasonable technical and organisational security safeguards appropriate to the nature of the data, including encrypted connections (HTTPS) for the whole website, access to signup data limited to people who need it, secret credentials kept only on our servers, hashing of data used for abuse protection, rate limiting, and careful selection of service providers. No method of transmission or storage is completely secure, but we work to protect your data and review our safeguards regularly.
If a personal data breach occurs, we will take prompt steps to contain it and will notify the relevant authority and affected individuals where required by law, including the Data Protection Board of India and, where the GDPR applies, the competent supervisory authority.
11. Your rights and choices
For everyone
- Unsubscribe: use the link in any email, or write to us.
- Access: ask what personal data we hold about you and how we use it.
- Correction: ask us to correct or update inaccurate data.
- Deletion: ask us to delete your data.
- Withdraw consent: at any time, as easily as you gave it. This does not affect processing that took place before withdrawal.
Additional rights in India (DPDP Act)
- to obtain a summary of the personal data we process and the processing activities, and the identities of those we have shared it with;
- to correction, completion, updating and erasure of your personal data;
- to have your grievances addressed by our Grievance Officer (section 2);
- to nominate another person to exercise your rights in the event of your death or incapacity.
If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.
Additional rights in the EU/EEA (GDPR)
- access (Art. 15), rectification (Art. 16) and erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- to object to processing based on legitimate interests (Art. 21), and to object at any time to direct marketing;
- to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where an alleged infringement took place.
How to exercise your rights
Email [privacy@tretrove.com] or our Grievance Officer at [privacy@tretrove.com]. We may need to verify your identity before acting on a request, usually by confirming that you control the email address concerned. We aim to respond within 30 days, and in any case within the time required by applicable law. Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive.
12. Children
This website and our First Release list are intended for adults. We do not knowingly collect personal data from anyone under 18 years of age (the age of majority under the DPDP Act). If you are a parent or guardian and believe a child has given us personal data, please contact us and we will delete it.
13. Cookies and similar technologies
We do not use advertising, social-media tracking or cross-site cookies. The website uses only the following strictly necessary storage on your device:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| tt-intro | Session storage (strictly necessary) | Remembers that the opening animation has been shown, so it does not repeat | Until you close the browser tab |
| NEXT_LOCALE | Cookie (strictly necessary) | Remembers the language you chose in the footer | 1 year, or until you clear your browser data |
| tt-analytics-consent | Local storage (strictly necessary) | Remembers your analytics choice | Until you clear your browser data |
Analytics. If enabled, we use Plausible Analytics, a cookie-free service, to count visits in aggregate (for example, page views and referring websites). It does not create personal profiles or track you across other websites. It only runs after you click “Allow”, and you can change your choice at any time through “Privacy settings” in the footer. [Remove this paragraph if analytics is not used.]
14. Links to other websites
This website links to other services, such as Instagram. Those services are operated by third parties under their own privacy policies, and we are not responsible for how they handle your data. Please read their policies before sharing information with them.
15. Changes to this policy
We may update this policy as our business grows, for example when we launch in new countries or start selling products. The “Last updated” date at the top shows when it last changed. If we make significant changes, we will tell you by email or by a notice on this website before they take effect, and ask for your consent again where required.
16. Contact and complaints
If you have any questions about this policy or how we handle your personal data, please contact us at [privacy@tretrove.com], or our Grievance Officer at [privacy@tretrove.com]. We will do our best to resolve your concern. You also have the right to complain to a data protection authority, as described in section 11.