Data Use Policy

Overview

This Data Use Policy describes how TrovaInsights handles the business data our customers bring to the platform. It complements our Privacy Policy, which covers personal information collected through this website and from platform users, and our AI Use Policy, which describes how our AI features work.

Customer data ownership

The business data you bring to the platform is yours. You retain all right, title, and interest in it. We hold a limited license to host, process, transmit, and display that data only to the extent necessary to provide the platform to you, prevent or address technical problems, or as you expressly direct.

Where your data lives

We store customer business data in Snowflake, which we use as our data warehouse. Our application, user accounts, dashboards, conversation history, and tenant configuration are hosted on Render. Our production infrastructure is located in the United States.

Where you have your own Snowflake account and prefer to keep your data there, we support that configuration and build our data pipelines to operate against your account rather than ours. Where we host your data on your behalf, it lives in a per-tenant schema in our Snowflake account.

Access controls

Access to customer data is scoped to each tenant. Every database connection, query, and application view is bound to a specific tenant, and application code enforces that boundary before any query runs. Credentials for connecting to customer data warehouses are stored encrypted and are decrypted only when needed for a request.

Access to production systems by our personnel is role-based, requires multi-factor authentication for administrative access, follows the principle of least privilege, and is revoked promptly when someone leaves. Customer data is encrypted in transit using industry-standard TLS and at rest through our cloud infrastructure providers.

Subprocessors

We use a small number of subprocessors to deliver the platform, including Anthropic as the language model provider for our AI features, Snowflake as the data warehouse, Render as the application host, dbt Labs for data transformation orchestration, and Intuit for connections to QuickBooks Online where authorized by the customer. Our current subprocessor list is available on request.

We enter into written agreements with each subprocessor that impose data protection obligations substantially equivalent to those we make to our customers. If we add a new subprocessor, we notify affected customers in advance.

Deletion and export

When your subscription ends, we make your data available for export for 30 days in a commercially reasonable format. After that period, we delete customer data within a commercially reasonable time, subject to any legal obligation to retain records and to routine backup cycles that are deleted on their normal schedule.

You can also request deletion of specific customer data at any time during your subscription, and we will act on that request in accordance with your instructions and our agreement with you.

Contact

Questions about how we handle customer data can be directed to app_admin@trovainsights.com.