Privacy
Policy.

Who we are and what this policy covers

TruCom is a customer support platform from Truvenda Cloud Technologies. This Privacy Policy explains how personal data is handled when you visit our website, create or use a TruCom account, contact us, or interact with a business through tools it operates using TruCom.

Personal data means information relating to an identified or identifiable person. This can include a name or email address, as well as an online identifier, message, device detail or record that can be linked to a person. The information involved depends on the features and interactions described below.

This policy describes data handling; it is not a request for blanket consent. The Terms and Conditions govern use of the service. A specific privacy notice or agreed data processing arrangement may provide further information for a particular activity.

Our role and the business you contact

For TruCom’s own account administration, billing, security and direct business communications, Truvenda Cloud Technologies determines the relevant purposes and means of processing and acts as the data controller for those activities.

When a business uses TruCom to handle its customer conversations, tickets, help content, feedback or service updates, that business generally decides why the information is collected and how its team uses it. We process that workspace information to provide the service and follow authorised instructions, subject to applicable law and any required processing agreement.

If your request concerns a shop, service provider or another business using TruCom, its own privacy notice and customer relationship matter too. Contact that business about its use of your support information. You can also contact us, and we will distinguish information we control from information we handle on a customer’s behalf.

The information we handle

We handle information you provide, information supplied by an authorised business or connected provider, and technical information generated when the service is used. The categories below are examples; a feature being available does not mean every category is collected in every interaction.

Account and workspace details

Names, email addresses, account identifiers, business details, team membership, roles, departments, preferences and account-verification information.

Used to create and administer access, identify the workspace and apply the permissions your organisation chooses.

Customer support content

Messages, contact details, conversation history, ticket descriptions, internal notes, tags, attachments, satisfaction responses and information a business records about a customer.

Used to deliver the support interaction, keep context and carry out authorised follow-up.

Knowledge and public content

Help articles, uploaded knowledge, extracted text and search representations, published service updates, feature requests, votes and related activity.

Used to provide search, self-service, AI assistance and the public information the workspace chooses to publish.

Technical and visit information

IP addresses, browser and device details, page URL paths and titles, referring page context, time zone, visit times, browser or session identifiers and approximate location where enabled.

Used for service operation, support context, country-aware pricing, security and troubleshooting.

Billing and payment records

Billing country, payer details, invoices, currency and amounts, transaction references and outcomes, and provider-supplied payment-method metadata such as card brand, last four digits or an authorised payment token.

Used to manage subscriptions, verify payments, reconcile refunds and maintain required financial records.

Security, AI and service activity

Sign-in and audit events, account recovery and challenge records, connection identifiers and credentials, notification endpoints, AI task references, model and usage records, errors and diagnostic information.

Used to protect accounts, operate enabled features, measure usage and investigate a service problem.

Where information comes from

You may provide information directly through registration, account settings, a support message, a ticket, a file upload, a subscription or another form. An employer, colleague or business you contact may provide information when they invite you, manage a workspace or record a support interaction.

If you choose Google sign-in, Google supplies the identity details needed for the authorised flow, including your name, email, provider identifier and available profile information. Connected messaging providers supply the identifiers, messages and context permitted by the connection you or the business authorises.

Technical information can come from your browser, device, network request and service activity. A location provider may use an IP address to estimate a country, region or city where that feature is enabled. We do not assume that an approximate location identifies where a person actually lives.

Why we use information and our legal bases

The legal basis depends on the activity, our role and the law that applies. For information we control, the principal purposes and bases are described below. Where we act for a business using TruCom, that business must establish the basis for its own collection and instructions.

When we rely on legitimate interests, those interests include securing the service, preventing misuse, resolving support issues and operating a reliable business service. We must consider the impact on people and must not use that basis where their rights override the interest. We do not treat a legitimate interest as permission for every possible use.

Providing the account and service

Creating an account, administering a requested subscription, delivering a support feature and responding to a service request.

Performance of an agreement with you, or taking steps you request before entering one, where applicable.

Security and reliable operation

Preventing abuse, investigating incidents, maintaining audit trails, troubleshooting and administering authorised workspace access.

Legitimate interests in protecting people, customer information and the service, subject to the applicable balancing requirements; legal obligations where relevant.

Payments and required records

Issuing invoices, verifying transactions, managing refunds and meeting accounting, tax and lawful disclosure requirements.

Contractual necessity and compliance with applicable legal obligations, as relevant to each activity.

Optional activities requiring consent

A particular optional communication, permission or other processing activity for which the applicable law requires consent.

Your specific consent. You can withdraw it, without affecting processing that was lawful before withdrawal.

Legal claims and rights requests

Assessing a request, confirming identity or authority, responding to a complaint and establishing, exercising or defending legal rights.

Applicable legal obligations and legitimate interests in resolving claims and protecting rights, depending on the circumstances.

Website chat, page context and location

When a business installs TruCom’s website widget, the widget can report visit context so its support team can understand the page being viewed and recognise a returning browser. This can include the page path and title, referrer context, browser or session identifiers, device information, time zone and IP address.

Where location lookup is enabled, an IP address may be sent to a location service to estimate a country, region, city or time zone. TruCom supports IPWhois for these lookups and can also use location information supplied with the network request. An IP estimate can be affected by a VPN, shared network or mobile connection.

The business operating the website decides where to install its widget and how its team uses the resulting support context. It is responsible for providing its visitors with appropriate information and obtaining any permission its particular use requires. Avoid sending passwords, private sign-in codes or information unrelated to the support request.

Cookies and browser storage

TruCom uses browser mechanisms for sessions, request security, interface preferences, device layout and continuity of chat. Cookies, local storage and session storage can hold identifiers or choices such as the saved theme, the preferred device experience or a widget browser or conversation reference.

Some functions support access and security; others support a preference or continuity feature. The purpose of each use and the applicable law determine the information and permissions required. This Privacy Policy is not itself consent to an optional tracking activity.

You can manage stored information and permissions through your browser and use relevant workspace or device settings where available. Blocking or clearing storage may sign you out, reset preferences or interrupt access to a previous chat. A business installing the widget must also address its use in its own website notices and any consent mechanism required for that use.

AI, knowledge and automated assistance

When enabled, AI assistance can process the question, relevant conversation context, instructions and permitted knowledge needed for a response, draft, summary or other supported task. Knowledge search can create numerical representations of text to help retrieve relevant material. Input text is sent to the configured embedding service when that service is used.

The platform supports OpenAI completion and embedding integrations, with the endpoint and models determined by service configuration. Relevant inputs are transmitted to the configured AI processing provider. The provider agreement and service settings govern how those inputs are processed and retained.

TruCom can retain the conversation, generated output, source references and AI operation records needed for support, usage, billing and troubleshooting. Those records may include the model, task outcome, token usage, credit charge and timing. Content visibility and the knowledge audience you choose determine who can use or read it within the service.

AI answers can be inaccurate or incomplete. Customers can ask for a person, and teams should review outputs and challenge incorrect information. Contact us if an automated service action affects you and you need an explanation or review, including where applicable law provides a right to human involvement.

Connected messaging accounts

When you authorise a supported WhatsApp Business, Instagram, Facebook Page Messenger or Telegram connection, TruCom processes the account or asset identifiers, permission information, credentials and messages needed to operate that connection. Supported attachments and provider-supplied message context may accompany an interaction.

Access applies to the accounts, numbers, Pages, bots or chat assets authorised for the connection. It does not establish access to every private conversation or every historical message held by that provider. The business controls the connection, its team permissions and the use of its incoming support records.

Revoking provider access or removing a connection can stop future exchange. It does not automatically remove messages already stored in TruCom, the provider’s systems or the recipient’s records. Requests concerning those copies may need to be directed to more than one responsible organisation.

Subscriptions and payment information

When you subscribe or purchase available usage, we process the billing details needed for the transaction and the resulting subscription. This includes the billing country, accepted offer, invoice, amount, currency, payment reference and verification or refund outcome.

Payments are processed through the configured payment provider; the platform supports Flutterwave. We may receive payer details and payment-method metadata supplied by that provider. Where a payment method is saved with the relevant authorisation, a provider token, card brand, last four digits and related consent or status information can be stored to support that arrangement.

Use the provider’s payment interface for payment credentials. Do not send a full card number, security code or account password in a chat or ticket. Financial records may need to be retained after a subscription or account ends to meet legal, accounting or dispute requirements.

Communications and notifications

We use account and contact information to send verification, password-reset, security, invitation, billing and other service messages. A business using TruCom may also send customer replies or updates through the channels and notification features it enables.

Browser or device notifications use the subscription and endpoint information required to deliver them. You can manage browser permissions and relevant notification preferences. Switching off an optional notification does not necessarily stop essential security, legal or transaction communications.

If we send a marketing communication for which consent or an opt-out is required, we must honour that requirement separately from account registration. You can contact us to object to direct marketing or withdraw relevant consent. A workspace business is responsible for the marketing messages it sends to its own contacts.

Who can receive information

Information is shared according to the purpose of an activity, the permissions involved and the law. A private support record is not made public merely because it is held in TruCom. The principal recipients or categories of recipients are below.

• Your organisation’s authorised owners, administrators, teammates and other intended recipients who need the record for the support work or workspace administration.
• The customer or other person to whom a reply, ticket update, invitation or other authorised communication is addressed.
• Providers of hosting, file storage, email, realtime delivery, security checks, payment processing, location lookup and enabled AI functions. Examples supported by the implementation include Cloudflare services, Google sign-in, Flutterwave, IPWhois and the configured AI provider.
• Messaging services such as Meta’s supported business channels and Telegram when the relevant connection is authorised.
• Authorised TruCom personnel or advisers who need access for support, service operation, security, legal or financial work, subject to appropriate access and confidentiality obligations.
• A competent authority or another recipient where disclosure is lawfully required, or where necessary and permitted to protect rights, address unlawful activity or respond to a legal claim.
• A successor or relevant counterparty in a legitimate business transfer, subject to applicable safeguards, notice requirements and continuing privacy obligations.

Public pages and workspace visibility

A business can publish help articles, status information, incident updates, roadmap entries or feedback through TruCom. Information it chooses to publish may be visible to anyone with access to the public page, and public material may also be found by search engines or copied by other people.

Before publishing, check names, comments, screenshots, files and other content for information that should remain private. Internal notes, customer replies and public posts have different audiences. A knowledge source being available to team tools does not automatically make it suitable for a public answer.

Owners and authorised administrators can manage the organisation’s workspace and the records it holds. An employee or teammate should not assume that business records are private from the administrators who are entitled to manage that workspace.

International processing

TruCom and the providers involved in a feature may process information in countries other than the country where you or the business using TruCom is located. An integration or model can therefore involve an international transfer, and information may be processed in more than one country depending on the services involved.

Where applicable law requires safeguards for a transfer, those requirements must be met for the relevant processing. The appropriate arrangement depends on the recipient, location and applicable law, including any requirement for an adequacy assessment, contractual protection or another permitted transfer mechanism.

Contact us if you need information about the providers, locations or transfer arrangements relevant to a specific workspace or feature before supplying information subject to a location restriction.

Security and authorised access

The service uses measures intended to protect information, including account authentication, workspace permissions, checks on access to protected records, audit activity and protection of sensitive credentials. Passwords are stored as hashes, and supported connection credentials and saved payment tokens use encrypted storage.

Authorised support or administration may involve access to relevant information to investigate a problem, protect an account or carry out a permitted repair. Access should be limited to the purpose and authority for the task, including when a service operator needs to review a relevant customer message.

No online system can guarantee absolute security. Protect your credentials and devices, assign suitable team permissions and report suspected compromise promptly. If a personal data breach requires notification under applicable law, we must provide the required notification to the appropriate parties.

How long information is kept

Retention depends on the purpose and type of information, the organisation responsible for it and applicable legal requirements. The period for a sign-in session, security challenge, support conversation, invoice and published article need not be the same.

For information we control, we assess how long it is needed to provide the requested service, maintain security, meet accounting or other legal obligations and resolve a genuine dispute. For workspace information processed for a business, its authorised instructions and applicable processing arrangement also matter.

Our Delete my account process requires verification through your registered email address and an explicit confirmation. The confirmation and scheduling email show the cancellation deadline: 14 days by default. Deletion then removes your live account, its memberships, and the workspaces you own when deletion begins, including their data and uploads. Independent businesses and providers may retain records for which they are responsible.

Before live removal, we create a private encrypted backup for legal purposes. Its retention period is shown with your request and defaults to 30 days from backup creation; the backup is removed after that period. Unconfirmed or cancelled request records are normally removed after 30 days. Technical failures can delay processing; the scheduler retries unfinished removal and backup cleanup. The legal backup is not a recovery service.

A request may need separate consideration for financial records, security logs, backups and copies held by a connected provider. We will explain any lawful restriction that affects your request and the steps that can be taken.

Your privacy rights and choices

The rights available to you depend on the applicable law, our role and the basis for the processing. You may be entitled to the rights below. Exercising a right does not require you to give up an unrelated legal remedy.

You can object to processing based on legitimate interests where the law provides that right, and you can object to direct marketing. Where processing is based on your consent, you can withdraw it. Withdrawal does not make earlier lawful processing unlawful or prevent processing that has another valid basis.

• Ask what personal data is held about you and request access to it, together with information about its use.
• Ask for inaccurate information to be corrected or incomplete information to be completed.
• Request deletion where the applicable conditions are met.
• Request restriction of particular processing or object to it where the law provides that option.
• Request a portable copy of relevant information where the applicable portability requirements are met.
• Raise a concern about a relevant automated decision and request an explanation or human involvement where required by law.
• Complain to the Nigeria Data Protection Commission or another competent authority without first having to accept our preferred outcome.

Making a request and who should respond

Use the privacy contact at the end of this policy. Identify the account, business or workspace involved, describe the information or action you are asking about and provide a contact method for the response. Do not include a password, recovery code or unrelated identity document in your initial message.

We may ask for proportionate information to verify your identity or authority, especially where a request could expose another person’s information or affect business records. We will assess the request under the applicable legal requirements, explain a relevant restriction and identify the responsible organisation where the information is controlled by a business using TruCom.

If you are a customer of a business that uses TruCom, that business will generally need to address your request concerning its customer records. If you are an employee, an individual account request must also be distinguished from the organisation’s ownership of its workspace. Subscription cancellation, removal from a team and deletion of personal data are separate matters.

Children and sensitive information

TruCom business accounts are intended for adults who meet the eligibility requirements in our Terms. A business using TruCom must separately consider the people it serves, including any legal requirements applying to children’s or sensitive personal information.

Do not supply sensitive information unless it is necessary for a lawful purpose, you have the authority to provide it and the relevant processing and safeguards are appropriate. A general support tool should not be treated as permission to collect every type of record.

If you believe information concerning a child or sensitive information has been provided improperly, contact us with enough detail to identify the interaction. We will assess the concern, the responsible organisation and the action required under applicable law.

Other websites and providers

TruCom can link to another organisation’s website or connect to a service you authorise. That organisation’s own privacy notice applies to the processing it controls. We do not determine every use of information by a messaging, identity, payment or other independent provider.

Read the relevant provider’s notice and the business’s own notice before providing information through those services. A business using TruCom remains responsible for explaining its own customer support practices; displaying this platform policy does not replace that obligation.

Changes to this policy

We may update this policy when the service, data handling or applicable requirements change. The published version carries an effective date and version number so you can identify the notice you read.

Where a change materially affects how existing personal data is used, we will provide appropriate notice through the service or a relevant contact channel and meet any additional requirement that applies. We will not treat an update to this page as automatic consent to a new processing purpose where the law requires separate consent or another legal basis.