Privacy policy

Trigvanta is an automation-first platform for SEO, content and social listening. This policy explains exactly which personal data we collect when you create an account, connect a source or use the browser extension, and why.

Trigvanta is the data controller for the account and workspace data you provide directly, and a data processor for content Trigvanta scans or generates on behalf of a connected workspace, as set out in the data processing agreement.

Account data: email, full name, phone number, country and a hashed password (never stored in clear text). For business accounts we also collect the company registration number, company name and contact person.

Workspace and connection data: the websites, Google Search Console properties, WordPress/CMS credentials and social accounts you connect, plus the automation rules you set for each.

Content data from connected sources: crawl results from your own site, Search Console data for keywords/clicks/impressions, and — where you use the browser extension — posts read from social platforms you are logged into (see "The browser extension" below for the exact fields).

Generated content: AI-written articles, fixes and replies, together with the evidence each draft is based on, traceable to its source.

Security data: two-factor secrets (encrypted at rest), login events and audit logs recording who did what and when.

Directly from you at sign-up and in account/workspace settings.

From providers you explicitly authorise, such as Google (Search Console via OAuth) or your WordPress site (an application password you create yourself and can revoke).

From our own crawler visiting the public pages of websites you connect.

From Trigvanta's browser extension, but only while it is installed, enabled and you are actively using one of the platforms it supports — see below.

The "Trigvanta Connector" extension reads posts on social platforms you are already logged into in that browser. It uses no developer API keys and never asks for your platform password — it only reads what your own browser already shows on screen.

It runs only on these platforms: Facebook, Instagram, TikTok, LinkedIn, X/Twitter, Threads, Pinterest, Bluesky, Gab, Truth Social, Minds, Rumble and Odysee. It requests no browser permission beyond local storage, and its page access is limited to those platforms — never every page you visit.

For each post it captures exactly five things: which platform and group/page it is, the post URL, the author display name, the post text and the publication date if the page shows one. Comments and replies under a post are not captured today — only the post itself.

It never reads your password or session token, private messages, or private groups/pages you have not already opened, and it does nothing at all while it is uninstalled or switched off.

This is a first version: each platform is read via that platform's own page layout, which can change without notice. If a platform changes its page structure, that one platform stops returning results until we update — the others keep working.

To run your account and workspaces, run the automation rules you set, generate and publish content you approve, and keep an auditable log of what the system did and why.

Account and workspace data is processed because it is necessary to deliver the service you signed up for (contract). Cookie/marketing data is processed only with your explicit, withdrawable consent. Security and audit logging rely on our legitimate interest in keeping the platform safe.

Product analytics (e.g. crawls, automation decisions, publishing jobs) drive core function and are not optional. Marketing analytics is off by default and only loads after you accept the Analytics category — see the Cookie policy.

Content drafts are generated by a third-party AI provider (currently Grunden.ai) from the evidence in your workspace. Drafts stay in a review queue and are never published automatically unless you have explicitly set that specific rule to full automation, and even then generation must first pass validation.

Trigvanta does not make decisions that produce legal or similarly significant effects about you by solely automated means. Where automation acts on your behalf, you retain human oversight and can review, edit or reject any output. Under the GDPR (Article 22) you have the right not to be subject to a decision based solely on automated processing that significantly affects you; contact order@trigvanta.com to exercise it.

In line with EU AI Act transparency expectations, AI-generated content is always labelled as a draft, is traceable to the provider and evidence that produced it, and a human approves anything that goes live externally.

We only share data with the subprocessors listed at /subprocessors, each with its purpose and region stated — never sold, never shared for third-party advertising.

Trigvanta's infrastructure runs on Hetzner in the EU. Where a subprocessor processes data outside the EU/EEA, that transfer is documented on the subprocessor's record together with its legal mechanism (e.g. EU Standard Contractual Clauses).

Trigvanta is available globally, so the rights you have depend on where you live. We apply a GDPR-level baseline to everyone and honour stronger local rights where they apply.

EEA / EU: under the GDPR you have rights of access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority.

United Kingdom: the UK GDPR gives you the same core rights; you may complain to the ICO.

Switzerland: the revised FADP gives you comparable access and correction rights.

California: under the CCPA/CPRA you have the right to know, delete, correct, and opt out of "sale"/"sharing" of personal information. Trigvanta does not sell or share personal information for cross-context behavioural advertising.

Brazil (LGPD), Canada (PIPEDA) and other regions: we honour local access, correction and deletion rights. Wherever you are, you can exercise your rights from the Compliance section or by emailing order@trigvanta.com.

Retention periods are set per data category and, where applicable, per company, and govern when data is archived or deleted. You can see current retention settings via a data export request.

You can request export, deletion or correction of your personal data at any time. Export and deletion requests are carried out for real — export produces an actual downloadable archive of your data, and deletion anonymises your account record and revokes active sessions, rather than just flipping a status.

Send a request from the Compliance section of your dashboard while logged in, or email order@trigvanta.com.

Trigvanta is a business tool and is not directed at children. You must be at least 18 to create an account, and we do not knowingly collect personal data from children.

Passwords are hashed, never stored in clear text. Two-factor login (TOTP) is mandatory for owners, admins and root accounts. Connected-source credentials (Search Console tokens, WordPress application passwords, DataForSEO keys) are encrypted at rest, each with its own encryption key. Every sensitive action is written to an audit log, and secrets are masked before being written to any log or error report.

Material policy changes may require renewed acceptance before you can keep using the platform.

support@trigvanta.com and order@trigvanta.com