Privacy Policy

FillTrust provides software that drafts answers to security questionnaires from documents its customers upload. This policy explains what we do with personal data and applies to our website and to the product.

For data about our own users and visitors we are the controller. For the documents and questionnaires a customer uploads we act as a processor on that customer's instructions; the terms of that processing are in our Data Processing Agreement, which applies automatically and does not need to be requested or signed separately.

Contact for anything in this policy: privacy@filltrust.com. We are established in France and answer every message. Postal address: 1 rue Marguerin, 75014 Paris, France.

Four categories, and nothing beyond them.

Account data. Your name, work email address, company name if you give one, a hashed password, and, if you enable two-factor authentication, an encrypted TOTP secret. You give us these directly.

Customer content. The documents you upload to your knowledge base and the questionnaires you upload to be answered, together with the answers produced from them and every revision to those answers. This may contain personal data if your documents do; we handle it as a processor under the DPA.

Usage and diagnostic data. Server logs, error reports, and records of actions taken in the product (who changed an answer, and when). The audit trail is a product feature: it is what lets you answer “who approved this?” about your own questionnaires.

Where you came from. When you create an account we record the page you were on immediately before signing up. For our own pages we keep the path; for anywhere else, the site’s name and nothing more. It is read from the referrer your browser already sends with the request, so we store nothing on your device to obtain it, there is no cookie and no identifier, we never keep the query string, and it is deleted with your account.

Each purpose has one legal basis under Article 6 of the UK and EU GDPR.

Where we rely on legitimate interests we have considered whether that interest is overridden by your rights. You can object to any of it; see your rights below.

We do not sell personal data, we do not share it for advertising, and we do not use customer content to train models. That last point is contractual as well as a statement of intent: see AI providers.

Answering a questionnaire means sending the question text and the specific excerpts retrieved from your documents to a model provider. We send the excerpts used to answer, not whole documents, and we do not send your account data.

We call Google and OpenAI through their standard business APIs, whose terms exclude API content from training their models. To be precise about what that does and does not mean: it is a contractual commitment not to train on your content, and providers may still retain it briefly for abuse monitoring under their own published policies. We do not hold a zero-retention agreement with either provider, and we would rather say so than imply a guarantee we have not bought.

No decision with a legal or similarly significant effect is made about you by automated means. The product drafts text for a person to review; it does not decide anything about anybody.

Only the sub-processors we publish, each for a stated purpose. The current list is at /legal/subprocessors and holds 9 entries. We give notice before adding a new one, on the terms in the DPA.

We may also disclose personal data where we are legally required to, or to establish or defend legal claims. If we are compelled to disclose customer content we will tell the customer unless we are prohibited from doing so.

If the business is sold or merged, personal data may transfer to the acquirer under this policy. We would give notice before that took effect.

Documents are stored in Google Cloud in Paris and the database is hosted in Frankfurt, both of them in the EU.

Question text and the specific excerpts used to answer are sent to AI providers in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, which are annexed to our Data Processing Agreement along with the transfer impact information a reviewer usually asks for.

Deleting your account cancels billing, removes every uploaded document and generated questionnaire from storage, and deletes your records. If any part of that cannot be completed the deletion is aborted and reported rather than partially applied, because a deletion that reports success without finishing is worse than an error.

Under the UK and EU GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent where processing relies on it.

Account deletion in your settings exercises erasure directly and immediately. For anything else, write to privacy@filltrust.com. We respond within one month, and we do not charge for it.

If you are an end user whose data appears inside a customer's documents, that customer is the controller and we act on their instructions. Send your request to them; if it reaches us first we will pass it on and tell you we have.

You also have the right to complain to a supervisory authority. In France that is the CNIL. We would rather you told us first, but that is your right and not conditional on it.

No advertising cookies, no cross-site tracking, and nothing sold or shared with data brokers. The attribution described in what we collect is read from the page you arrived from at the moment you sign up, and stores nothing on your device.

Nothing that is not strictly necessary runs before you have been asked. The first time you arrive, a banner asks about the one optional thing on this list. Refusing takes exactly as many clicks as accepting, nothing on the site is withheld either way, and you can change your mind from the Cookie preferences link at the bottom of every page. Turning analytics off there deletes the cookies it set rather than merely stopping new ones.

The cookies that need no consent, because the site cannot work without them:

• __Host-next-auth.csrf-token and __Secure-next-auth.callback-url, set on your first visit. The first stops somebody else's page submitting our sign-in form on your behalf; the second remembers where to return you afterwards.
• __Secure-next-auth.session-token, set when you sign in and removed when you sign out. It is what keeps you signed in.
• ft_pending_invitation, set only if you follow an invitation to somebody's workspace before you have an account, and cleared the moment it is redeemed.

Two things that are not cookies but are stored on your device, so they belong in the same list. The sign-in library keeps an entry called nextauth.message in your browser's local storage: it is how two open tabs agree that you have signed out of both, and it holds an event name and a timestamp, nothing that identifies you. And cc_cookie records the choice you made in the banner, so you are not asked again on every page.

The __Host- and __Secure- prefixes on those three names are not decoration: they are an instruction to your browser to refuse the cookie unless it arrived over HTTPS from this exact site. You will see the names without the prefix only if you are running the site locally over plain HTTP, which is a thing only we do.

The one cookie that does need consent, and only if you give it:

• _ga, _ga_* and _gid, set by Google Analytics, which counts visits so we know which pages are worth writing. Off unless you turn it on. Before any address is sent we remove anything single-use from it, so a password reset or invitation link is never handed on. Google Analytics is named on our sub-processor list with what it receives.

Encryption in transit and at rest, tenant isolation derived server-side from your session, rate-limited authentication with optional two-factor, least-privilege service accounts, an append-only audit trail, and versioned storage. The full description is on our security page and the contractual version is Annex II of the DPA.

If you believe you have found a vulnerability, write to security@filltrust.com. We will acknowledge it and tell you what we are doing about it.

The service is sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, write to privacy@filltrust.com and we will delete it.

We update this policy when what we do changes. The date at the top moves only when the substance does, not on every deploy, so that a version you compared against still means something. For a change that materially reduces your rights we give notice by email to account holders before it takes effect.