Privacy Policy
Effective June 9, 2026 · Last updated October 23, 2026
Truseta is a wealth tracking platform. We are not a financial institution, investment adviser or broker-dealer, and nothing in the product, including anything produced by Quinn, our AI assistant, is financial advice. We never sell your data, run ads or monetize your information; we earn subscription fees only. To deliver AI features, parts of your data are processed by third-party AI providers under agreements that prohibit training on it, as described in Section 4 and the AI and Data Disclaimer.
1Who we are
Truseta is a private wealth command center for high-net-worth individuals, families, family offices and their advisors. The platform is operated by Truseta Corporation, a Florida corporation (“Truseta,” “we,” “our,” or “us”). Access is by invitation or approved application only; we do not offer open public registration.
Questions about this Privacy Policy can be directed to privacy@truseta.com.
2Data we collect
2.1 Account and identity data
When you create an account we collect your name, email address and authentication credentials. We use Supabase Auth for identity and session handling. Multi-factor authentication is required for password sign-in and advisor portals (Google and Microsoft sign-ins rely on the provider’s own second factor); MFA enrollment data is stored securely. We also record your acceptance of our legal documents: the version, the date and time, and the IP address and browser it came from.
2.2 Financial account data (via Plaid and Coinbase)
When you connect a bank, brokerage, retirement or credit account through Plaid, Truseta receives and stores on your behalf: account names, masked numbers, types and institution details; current and available balances; investment holdings, quantities, prices and cost basis where available; liability balances; and transaction history used for performance and cash-flow analysis. Truseta never receives or stores your banking credentials; credential entry happens exclusively inside Plaid’s Link interface under Plaid’s own privacy policy. A connected Coinbase account gives us read-only balances and holdings; we cannot move funds and do not store your Coinbase credentials.
2.3 Manually entered financial data
Private equity investments, real estate, entity structures (LLCs, trusts, holding companies), capital-call schedules, ownership percentages, loans, cash-flow records, donations and gifts, books and journal entries, and custom valuations are entered or imported by you.
2.4 Documents
You may upload or link K-1s, 1099s, tax returns, partnership agreements, closing statements and other records. Documents are read by our AI features to extract structured data (Section 4). Documents you link from Google Drive or OneDrive are accessed with the encrypted OAuth tokens you granted, not your password, and stay in your own storage; they are not copied to Truseta servers unless you explicitly import them.
2.5 Google user data and Limited Use
Truseta’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When you connect Google, we store encrypted OAuth access and refresh tokens so the product can call Gmail and Drive on your behalf. We do not keep a copy of your mailbox: searches run against Gmail at the moment you ask and the results are not retained. Where a feature draws a specific finding out of your mail (the private-investment intelligence scan is the one that does), the sender, subject, date and a short excerpt of the source message are stored alongside that investment so a figure can be traced to where it came from. Drive folder IDs you configure are stored as pointers; file bytes stay in Google Drive unless you explicitly import a document.
We use Drive to read the financial documents you point us at and to write files you ask us to save, and Gmail to let Quinn search and read correspondence you direct it to and to leave draft replies in your own mailbox. We do not use Google user data for advertising, do not sell it, and do not use it to train generalized AI models. Human access to Google user data is limited to what you explicitly authorize, what is necessary for security or to comply with law, and what is required to operate features you use.
Truseta does not send email from your Gmail account. Anything Truseta composes for you is placed in your Gmail drafts for you to read, edit and send yourself. Google has no permission that allows drafting without also allowing sending, so the permission we hold (gmail.compose) is broader than what we do with it; we do not request the dedicated send or modify permissions, and no code in Truseta calls Gmail’s send endpoint. We do not request Google Calendar access; the compliance calendar is Truseta data.
You can disconnect Google at any time from Settings → Connections. Disconnecting revokes our access with Google, deletes the stored encrypted tokens and purges Google-derived email and calendar cache for that mailbox. Excerpts saved on an investment by the intelligence scan stay with that investment until you request account deletion. You can also revoke Truseta from your Google Account permissions. When K-1 portal notice detection is enabled, Truseta may read the sender, subject and date of messages from portal senders you have turned on; message bodies are not stored.
2.6 Microsoft 365 data
If you connect Microsoft 365, the same rules apply through Microsoft’s OAuth: encrypted tokens, Outlook searched at the moment you ask, drafts left in your own mailbox, OneDrive folders stored as pointers with files remaining in your OneDrive, and disconnect from Settings → Connections or from your Microsoft account at any time.
2.7 Communications and AI interactions
When you use Quinn or another AI feature, your query and the context needed to answer it (relevant portfolio data, and documents or messages you ask it to read) are transmitted to the AI provider described in Section 4. Conversations and AI-generated summaries, signals and extracted values are stored in your workspace for continuity and traceability.
2.8 Advisors and people you invite
When you invite an advisor, accountant, attorney, spouse or team member, we collect their name, email, role, the permissions you grant, and a log of their access. They are bound by these documents when they accept their own invitation.
2.9 Usage and technical data
We collect standard technical data: IP address, browser and operating system, device identifiers, pages visited, timestamps, and error reports from our monitoring tools. This is used for security, debugging and service improvement, never for advertising.
3How we use your data
We use your data for the following purposes and no others:
- To operate and deliver the Service, including aggregating and displaying your financial data
- To compute analytics, returns, IRR, net worth, scenario valuations and portfolio summaries
- To power Quinn and the other AI features described in Section 4
- To operate Google and Microsoft features you invoke, using encrypted OAuth tokens, and to store the source details when a feature draws a finding from mail
- To extract structured data from documents you upload or link
- To send platform notifications, alerts and the Wealth Digest where enabled
- To authenticate you, maintain session security and record your acceptance of our legal documents
- To detect and prevent fraud, unauthorized access and abuse, and to investigate security incidents
- To comply with legal obligations and enforce our Terms
- To improve the Service using aggregated, de-identified usage patterns
We do not use your data to make or suggest investment decisions, provide financial advice, or recommend financial products. Truseta is a tracking and organizational tool, not an advisory service.
4Artificial intelligence and your data
Quinn, document extraction, private-investment intelligence, digests, portal detection and suggestions are produced with large language models run by third-party providers. By default that provider is Anthropic (Claude). If your workspace selects another provider in Settings, such as OpenAI or xAI, or enables voice through ElevenLabs, that provider processes the relevant data instead or in addition. If you connect your own Claude or ChatGPT to your workspace, your data flows to that provider under your own agreement with them.
- What is sent: your prompts and conversation, the workspace context needed to answer, and the documents, emails or files you ask a feature to read, including scheduled scans you have turned on.
- Training: our agreements with the providers we contract with prohibit them from using your data to train their models, and Truseta does not train models on your data. Providers you connect yourself are governed by your own terms with them.
- Retention: providers may retain inputs briefly for abuse monitoring under their own policies. AI output is stored in your workspace until you delete it or close your account.
- Accuracy: AI output can be wrong and is not reviewed by a person before you see it. See the AI and Data Disclaimer.
- Control: you can leave AI features off, disconnect mail and document stores, and remove bring-your-own AI connectors in Settings.
5Third-party services
Truseta uses the following third-party services to deliver its functionality. Each operates under its own privacy policy and terms, and each processes only the data needed for its role.
Plaid Technologies, Inc.
Connects and syncs bank, brokerage and investment accounts; handles credential entry and institution authentication. plaid.com/legal/privacy-policy
Anthropic, PBC, and other AI providers
Anthropic’s Claude API powers Quinn and the AI features by default; OpenAI, xAI and ElevenLabs process data only if your workspace selects them. Data is sent for processing only and is not used to train models. anthropic.com/legal/privacy
Supabase, Inc.
Database, authentication and storage, hosted on Amazon Web Services in the United States. Each customer’s data is separated from every other customer’s by access rules enforced in the database itself and is encrypted at rest. supabase.com/privacy
Vercel, Inc.
Hosts and serves the application. vercel.com/legal/privacy-policy
Google LLC and Microsoft Corporation
If you connect Gmail and Drive or Outlook and OneDrive, your use is governed by that provider’s terms and privacy policy. We store encrypted OAuth tokens and request only the scopes those features need (Sections 2.5 and 2.6).
Coinbase Global, Inc.
If you connect Coinbase, Truseta receives read-only balance and holdings data under Coinbase’s privacy policy.
Twilio SendGrid and error monitoring
Transactional email (invitations, security notices, digests you enable) is delivered through Twilio SendGrid, which processes recipient addresses and message content for delivery. Application errors are reported to an error-monitoring service with technical context and without your financial data wherever possible.
6Data sharing and disclosure
We do not sell, rent or trade your personal data, do not share it with advertisers or data brokers, and do not use it to target you with advertising.
We disclose your data only in these limited circumstances:
- To the service providers in Section 5, strictly as necessary to operate the Service, under contracts that restrict their use of it
- To advisors, accountants, attorneys and workspace members you explicitly authorize, limited to the areas and permissions you grant
- To comply with a valid legal obligation, court order or government request, after reasonable efforts to notify you unless prohibited by law
- To protect the security or integrity of the Service, to investigate fraud or abuse, or to prevent imminent harm
- In connection with a merger, acquisition, financing or sale of all or substantially all of our assets, subject to advance notice and successor privacy protections
7Data security
We use administrative, technical and physical safeguards appropriate to the sensitivity of personal financial data, including:
- Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
- Column-level encryption of sensitive fields such as Plaid access tokens, tax IDs and account numbers using keys unique to each family, so one family’s data cannot be decrypted with another’s key
- Encryption keys held in a dedicated secrets vault separate from the application database
- Database-level separation of each family’s data through row-level access rules
- Mandatory multi-factor authentication for password accounts and advisor portals
- Sessions that require re-authentication daily on desktop and every 7 days on iOS
- Logged, separately authorized access to production data by Truseta personnel
- Invitation-only admission: only approved accounts can sign in
No method of transmission over the internet or of electronic storage is completely secure. While we work to protect your information, we cannot guarantee its absolute security, and we cannot guarantee that unauthorized third parties will never defeat our safeguards or those of our service providers. You also play a part: keep your credentials, second factor, devices and email account secure, and tell us immediately at security@truseta.com if you suspect your account has been compromised.
8Security incidents and breach notification
If we determine that a security incident has resulted in unauthorized access to or acquisition of your personal information, we will notify you without undue delay and within the time required by applicable law, including the Florida Information Protection Act and any other law that applies to you. The notice will describe what happened as far as we know it, what information was involved, what we are doing about it, and what you can do. We will also notify regulators, financial institutions or other parties where the law requires it. We may ask you to change credentials or take other protective steps, and we ask that you cooperate with us.
Our responsibility for security incidents is subject to the Terms of Service, including its limitation of liability.
9Data retention
We retain your account and financial data for as long as your account is active. If you close your account we delete your personal data within 30 days, except where retention is required by law, where records of your legal acceptances and security logs must be kept, or where encrypted backups are still within their rotation cycle (completed within 90 days).
You may export your data before closure: Settings → Data produces a complete workspace archive on demand. How to close your account: deletion is deliberately not a self-serve button. Request it from Settings → Data or by emailing support@truseta.com; we confirm the request with you directly before anything is removed, then complete it within the 30 days above. Disconnecting Google or Microsoft in Settings → Connections revokes our access immediately, deletes the stored tokens and purges the derived mail cache; investment-intelligence excerpts are removed on account deletion.
10Where your data is stored
Truseta is operated from the United States and your data is stored and processed in the United States by us and the service providers in Section 5. If you use the Service from outside the United States, you understand that your information is transferred to and processed in the United States, where privacy laws may differ from those of your country.
11Your rights
You have the following rights with respect to your data:
- Access: request a copy of the personal data we hold about you
- Correction: request correction of inaccurate data
- Deletion: request deletion of your data and account
- Portability: request an export of your data in a machine-readable format
- Restriction: request that we stop processing your data in certain circumstances
- Objection: object to processing based on legitimate interests
To exercise any of these rights, email privacy@truseta.com from the address associated with your account. We will respond within 30 days and may need to verify your identity first.
12California residents (CCPA / CPRA)
If you are a California resident you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act. In the past 12 months we have collected the categories of personal information described in Section 2 for the purposes in Section 3. We have not sold or shared personal information and do not sell or share it for cross-context behavioral advertising. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (not applicable); and not to be discriminated against for exercising these rights. Submit a request to privacy@truseta.com; we respond within 45 days.
14Children's privacy
Truseta is not directed to individuals under 18 and we do not knowingly collect personal information from children. If you believe a minor has created an account, contact privacy@truseta.com and we will delete it promptly.
15Changes to this policy
We may update this Privacy Policy from time to time. For material changes we will notify you by email or in the Service at least 14 days before they take effect, and we may ask you to read and accept the updated policy before continuing. Your continued use after the effective date is acceptance of the revised policy.
16Contact us
For privacy questions, data requests or security concerns:
- Email: privacy@truseta.com
- Security issues: security@truseta.com
- Mailing address: Truseta Corporation, 1900 Glades Rd, STE 340, Boca Raton, FL, 33496