Privacy notice

What is held, why, and for how long

Your name and email address

to sign you in, put your name on the work you own and record, and send you the reminders and digests your workspace has turned on

Kept for as long as you are a member of a workspace; your name stays on the readings, decisions and audit entries you made after you leave, because the record has to say who did what.

Everything recorded in a workspace

it is the product: the plan, its metrics and readings, initiatives and milestones, meeting notes, decisions, comments, and the documents attached to them

Kept for the life of the workspace, and until an administrator clears or deletes it; readings and the audit trail are kept as an append-only record and are not edited in place.

Documents you import

to read them onto the plan; the rows you review keep short quotes from it as evidence of where each item came from, and the file itself is kept only if you choose "keep a private copy" when importing, so it can be read again later

Kept the quotes live with the import record; discarding an import removes them. A kept copy is stored privately, readable only by your workspace, until the import is deleted or the plan is cleared.

An audit trail

who changed what, when, and from what to what — required by customers who use the plan for governance and incentive decisions

Kept for the life of the workspace; it is never edited or trimmed by the product.

Notification records and, if you turn them on, push subscription keys for your devices

so nothing is sent twice, and so a reminder can reach your phone

Kept notification records for the life of the workspace; push keys until you turn notifications off on that device.

Server logs

to keep the service running and to investigate failures

Kept per the hosting provider's retention; they do not contain document contents.

Who processes it on Trellis’s behalf

Clerk — sign-in and organization membership

Receives your name, email address and sign-in credentials; which organizations you belong to and your role in them.

Neon — the database

Receives everything recorded in a workspace: the plan, readings, comments, session notes, the audit trail, and the names and addresses of members.

Vercel — hosting, and the private file store for attached documents and kept import copies

Receives every request to the application and its server logs; the documents attached to sessions, objectives and initiatives; and imported files, when you choose to keep a private copy.

Resend — email delivery

Receives the address and name of each recipient, and the text of each reminder, digest and mention email.

Anthropic — the model that reads imported strategy material and drafts summaries

Receives the full content of documents you choose to import, and the plan facts a session summary or owner update is drafted from (an administrator can turn drafting off) — processed in the United States under Anthropic's commercial API terms, which do not use it to train models.

Nothing is sold, shared with advertisers, or used to build profiles. No analytics or advertising scripts run on these pages. Data is hosted in data centres operated by the services above; the region is recorded in the deployment’s documentation and available on request.