Last updated: March 2026

Privacy & data compliance

This page summarizes how TrendMate ("we", "the service") handles data for teams using the product. It is designed to support common procurement and GDPR-related questions. It does not replace legal advice; have your counsel review before signing customer terms.

1. Who is responsible?

The organisation operating this TrendMate deployment acts as the data controller for account data (e.g. profile, billing). Depending on your configuration, infrastructure providers (see subprocessors below) may process data as processors under your or our agreements.

2. What we process

• Account & preferences: email, name, contact fields you provide, timezone for plan limits, authentication metadata.
• Product configuration: project names, monitor keywords, sources, and similar settings.
• Signals & analytics outputs: content ingested from public sources you choose (e.g. news, social posts, forums), including text, URLs, timestamps, and author handles or names where publicly visible. We analyse and store these to power dashboards, reports, and alerts.
• Billing: subscription status and payment references via our payment provider (we do not store full card numbers on our servers).

3. Legal bases (GDPR-style framing)

Typical bases include:

• Contract — providing the service you signed up for (including paid plans).
• Legitimate interests — securing the product, abuse prevention, and aggregating public information for monitoring use cases, balanced against user rights.
• Consent — where you use optional integrations or marketing that explicitly require it.

Your organisation should confirm bases in your own DPIA, especially for employee or sensitive topics.

4. Retention

Report history visible in the app is limited by your subscription tier. Current defaults (from product configuration):

Raw or derived signal data may be removed or archived in line with this window and operational backups. Exact purge behaviour can vary by deployment; confirm with your administrator if you need a fixed deletion SLA.

5. Subprocessors & transfers

Depending on how this instance is hosted, data may be processed by vendors such as:

• Database, auth, and file storage (e.g. Supabase)
• Payments (e.g. Stripe)
• Hosting / edge (e.g. Vercel, Railway, or your cloud)
• Optional third-party APIs you enable (e.g. social or news data providers)

Data may be stored or processed in regions supported by those vendors. For EU customers, standard contractual clauses (SCCs) or equivalent mechanisms are typically provided by major vendors; retain evidence in your vendor register.

6. Your rights

Where GDPR or similar laws apply, individuals may have rights to access, rectify, delete, restrict, or object to processing, and to data portability. Account holders can delete their workspace data via Profile → danger zone, where that action is enabled. For requests this flow cannot cover, use the contact below.

7. Data Processing Agreement (DPA)

Agencies and enterprise buyers often need a DPA naming roles (controller/processor), subprocessors, security measures, and international transfers. We can provide a standard DPA template or review yours as part of onboarding.

• Describe the monitoring purposes and categories of data (public signal content, account data).
• List subprocessors your deployment actually uses.
• Attach technical and organisational measures (encryption at rest/transit, access controls, RLS).
• Reference this retention table and your organisation’s support contacts.

8. Contact

Privacy, DPA, and compliance questions: configure NEXT_PUBLIC_PRIVACY_EMAIL for this deployment, or reach your workspace administrator.

Service URL: https://app.trend-m8.com