Confidentialité

Trelyvo is a product and brand operated by ASL konsultti, business ID 3464920-3, registered domicile Hämeenlinna, Finland.

Registered address: Laajakorvenkuja 6, 01620 Vantaa, Finland

Privacy enquiries and requests: privacy@trelyvo.com

Trelyvo is business software. Which role we hold depends on whose data is involved, and there are two situations.

For our own business — the accounts of the businesses that use Trelyvo, sign-in, support, our own website and commercial administration — we are the controller.

For the personal data a business collects from its own customers through the Trelyvo widget, that business is the controller. It decides what to ask, what to do with the answers and who to contact. Trelyvo processes that data on its instructions, as its service provider.

The product processes the following, and nothing else:

• Business account: the email address used to sign in, and the time of the last sign-in.
• Company configuration: the business name, trade, service area, the services it offers, the questions it asks, and the address its leads are emailed to.
• Website-derived knowledge: text taken from the business's own public website during setup, together with the page it came from.
• Customer conversation messages: what an end customer types into the widget, stored as written.
• Contact details supplied by customers: name, email address and phone number, where the business has configured those questions.
• Qualification answers: the structured answers derived from the conversation — service, size, location, timing and whatever else that business asks.
• Opportunities and leads: the assembled record of a finished enquiry.
• Authentication data: single-use sign-in tokens, stored only as a hash, with their expiry and whether they have been used.
• Notification email processing: the recipient address, subject and body of the lead notification and the sign-in email.
• A pseudonymous visitor identifier: a salted hash of the visitor's IP address and browser user-agent string, used to limit abuse. The IP address itself is not stored.
• Technical telemetry: model name, response time, token counts and error codes. It contains no message content and no contact details.

No photographs or files are uploaded. The widget can attach images to a message in the browser, but nothing is transmitted or stored, and there is no file storage in the product.

No analytics, advertising or tracking of any kind is used. There is no tag manager, no advertising pixel and no cross-site tracking.

Application logs record shapes, names, counts and error codes. They do not record message content, contact details or any value a customer typed.

Business account and configuration data is processed to provide the service under our agreement with the business.

Conversation and lead data is processed to deliver the service the business has asked for — answering its customers and passing on completed enquiries. The business determines the purpose and its own legal basis for that processing.

The pseudonymous visitor identifier and technical telemetry are processed in our legitimate interest in keeping the service available and preventing abuse.

The primary database is hosted by Supabase in the West EU (Ireland) region, eu-west-1. Conversations, leads, accounts and configuration are stored there.

Server-side execution — page rendering and the application's own interfaces — currently runs on Vercel in the US East region, iad1. This means data submitted through the widget is processed in the United States before it is stored in Ireland, regardless of where the visitor is.

AI understanding, reply composition and website extraction are performed by OpenAI, which receives the conversation text, the business's configuration and the text taken from the business's own website.

Email is sent by Resend, which receives the recipient address and the contents of the message.

We state the regions we have configured and can verify. We do not state processing locations, retention practices or contractual safeguards on behalf of these providers, because those are theirs to state and not ours to assume.

Four service providers are involved in running Trelyvo. Each is necessary for the product to function, and there are no others.

• Supabase — database. Receives and stores everything listed above.
• Vercel — hosting and server execution. Handles all request traffic, including conversation text in transit.
• OpenAI — AI understanding, reply composition and website extraction. Receives conversation text, company configuration and crawled website text.
• Resend — email delivery. Receives recipient addresses and message contents for sign-in and lead notification emails.

A completed enquiry is sent to the one email address that business configured, and is visible in that business's own inbox in Trelyvo. It goes nowhere else.

Each business's data is separated from every other business's at the database level, and that separation is verified by automated tests.

Data is not sold, and it is not shared for advertising or marketing.

Data is retained while it is needed to provide the service and to operate the business relationship. The product does not currently delete conversations or leads automatically, and we would rather say so than describe a schedule that does not exist.

Requests for access, correction or deletion can be sent to privacy@trelyvo.com and are handled individually.

Some information may need to be retained for longer where law requires it.

Sign-in is passwordless. No password is ever set, sent or stored. A sign-in link works once, expires in fifteen minutes, and only its hash is stored, so the token table is not a set of credentials.

The session cookie carries a signed user identifier and nothing else — no email address, no company, no personal data.

Each business's data is isolated at the database level under deny-by-default rules, and the application connects with least privilege.

Connections are encrypted in transit.

We hold no security certification and we do not describe ourselves as certified. If that changes, this section will name the standard, the auditor and the date.

One cookie is used, and it is strictly necessary for signing in to a business account.

• trelyvo_business — keeps a business user signed in. HttpOnly, Secure, SameSite=Lax, path /, lifetime 30 days. It holds a user identifier, an expiry and a signature.
• Browser local storage — the widget keeps the identifier of the current conversation in the visitor's own browser so that reloading the page does not lose it. It contains no personal data and is removed when the conversation is restarted.

There is no analytics cookie, no advertising cookie and no third-party cookie to consent to. The one cookie in use is required to provide a service the user has asked for by signing in. If that ever changes, consent will be asked for before the cookie is set, and this section will say so.

You may ask what data we hold about you, ask for it to be corrected, ask for it to be deleted, or object to processing. Write to privacy@trelyvo.com.

If your data reached Trelyvo through a business's website — because you sent that business an enquiry — that business is the controller and is the right first point of contact. Write to us anyway if that is easier, and we will act on their instructions and help where we can.

You may also complain to your local data protection authority.

This notice is updated when the product or its processing changes. The version on this page is the one in force.

This notice is published in English. Where the product's interface is available in other languages, the English text is the version that applies.