Trestle Privacy Policy
Last updated: [DATE]
1. Who we are
Trestle is a service operated by [COMPANY LEGAL NAME], a company registered in England and Wales (company number [NUMBER]), with its registered office at [REGISTERED ADDRESS] ("Trestle", "we", "us").
[OWNER: We are registered with the Information Commissioner's Office under registration number [ICO NUMBER]. Keep this sentence only once the registration exists; nothing in the project shows it yet.]
Questions about this policy or your data: info@trestleinsight.com.
2. What this policy covers
This policy explains what information we collect when you visit our website or use the Trestle app, what we do with it, who we share it with, how long we keep it, and how you can have it deleted.
Trestle is a business tool for companies and sole traders that sell on online marketplaces ("sellers"). It is not intended for consumers or for anyone under 18.
[SOLICITOR: confirm Trestle's role. For the account and sign-in information in section 3.1 Trestle appears to decide why and how it is used (controller). For the business data a seller uploads (section 3.3), confirm whether Trestle is a controller or a processor acting for the seller, given that a sole trader's sales figures may be personal data. Section 5.5 of the Terms depends on the answer.]
3. Information we collect
3.1 Your account
When you sign up we collect:
- your name, your work email address and the name of your business;
- your password, which we never store as written: we keep only a one-way scrambled form of it (a hash), and the hashes of your last 10 passwords so an old one cannot be reused;
- a record that you accepted these terms and this policy, with the version and the time.
Signing in to Trestle always needs a second step. Depending on what you choose, we keep:
- a passkey: your device keeps the private part; we keep only its public key, an identifier and a counter;
- an authenticator app: the shared secret, stored encrypted;
- recovery codes: 10 one-use codes, stored only as hashes;
- codes and links we email you (to confirm your email, sign in, reset a password or change your email): stored only as hashes, and each expires, for example a sign-in code after 10 minutes and a password reset link after 30 minutes.
While you are signed in we keep a record of each session: when it started and was last used, and a short label for the browser (for example "Chrome on Windows"), so you can see and end your sessions from the Security page. A session ends after 8 hours without use, and after 7 days at most.
If you are part of a team, the account's owners can see the name, email address and role of each person in the account. When an owner invites someone, we keep the invited email address and role; the invitation link lasts 7 days.
You can change your name and email address from "Your profile". A new email address takes effect only after you use a link sent to it, and we tell the old address, with a link that undoes the change for 7 days.
3.2 Payments
Payments are taken by Whop, which acts as the seller of record for the payment and handles card details, receipts and VAT under its own privacy policy and terms. When you start a payment we send Whop only an internal reference for your Trestle account and the product chosen (the audit or the subscription). You give your payment details to Whop, not to us. We do not see or store card details.
From Whop's payment messages we keep: Whop's own identifiers for you as a customer and for your membership, the product, the payment or subscription status, the paid period's dates, whether a subscription is set to cancel, and the identifier of each message (so a message is never applied twice).
3.3 The business data you upload
Trestle does not connect to your Amazon or Argos account. It has no access to your seller account and never asks for your marketplace password. You choose which files to give it, by uploading reports you have downloaded yourself:
- Amazon's "All Listings" report: for each listing, the SKU, product name, ASIN, listed price, quantity in stock, the date it opened, the fulfilment channel and the listing status;
- a sales and costs spreadsheet: for each product, sales figures (price, fees, units sold and the period), its category, and the costs and settings you enter, such as product cost, freight, duty, VAT status, return rate, size, weight and advertising rates;
- an Argos (Mirakl) order export: for each order line, the order number, the SKU, the order date, the quantity, the status, and the price, delivery charge, commission and refund amounts.
What we keep from an upload: the figures read from each row, with the file's name and the row number so each figure can be traced back. We do not keep a copy of the file itself: it is read once and the figures are stored. [OWNER: confirm this stays true once hosting exists, i.e. that no copy of uploaded files is kept in S3 or elsewhere.]
We do not ask for, and do not keep, information about your customers. In particular:
- from an Argos (Mirakl) order export, Trestle keeps only a fixed list of non-personal columns; the customer's name, address, phone number, email address and other customer columns are never read;
- as a second safeguard, every stored row has known customer and address fields (such as names, addresses, postcodes, phone numbers and email addresses) removed before it is saved;
- the free-text "notes" column of the spreadsheet is never stored.
These safeguards look at column names, not at what is typed inside a cell, so please do not type personal information about your customers or staff into any column. Order numbers are kept because they stop the same order being counted twice.
From your data Trestle works out margins, fees, verdicts, sales forecasts and alerts. If you record a decision in the Decision Ledger, we keep it with the name of the person who recorded it.
[OWNER: a direct connection to Amazon (or another marketplace) is out of the MVP. If one is added later, this policy must be updated before it goes live to say what it reads. The app already has a "Connect Amazon" page that says "coming soon" and changes nothing.]
3.4 Security and technical information
To protect your account we keep a security record of events such as sign-ups, sign-ins, failed sign-ins, password and sign-in method changes, team changes, payments and store deletions. Each entry holds what happened, to whom, when, the outcome, the network (IP) address it came from and the browser label. It never holds passwords, codes, links or card details. We also count recent failed sign-ins from each network address so we can slow down guessing.
We use this record to keep accounts secure, for example to email you when someone signs in from a browser we have not seen before.
[OWNER: the app does not record which pages you visit. Once hosting exists, confirm what the hosting and network services log (for example web server access logs) and for how long, and add it here.]
Our website does not use analytics, advertising or tracking tools, and it serves its own fonts, so visiting it does not send your details to a font service.
3.5 Cookies
The website sets no cookies. The Trestle app sets only these:
| Cookie | What it does | How long |
|---|---|---|
trestle_session | Keeps you signed in | Until you sign out or the session ends (8 hours unused, 7 days at most) |
trestle_browser | A random identifier for your browser, so we can tell a new browser from one you have used before and warn you of a sign-in from a new one. It does not sign you in. | 400 days |
trestle_checkout_baseline | Remembers the state of your account while you are at Whop's checkout, so the right payment is confirmed when you come back | 30 minutes |
trestle_amazon_handover | Holds the values Amazon passes if you arrive from Amazon to connect an account (not in use yet) | 10 minutes |
We do not use advertising, analytics or tracking cookies. Whop's checkout pages are run by Whop and may set their own cookies under Whop's policy.
[SOLICITOR: confirm that all four are "strictly necessary" under PECR, in particular the 400-day trestle_browser cookie, so that no consent banner is needed.]
3.6 News emails
The website has a box for news about new marketplaces and features, but it is switched off and collects nothing. [OWNER: before switching it on, choose the service that will collect the emails and add it here and to section 6, with the lawful basis for marketing emails.]
4. How we use information
We use the information above to:
- provide Trestle: work out margins, fees, marketplace expansion verdicts, sales forecasts and alerts for your products;
- set up and manage your account and your team, and keep your sign-in secure;
- take payment through Whop and give or end access according to what you have paid for;
- send you the emails the service needs (see below);
- keep the service secure, detect misuse and investigate incidents;
- answer your questions and provide support;
- meet our legal obligations.
Emails we send. Trestle sends emails only about your account and the service: confirming your email address, sign-in codes, password resets, security alerts (a new browser, a locked account, a changed password or sign-in method, recovery codes used or replaced), team invitations and changes, email address changes, payment received and subscription changes, notice that paid access is ending or has ended, notice that a store's data will be deleted and when it has been, and notice that an account that never paid will be removed. Alerts about your products appear inside the app; they are not emailed. We do not send marketing emails. Whop sends its own receipts.
Your business data is used only to provide Trestle to the seller it belongs to. We do not sell it and we do not use it for advertising. We do not combine one seller's data with another's, we do not use it to train or improve models for other sellers, and we do not disclose it to other sellers, whether individually or in aggregate. Each seller's sales forecast uses only that seller's own data and general assumptions that we set.
5. Our legal bases
[SOLICITOR: review this table. It is the owner's original draft with the analytics row removed (no analytics is used) and the billing row narrowed (Whop, not Trestle, issues receipts and invoices).]
Where the information is personal data, we rely on the following legal bases under the UK General Data Protection Regulation:
| Purpose | Legal basis |
|---|---|
| Providing the service, managing your account and team, service emails | Performance of our contract with you |
| Security, fraud prevention, the security record, improving the service | Our legitimate interests in running a secure and reliable service |
| Keeping records of payments for our accounts | Legal obligation |
| [Marketing emails, if the news box is switched on] | [Your consent, which you can withdraw at any time] |
6. Who we share information with
We share information only with suppliers that help us run the service:
| Supplier | What they do | Where |
|---|---|---|
| Hostinger | Hosting the website and the Trestle app, including its database and backups | [OWNER: the server's data centre once bought; the UK if offered (D-213)] |
| Amazon Web Services | Sending the service's emails (Amazon Simple Email Service) | EU, Stockholm region (eu-north-1) |
| Whop | Payments, receipts, VAT and refunds, as merchant of record | [LOCATION] |
| [OTHER, or delete row] |
[OWNER and SOLICITOR: the original draft said each supplier is bound by a written contract to protect the information and use it only on our instructions. Keep that statement only once a data processing agreement is in place with each supplier. Whop acts as merchant of record and may be a controller in its own right for payment data; the wording should reflect that.]
Within your Trestle account, the people you add to your team can see the account's data.
We may also disclose information if the law requires it, to our professional advisers, or to a buyer of our business, in which case this policy would continue to apply to it.
We do not sell personal data or business data to anyone.
7. International transfers
We plan to store data on a Hostinger server in the UK. [OWNER: confirm the data centre once the server is bought (D-213).] The service's emails are sent through Amazon Simple Email Service in the EU (Stockholm), which UK adequacy regulations cover. If a supplier processes personal data outside the UK, we will make sure a lawful safeguard is in place, such as UK adequacy regulations or the UK International Data Transfer Agreement. [SOLICITOR: confirm where Whop processes data and which safeguard applies.]
8. How we protect information
Built into Trestle today:
- signing in needs your password and a second step (a passkey, a code we email you or an authenticator app);
- passwords are stored only as Argon2id hashes; recovery codes, emailed codes and links are stored only as hashes and expire; the authenticator secret is stored encrypted;
- after 5 wrong attempts sign-in is locked for 15 minutes, and repeated attempts from one network address are slowed down;
- sensitive actions, such as deleting a store or changing your email address, need a fresh check with a passkey, authenticator app or recovery code;
- sessions end after 8 hours without use and after 7 days at most, and you can end any session from the Security page;
- each seller account's data is kept apart, and every request is checked against the account it belongs to;
- we email you about a sign-in from a new browser and about changes to your password or sign-in methods.
[OWNER: keep each of the following only once it is true; each depends on hosting or on a policy being adopted. None is evidenced in the project yet.]
- [Data is encrypted in transit using TLS 1.2 or higher, and database backups are encrypted before they leave the server.] [OWNER: do not claim encryption at rest (for example AES-256) for the server's disk unless Hostinger confirms it for the plan bought (D-213).]
- [Access by our staff is limited to those who need it, requires multi-factor authentication, and is reviewed at least every three months.]
- [We keep a written incident response plan. If a security incident affects your data we will tell you without undue delay, and we will notify the Information Commissioner's Office and any marketplace whose rules require it.] [SOLICITOR: confirm the notification wording.]
The original draft's statement that marketplace access credentials are encrypted and rotated has been removed: Trestle holds no marketplace credentials.
No system is perfectly secure. If you believe your account has been compromised, contact info@trestleinsight.com straight away.
9. How long we keep information
| Information | How long we keep it |
|---|---|
| A store's data: the figures from your uploads and everything worked out from them | While the store exists. It is deleted 14 days after an owner confirms the deletion in Trestle, or 14 days after your account's paid access ends (when an audit's 30 days run out, or a subscription ends). Owners are emailed when the 14 days start and again 3 days before. An owner can stop the deletion within the 14 days; if it started because paid access ended, you need to pay again first. After deletion we keep only a short record that the store existed and was deleted (its name, who asked and when). [OWNER: decide how long that record is kept; at present it is kept indefinitely.] |
| An account that never paid | Removed, with its stores and its people (unless they belong to another account), 30 days after sign-up. Owners are emailed 7 days before. |
| Your account information (section 3.1) after paid access ends | [OWNER: not decided and not built. At present it is kept until removed on request. The original draft said "up to [12] months"; decide a period and have it built before publishing one.] |
| Sessions and used codes and links | [OWNER: kept with the account at present; only used or expired passkey challenges are removed automatically. Decide whether a shorter period is wanted.] |
| Payment records we hold (section 3.2) | [OWNER and accountant: kept with the account at present. Decide a period, for example [6] years for tax, and have it built.] Whop keeps its own records under its own terms. |
| Security record (section 3.4) | 12 months, then removed automatically. It is kept for that time even after an account is removed. |
[OWNER: backups. The plan (onboarding spec ruling D-1) is a rolling backup kept for 14 days, so every copy of deleted data is gone within 28 days of the event that started deletion, and a restored backup has every completed deletion applied again before use (ruling D-2). Nothing is hosted yet, so no backup exists. Publish this only once it is configured: "Backups are kept for no more than 14 days, so every copy is gone within 28 days of the event that started deletion."]
10. How to delete your data
- A store: an owner can delete a store and all its data from its settings in Trestle, by typing the store's name and confirming with a passkey, authenticator app or recovery code. The data is deleted 14 days later, and the deletion can be stopped until then. We email the account's owners when the deletion is started and when it is done.
- When paid access ends: every store's data is deleted 14 days later, as described in section 9.
- A person in a team: an owner can remove a person from the account. [OWNER: the person's own sign-in details stay on file after removal; decide whether they should be deleted.]
- Your whole account: email info@trestleinsight.com and we will delete your account and the data in it, and confirm in writing when it is done. [OWNER: there is no button or tool for this yet; it would be a manual task. Build one or set a written procedure before launch.]
11. Your rights
If we hold personal data about you, you have the right to:
- ask for a copy of it;
- ask us to correct it (you can change your name and email address yourself in "Your profile");
- ask us to delete it;
- ask us to restrict or stop using it;
- object to our use of it;
- receive it in a portable format;
- withdraw consent where we rely on consent.
To use any of these rights, email info@trestleinsight.com. We will respond within one month. There is no charge. [OWNER: there is no export tool in the app, so copies and portable data would be prepared by hand.]
You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.
12. Changes to this policy
We may update this policy. If a change is significant, we will tell account holders by email before it takes effect. The date at the top shows when it was last updated. [OWNER: the app records which version of this policy each person accepted at sign-up; set that version to the publication date when this is published.]
13. Contact
[COMPANY LEGAL NAME] [REGISTERED ADDRESS] Email: info@trestleinsight.com