Terms of service
Who we are and contract documents
The TrustInsider service is provided by NEURALWORD S.r.l., VAT number IT03570180244, REA MI 1927098, with registered office in Milano (Italy), hereinafter “TrustInsider” or “we”. Contacts: support@trustinsider.com for support, billing@trustinsider.com for invoices and payments, privacy@trustinsider.com for personal data, info@trustinsider.com for any other request.
The contract consists of these Terms, the Acceptable Use Policy, the Artificial Intelligence Policy, the Data Processing Agreement (when you entrust personal data to us) and the order or plan chosen with the price list in force at the time of purchase. In case of conflict the following prevail, in this order: the signed order for Enterprise contracts, the Data Processing Agreement for data protection, these Terms, the referenced policies. The Privacy Notice explains how we process personal data but is not a contractual document.
Definitions
- “Customer”: the business or professional who opens an account or subscribes to a plan.
- “Authorised Users”: the people the Customer invites into its workspace.
- “Workspace”: the reserved area where the Customer configures brands, competitors, questions, connections and actions.
- “Credits”: the units measuring the consumption of metered operations, such as measurements on AI assistants, analyses and new reports.
- “Third-party AI assistants”: artificial intelligence services operated by others, such as ChatGPT, Gemini, Copilot, Claude and Perplexity, which TrustInsider queries or observes but does not control.
- “Customer Content”: the data, texts, files and settings the Customer enters or connects, including data from its integrations.
- “Results”: the measurements, indices, reports, recommendations and drafts the service produces for the Customer.
A service for professionals
TrustInsider is reserved for businesses and professionals acting for purposes related to their trade or profession. By opening an account the Customer declares that it acts in this capacity and that the person registering it has authority to bind it. Consumer protection rules reserved for consumers do not apply; protections that the law makes mandatory remain unaffected.
Account, access and authorised users
The contract is concluded when the Customer completes registration and accepts these Terms; for paid plans, when payment is confirmed by the payment provider. The Customer provides true and up-to-date information, safeguards its means of access, enables two-step verification when we consider it necessary and notifies us immediately of any unauthorised use.
The Customer may invite Authorised Users within the limits of its plan and is responsible for their actions as for its own. A personal account may not be shared: each person uses their own credentials.
What the service does
TrustInsider measures how AI assistants and search engines present a brand, its products and its competitors, and helps the Customer understand and improve that presence. Depending on the plan, the service includes:
- measurements on third-party AI assistants, collected through their programming interfaces and by observing the answers they give to the public;
- reading the data the Customer connects, such as Google Analytics, Search Console, Bing Webmaster Tools and its content management system;
- monitoring of public mentions, news, reviews and conversations about the brand;
- recommendations, action plans, content drafts and, where the plan provides for it, publishing to connected destinations;
- the Ask assistant, reports, alerts and, for the Enterprise plan, APIs, an MCP server, SSO single sign-on and SCIM provisioning.
The features included in each plan are those described on the pricing page at the time of purchase. We may improve the service and add or replace features; we do not substantially reduce the essential features of a paid plan during a period already paid for.
Nature of measurements and third-party AI assistants
The answers of AI assistants change with the model, version, language, market, wording of the question and time. Every TrustInsider measurement is therefore an estimate on a declared sample, accompanied, where the method allows, by an interval and the collection date: it describes what was observed and does not guarantee what an assistant will answer to someone at another time.
Third-party AI assistants, search engines and connected platforms are operated by others. TrustInsider does not control their operation, availability, terms of use or content and does not guarantee that an action will produce a mention, citation, ranking, traffic or sales. Recommendations are operational guidance based on the data collected: decisions, and their legal and commercial review, remain with the Customer.
Features that use artificial intelligence models may produce inaccurate or incomplete text. The Customer reviews summaries, drafts and answers before using or publishing them. Results are not legal, tax or investment advice.
Plans, prices and payments
The “Starter” plan is free of charge, with the limits and credits shown on the pricing page. Paid plans are subscribed with monthly or annual billing; the Enterprise plan is concluded with a dedicated order. Prices are those of the price list in force at the time of purchase, stated excluding VAT, which is applied under the law of the Customer’s country: for Customers with a VAT number in another EU Member State the reverse charge applies where its conditions are met.
Payment is made in advance on the payment page hosted by our payment provider: full card details never pass through our systems. The plan is activated only when the provider confirms the payment. The invoice is issued in accordance with Italian law and is available in the reserved area.
Credits and usage
Each plan includes a number of credits for each month. Viewing Results already produced, configuring the workspace and downloading an existing report do not consume credits. Before each metered operation the service shows how many credits it requires, and the operation starts only with the Customer’s confirmation or under automations the Customer has enabled, within the limits it has set. There is no automatic overage: once credits run out, metered operations stop until the following month or the purchase of additional credits, if offered.
Credits included in a month do not carry over to the following month, have no monetary value, are not transferable and are not refundable. If an operation fails for a reason attributable to us, the credits consumed are restored.
Renewal, cancellation and price changes
Paid plans renew automatically at expiry for an equal period, charged to the same payment method. The Customer may cancel at any time from the reserved area: cancellation takes effect at the end of the period already paid, until which the service remains active, and the current period is not refunded. A change of plan, up or down, takes effect from the next renewal, without proration.
We may change prices with at least 30 days’ notice before renewal, given by email or in the reserved area. The new price applies from the next renewal; a Customer who does not accept it cancels before renewal at no cost. If a payment fails, we give notice and, if it is not settled within 14 days, we may suspend metered operations and then move the account back to the free plan.
Integrations and connected destinations
The Customer may connect third-party services such as Google Analytics, Search Console, Bing Webmaster Tools, its website or content management system and its social pages. The connection relies on an authorisation the Customer grants and may revoke at any time, from the reserved area or from the third-party service. We read only the data needed for the features the Customer uses. Use of third-party services remains subject to their terms, which the Customer undertakes to comply with.
Changes to external destinations, such as publishing content or updating a page, happen in manual mode on all plans, with explicit approval of each action on paid plans, and in automatic mode only on the Enterprise plan, within the rules, caps and destinations the Customer configures. Every action is logged and, where the destination allows it, can be undone. The Customer remains responsible for content it approves or that the rules it has set publish.
Acceptable use
The Customer uses the service in compliance with the law, these Terms and the Acceptable Use Policy. In particular it does not use it to create or spread misleading content, fake reviews or false information about competitors, to manipulate AI assistants with hidden or deceptive content, to monitor individuals in their private sphere, to circumvent technical or usage limits, or to extract data from the service in bulk. Monitoring brands and competitors on the basis of public information is a permitted use.
Customer Content, Results and aggregated data
Customer Content remains the Customer’s. The Customer grants us a non-exclusive licence, limited to the term of the contract, to store, process and transmit it to the providers listed in the Data Processing Agreement solely to provide the service. We do not use Customer Content to train artificial intelligence models, whether ours or third parties’.
The Customer may freely use the Results for its business, including by publishing them, citing TrustInsider as the source when reporting measurements and indices. AI assistant answers and third-party content included in the Results remain subject to the rights of their respective owners.
We may use measurements on AI assistants, which concern public information, and aggregated, anonymous statistics on use of the service to improve it and for the public Observatory. We never publish data identifying the Customer as our customer, nor data from its integrations, its confidential settings or its documents.
TrustInsider intellectual property
The platform, software, measurement methods, indices, texts, design and trademarks of TrustInsider belong to us or our licensors. For the term of the contract we grant the Customer a non-exclusive, non-transferable right to use the service. Copying, decompiling or reverse engineering the software, except where permitted by law, and using the service to develop a competing product are not allowed. Third-party trademarks mentioned in the service belong to their respective owners. Data from the public Observatory is released under the licence stated on its dedicated page.
Confidentiality
Each party treats as confidential the non-public information received from the other, uses it only to perform the contract and protects it with the same care it applies to its own, and in any case with reasonable care. The obligation lasts for the term of the contract and for 3 years after it ends and does not cover information that is already public, already known or that must be disclosed by law or by order of an authority.
Personal data protection
For account, payment and communication data TrustInsider is the controller, as explained in the Privacy Notice. For personal data contained in Customer Content, including integrations, the Customer is the controller and TrustInsider is the processor: the Data Processing Agreement, which forms part of this contract, applies. The Customer warrants that it has a legal basis for the data it entrusts to us and has informed the data subjects.
Availability, security and support
We make every reasonable effort to keep the service available and secure, with appropriate technical and organisational measures and encrypted backups. The service may be interrupted for maintenance, preferably announced, or for causes outside our control, such as failures of providers or third-party AI assistants. Guaranteed service levels and dedicated support apply only if provided for in an Enterprise order. Ordinary support is requested at support@trustinsider.com.
Suspension and closure of the account
We may suspend access in whole or in part, notifying the Customer where possible, in case of breach of these Terms or the Acceptable Use Policy, risk to the security of the service or of third parties, non-payment under art. 9 or a request from an authority. The suspension lasts as long as its cause. For serious or repeated breaches we may terminate the contract under article 1456 of the Italian Civil Code by written notice.
The Customer may export its data from the reserved area at any time. A request to close the account is processed within 30 days, during which access remains available; if the contract ends at our initiative, we provide the export on request for 30 days. We then delete or anonymise the data, except for what the law requires us to keep, such as accounting records.
Limitation of liability
To the extent permitted by law, TrustInsider is not liable for indirect or consequential damages, loss of profit, loss of opportunity, goodwill or data the Customer could have saved, nor for the behaviour, answers or outages of third-party AI assistants, search engines and connected platforms.
TrustInsider’s total liability for all claims relating to the contract is limited to the amount paid by the Customer in the 12 months preceding the event giving rise to it, or to 100 euros for those using only the free plan. The limits do not apply to damages caused by wilful misconduct or gross negligence, to personal injury or where the law does not allow liability to be limited.
Indemnity
The Customer indemnifies TrustInsider against third-party claims, penalties and reasonable costs, including legal fees, arising from Customer Content, from content it approves or publishes through the service or from use of the service contrary to the law or these Terms. TrustInsider informs the Customer of the claim without delay and cooperates in the defence.
Term, withdrawal and termination
The contract lasts as long as the account is open; paid plans last for the subscribed period and renew as set out in art. 9. The Customer may close the account at any time from the reserved area. TrustInsider may withdraw with at least 30 days’ notice; in that case it refunds the prepaid, unused part of the fee. The articles on confidentiality, intellectual property, liability, indemnity, governing law and venue survive termination.
Changes to the Terms
We may change these Terms for legal, technical or commercial reasons. Material changes are notified by email or in the reserved area at least 30 days before they take effect; a Customer who does not accept them may withdraw before that date at no cost and, for paid plans, with a refund of the prepaid, unused part. Changes required by law or favourable to the Customer may apply immediately. Each version remains available with its number and date.
Notices
Notices relating to the contract are given by email to the account address, in the reserved area or, for the Customer, to the addresses listed in art. 1. An email notice is deemed received on the business day following its sending, unless proven otherwise.
Governing law and jurisdiction
The contract is governed by Italian law, excluding the Vienna Convention on the International Sale of Goods. The Court of Milan has exclusive jurisdiction over any dispute relating to the contract, subject to mandatory provisions of law.
Final provisions
If a clause is found invalid, the others remain effective. Tolerating a breach is not a waiver. The Customer may not assign the contract without our written consent; we may assign it to a company of our group or to whoever acquires the service, with notice. The Terms are drafted in Italian and translated into English, French, German and Spanish: in case of discrepancy the Italian text prevails.
Specific approval of clauses
Pursuant to articles 1341 and 1342 of the Italian Civil Code, the Customer specifically approves, with a separate declaration at registration, the clauses of the following articles:
- Art. 6 — Nature of measurements and third-party AI assistants
- Art. 8 — Credits and usage
- Art. 9 — Renewal, cancellation and price changes
- Art. 17 — Suspension and closure of the account
- Art. 18 — Limitation of liability
- Art. 19 — Indemnity
- Art. 20 — Term, withdrawal and termination
- Art. 21 — Changes to the Terms
- Art. 23 — Governing law and jurisdiction
Privacy notice
At a glance
This is the short version. The detail of each point is in the sections that follow, and prevails over this summary.
- Who: the controller is NEURALWORD S.r.l. (TrustInsider), based in Milano. For any question about personal data: privacy@trustinsider.com.
- What: your account and service data, browsing data and, only if you accept, statistics and advertising cookies. Names of people may appear in the public sources we analyse for brands: we do not build profiles of them and we do not keep the authors of reviews, forums and social media posts.
- Why: to provide the service you requested (contract), to meet legal obligations, to protect the website and measure how brands are presented (legitimate interest) and, only with your consent, for statistics, advertising and commercial communications.
- Artificial intelligence: the judgements and measurements the service produces with AI concern brands and companies, not people, and have no legal effect on you.
- With whom: with the providers that help us deliver the service, listed by name below with their location and the safeguard applied. We do not sell personal data.
- Where: also outside the European Union, only with a GDPR safeguard (Data Privacy Framework, adequacy decision or standard contractual clauses).
- For how long: for the period stated next to each purpose; when it ends, the data are deleted or anonymised.
- Your rights: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, free of charge, with a reply within 30 days. You can always contact the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Data controller and contacts
The data controller is NEURALWORD S.r.l., VAT number IT03570180244, REA MI 1927098, with registered office in Milano (Italy). For any question about personal data and to exercise your rights, write to privacy@trustinsider.com.
We have not appointed a data protection officer (DPO) because none of the cases in which art. 37 GDPR makes it mandatory applies: we are not a public authority; our core activities concern brands and companies and do not consist of regular and systematic monitoring of individuals on a large scale, because we do not build profiles of people and do not keep the authors of public content; we do not process special categories of data or criminal-offence data on a large scale, and in fact we discard them. We have documented this assessment and review it whenever a processing operation changes. For any data protection matter, the point of contact is privacy@trustinsider.com.
Who this notice is for
This notice concerns website visitors, people who open an account and the users they invite, people who contact us, subscribers to our communications and any individuals mentioned in the public sources we analyse. When a Customer entrusts personal data to us to use the service, for example data from its integrations or subscribers to its newsletter, the Customer is the controller and we act as processor under the Data Processing Agreement: for that data, please contact the Customer.
What data we process
- Browsing data: IP address, browser, pages visited, date and time, kept in reduced or hashed form where the plain address is not needed.
- Account data: email, name, role, company, preferences, proof of consent and security settings.
- Payment and billing data: company name, VAT number, billing address, amounts and payment outcome; full card details remain with the payment provider.
- Content and use of the service: configured brands, competitors and questions, uploaded documents, requests to Ask, approved actions and operation logs.
- Data from integrations authorised by the Customer, such as aggregated Google Analytics and Search Console statistics, processed on the Customer’s behalf.
- Communications: the messages you send us and, with consent, your preferences for commercial communications.
- Data from public sources: names of individuals appearing, in connection with a brand, in articles, reviews, public discussions or AI assistant answers.
We do not request or seek special categories of data (art. 9 GDPR: health, ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data) or data relating to criminal convictions and offences (art. 10 GDPR). Review, forum and social media content that reveals them is discarded before it is stored; please do not include them in the documents you upload or the questions you ask.
Purposes, legal bases and retention
Where the basis is legitimate interest, we have carried out a balancing test and checked that your interests, rights and freedoms do not override it: data is limited to what is strictly necessary, kept for the period stated and you can object at any time. You can ask us for a summary of each balancing test by writing to privacy@trustinsider.com.
Providing account data is necessary to conclude and perform the contract, and billing data is also required by law: without it, we cannot activate the service. All consents are optional, do not affect the service and can be withdrawn whenever you wish.
Data collected from public sources
To measure how a brand is presented we analyse AI assistant answers, news, reviews and public discussions. Names of individuals may appear, for example a spokesperson, the author of a review or a quoted executive. We process them only insofar as they relate to the brand analysed, without building profiles of individuals, without assessing them and without using the data to contact them. You can request rectification or object to the processing at any time using the means described below.
For reviews, forums and social media we use only the official programming interfaces of the platforms or of licensed providers, in line with their terms of use; we do not read apps designed for people with automated programs. We do not keep the name, username or other identifiers of whoever wrote the content: we keep a short quotation with the link to the source, and the measurements we show to customers are aggregated. We discard content that reveals health, ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data, convictions or offences, and content concerning minors. Every item is deleted automatically within 90 days, or earlier if the platform requires it or the content is removed at the source. If your content appears in these analyses and you want us not to process it, choose “Objection to processing” on the “Rights and corrections” page and paste the link to the content: from the moment of your request we stop collecting it and hide it, without using it, while we examine the request; if the objection is upheld we delete what we held. Press articles are not stopped automatically: a person assesses them.
The sources are the answers AI assistants give to questions about the brand, search engine results, news archives and public content from reviews, forums, videos and social media, accessed through the providers listed in the “Recipients and providers” section. The categories of data are a person’s name and what the public text says about them in relation to the brand. Since we do not keep contact details of the people mentioned, informing them one by one would be impossible or would involve disproportionate effort: this is why we publish this notice and give you a simple way to object (art. 14(5)(b) GDPR).
Artificial intelligence and automated decisions
We use third-party artificial intelligence models to measure assistant answers, summarise sources, answer Ask queries and prepare drafts, as explained in the Artificial Intelligence Policy. We do not use your data or source content to train models.
The judgements, indices and summaries the service produces concern brands and companies, not people. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR). No judgement produced with AI decides whether to enter into a contract with you, on what terms, or whether to give you access to the service.
To protect sign-up and payments we apply automated security checks: the country you connect from, addresses blocked for abuse, disposable email addresses and the anti-bot check. If a check prevents you from proceeding, write to privacy@trustinsider.com: a person reviews the case and you can express your point of view.
The only profiling is optional: with consent to marketing cookies, Google Ads may show you our ads on other websites if you have visited us before (remarketing). Without that consent it does not happen.
Recipients and providers
Data is processed by our staff, authorised and instructed in writing (art. 29 GDPR and art. 2-quaterdecies of the Italian Privacy Code), by the providers that help us deliver the service and, where the law requires, disclosed to authorities. We do not sell personal data. Next to each purpose you will find the providers that receive its data; here is the full list, with the location and safeguard of each:
A processor handles data on our behalf, only on our instructions and under an agreement pursuant to art. 28 GDPR. An independent controller handles data for its own purposes and under its own privacy notice: this is the case for services you connect, such as Meta or your website, and for the AI assistants we query as anyone would. “Used only when the feature is activated” indicates a provider that receives data only if the feature that uses it is switched on.
Transfers outside the European Union
Some providers process data in the United States or other countries outside the European Union. Transfers take place only with a safeguard under chapter V GDPR, shown for each provider in the “Safeguard” column: the provider’s certification under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795), another adequacy decision of the European Commission, or the standard contractual clauses approved by the Commission (decision (EU) 2021/914), with the necessary supplementary measures. A provider located in a country without these safeguards receives no personal data. You can request a copy of the safeguards at privacy@trustinsider.com.
Your rights
You have these rights and can exercise them free of charge (arts. 15-22 GDPR):
- Access (art. 15): knowing whether we process your data, which data, why and with whom, and receiving a copy.
- Rectification (art. 16): correcting inaccurate data and completing incomplete data.
- Erasure (art. 17): having data erased when it is no longer needed, when you withdraw consent or object, except data the law requires us to keep.
- Restriction (art. 18): suspending processing, for example while we verify a challenge you raised.
- Portability (art. 20): receiving the data you provided to us in a structured, commonly used and machine-readable format, and asking us to transmit it to another controller where technically feasible.
- Objection (art. 21): objecting to processing based on legitimate interest and, at any time, to commercial communications; the dedicated section explains how.
- Withdrawal of consent (art. 7(3)): at any time, without affecting processing already carried out.
- No solely automated decisions (art. 22): as explained in the section on artificial intelligence.
How: from the reserved area you can immediately download your data and request deletion of your account; for any other right, even without an account, use the form on the “Rights and corrections” page or write to privacy@trustinsider.com. If we have reasonable doubts about your identity, we may ask for the information needed to confirm it, for example to reply from the email address the data relates to (art. 12(6) GDPR).
Timing: we reply without undue delay and at the latest within 30 days of receipt (one month, art. 12(3) GDPR). If the request is complex or we receive many, the deadline may be extended by two further months: in that case we tell you within the first month, explaining why. If we do not act on the request, we explain why and how you can seek a remedy. We notify rectifications, erasures and restrictions to the recipients to whom we disclosed the data, unless this is impossible or involves disproportionate effort (art. 19 GDPR).
Complaint: if you believe the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it), or with the supervisory authority of the country where you live, work or where the alleged infringement took place (art. 77 GDPR), and you can go to court (art. 79 GDPR).
Your right to object
You can object at any time, on grounds relating to your particular situation, to the processing that has legitimate interest as its basis in the table of purposes, including the analysis of public sources. We stop processing your data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the data is needed to establish, exercise or defend legal claims (art. 21(1) GDPR).
You can always object, without giving a reason, to commercial communications: from that moment you no longer receive them (art. 21(2) and (3) GDPR).
To object, choose “Objection to processing” on the “Rights and corrections” page or write to privacy@trustinsider.com. If it concerns public content, paste the link and explain why: while we examine it the content is not collected, is hidden and is not used, but it is not deleted; if the objection is upheld we delete it, if it is rejected it returns as it was. Press articles are not stopped automatically: a person assesses them.
Consents and withdrawal
We ask for your consent only for what is not needed to provide the service: statistics cookies, marketing cookies and commercial communications. Each consent has its own box, separate and never pre-ticked, and we keep proof of it with the text version and the time.
Withdrawing is as easy as consenting: for cookies use “Manage cookies” on the Cookies page, linked at the bottom of every page; for commercial communications untick the box in the consents section of the reserved area; or write to privacy@trustinsider.com. Withdrawal takes effect immediately and does not affect processing already carried out.
The box with which, when opening the account, you confirm you have read this notice is not consent: it records that we have informed you. When the notice changes, at your next sign-in we show you the new version and ask you to confirm that you have read it.
Minors
The service is reserved for businesses and professionals: whoever opens an account declares they act for their own business. It is not intended for minors under 18 and we do not knowingly collect data concerning them; in public sources we discard content concerning minors. If you believe we process data of a minor, write to privacy@trustinsider.com: we will delete it.
Security
We protect data with measures appropriate to the risk (art. 32 GDPR): encrypted connections and security headers, sign-in by one-time link and two-step verification, encryption of integration credentials, request limits, hashed IP addresses where possible, a database in the European Union with encrypted backups, limited and logged staff access, and deletion when retention ends. In the event of a personal data breach we notify the Garante within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people, and, where the risk is high, we inform the people concerned without undue delay (arts. 33-34 GDPR). Every breach, even if not notified, is documented in our register.
Users in the United States and Canada
California (CCPA/CPRA): in the last 12 months we have collected the categories of data described above (identifiers, commercial information, internet activity, professional information) for the purposes stated. We do not sell personal information and do not share it for cross-context behavioural advertising without your consent to marketing cookies, which you can refuse or withdraw from the cookie banner. We honour your browser’s Global Privacy Control signal as a refusal of optional cookies. You have the right to know, access, correct and delete your data and not to be discriminated against for doing so; to exercise it, write to privacy@trustinsider.com.
Canada (PIPEDA): we collect, use and disclose personal information only for the purposes stated and with your consent where required by law. Information may be processed outside Canada by the providers listed and may be accessible to the authorities of those countries. You can request access and correction and withdraw consent by writing to our privacy contact at privacy@trustinsider.com; you may also contact the Office of the Privacy Commissioner of Canada.
Changes to this notice
We update this notice when our processing, our providers or the law change. Each version shows its date at the top of the page. When a change concerns account holders, at the next sign-in we show the new version and ask for confirmation that it has been read; if a change required new consent, we would not process data for the new purpose without obtaining it. Previous versions are available on request at privacy@trustinsider.com.
At a glance
This is the short version. The detail of each point is in the sections that follow, and prevails over this summary.
- Who: the controller is NEURALWORD S.r.l. (TrustInsider), based in Milano. For any question about personal data: privacy@trustinsider.com.
- What: your account and service data, browsing data and, only if you accept, statistics and advertising cookies. Names of people may appear in the public sources we analyse for brands: we do not build profiles of them and we do not keep the authors of reviews, forums and social media posts.
- Why: to provide the service you requested (contract), to meet legal obligations, to protect the website and measure how brands are presented (legitimate interest) and, only with your consent, for statistics, advertising and commercial communications.
- Artificial intelligence: the judgements and measurements the service produces with AI concern brands and companies, not people, and have no legal effect on you.
- With whom: with the providers that help us deliver the service, listed by name below with their location and the safeguard applied. We do not sell personal data.
- Where: also outside the European Union, only with a GDPR safeguard (Data Privacy Framework, adequacy decision or standard contractual clauses).
- For how long: for the period stated next to each purpose; when it ends, the data are deleted or anonymised.
- Your rights: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, free of charge, with a reply within 30 days. You can always contact the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Data controller and contacts
The data controller is NEURALWORD S.r.l., VAT number IT03570180244, REA MI 1927098, with registered office in Milano (Italy). For any question about personal data and to exercise your rights, write to privacy@trustinsider.com.
We have not appointed a data protection officer (DPO) because none of the cases in which art. 37 GDPR makes it mandatory applies: we are not a public authority; our core activities concern brands and companies and do not consist of regular and systematic monitoring of individuals on a large scale, because we do not build profiles of people and do not keep the authors of public content; we do not process special categories of data or criminal-offence data on a large scale, and in fact we discard them. We have documented this assessment and review it whenever a processing operation changes. For any data protection matter, the point of contact is privacy@trustinsider.com.
Who this notice is for
This notice concerns website visitors, people who open an account and the users they invite, people who contact us, subscribers to our communications and any individuals mentioned in the public sources we analyse. When a Customer entrusts personal data to us to use the service, for example data from its integrations or subscribers to its newsletter, the Customer is the controller and we act as processor under the Data Processing Agreement: for that data, please contact the Customer.
What data we process
- Browsing data: IP address, browser, pages visited, date and time, kept in reduced or hashed form where the plain address is not needed.
- Account data: email, name, role, company, preferences, proof of consent and security settings.
- Payment and billing data: company name, VAT number, billing address, amounts and payment outcome; full card details remain with the payment provider.
- Content and use of the service: configured brands, competitors and questions, uploaded documents, requests to Ask, approved actions and operation logs.
- Data from integrations authorised by the Customer, such as aggregated Google Analytics and Search Console statistics, processed on the Customer’s behalf.
- Communications: the messages you send us and, with consent, your preferences for commercial communications.
- Data from public sources: names of individuals appearing, in connection with a brand, in articles, reviews, public discussions or AI assistant answers.
We do not request or seek special categories of data (art. 9 GDPR: health, ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data) or data relating to criminal convictions and offences (art. 10 GDPR). Review, forum and social media content that reveals them is discarded before it is stored; please do not include them in the documents you upload or the questions you ask.
Purposes, legal bases and retention
Where the basis is legitimate interest, we have carried out a balancing test and checked that your interests, rights and freedoms do not override it: data is limited to what is strictly necessary, kept for the period stated and you can object at any time. You can ask us for a summary of each balancing test by writing to privacy@trustinsider.com.
Providing account data is necessary to conclude and perform the contract, and billing data is also required by law: without it, we cannot activate the service. All consents are optional, do not affect the service and can be withdrawn whenever you wish.
Data collected from public sources
To measure how a brand is presented we analyse AI assistant answers, news, reviews and public discussions. Names of individuals may appear, for example a spokesperson, the author of a review or a quoted executive. We process them only insofar as they relate to the brand analysed, without building profiles of individuals, without assessing them and without using the data to contact them. You can request rectification or object to the processing at any time using the means described below.
For reviews, forums and social media we use only the official programming interfaces of the platforms or of licensed providers, in line with their terms of use; we do not read apps designed for people with automated programs. We do not keep the name, username or other identifiers of whoever wrote the content: we keep a short quotation with the link to the source, and the measurements we show to customers are aggregated. We discard content that reveals health, ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data, convictions or offences, and content concerning minors. Every item is deleted automatically within 90 days, or earlier if the platform requires it or the content is removed at the source. If your content appears in these analyses and you want us not to process it, choose “Objection to processing” on the “Rights and corrections” page and paste the link to the content: from the moment of your request we stop collecting it and hide it, without using it, while we examine the request; if the objection is upheld we delete what we held. Press articles are not stopped automatically: a person assesses them.
The sources are the answers AI assistants give to questions about the brand, search engine results, news archives and public content from reviews, forums, videos and social media, accessed through the providers listed in the “Recipients and providers” section. The categories of data are a person’s name and what the public text says about them in relation to the brand. Since we do not keep contact details of the people mentioned, informing them one by one would be impossible or would involve disproportionate effort: this is why we publish this notice and give you a simple way to object (art. 14(5)(b) GDPR).
Artificial intelligence and automated decisions
We use third-party artificial intelligence models to measure assistant answers, summarise sources, answer Ask queries and prepare drafts, as explained in the Artificial Intelligence Policy. We do not use your data or source content to train models.
The judgements, indices and summaries the service produces concern brands and companies, not people. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR). No judgement produced with AI decides whether to enter into a contract with you, on what terms, or whether to give you access to the service.
To protect sign-up and payments we apply automated security checks: the country you connect from, addresses blocked for abuse, disposable email addresses and the anti-bot check. If a check prevents you from proceeding, write to privacy@trustinsider.com: a person reviews the case and you can express your point of view.
The only profiling is optional: with consent to marketing cookies, Google Ads may show you our ads on other websites if you have visited us before (remarketing). Without that consent it does not happen.
Recipients and providers
Data is processed by our staff, authorised and instructed in writing (art. 29 GDPR and art. 2-quaterdecies of the Italian Privacy Code), by the providers that help us deliver the service and, where the law requires, disclosed to authorities. We do not sell personal data. Next to each purpose you will find the providers that receive its data; here is the full list, with the location and safeguard of each:
A processor handles data on our behalf, only on our instructions and under an agreement pursuant to art. 28 GDPR. An independent controller handles data for its own purposes and under its own privacy notice: this is the case for services you connect, such as Meta or your website, and for the AI assistants we query as anyone would. “Used only when the feature is activated” indicates a provider that receives data only if the feature that uses it is switched on.
Transfers outside the European Union
Some providers process data in the United States or other countries outside the European Union. Transfers take place only with a safeguard under chapter V GDPR, shown for each provider in the “Safeguard” column: the provider’s certification under the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795), another adequacy decision of the European Commission, or the standard contractual clauses approved by the Commission (decision (EU) 2021/914), with the necessary supplementary measures. A provider located in a country without these safeguards receives no personal data. You can request a copy of the safeguards at privacy@trustinsider.com.
Your rights
You have these rights and can exercise them free of charge (arts. 15-22 GDPR):
- Access (art. 15): knowing whether we process your data, which data, why and with whom, and receiving a copy.
- Rectification (art. 16): correcting inaccurate data and completing incomplete data.
- Erasure (art. 17): having data erased when it is no longer needed, when you withdraw consent or object, except data the law requires us to keep.
- Restriction (art. 18): suspending processing, for example while we verify a challenge you raised.
- Portability (art. 20): receiving the data you provided to us in a structured, commonly used and machine-readable format, and asking us to transmit it to another controller where technically feasible.
- Objection (art. 21): objecting to processing based on legitimate interest and, at any time, to commercial communications; the dedicated section explains how.
- Withdrawal of consent (art. 7(3)): at any time, without affecting processing already carried out.
- No solely automated decisions (art. 22): as explained in the section on artificial intelligence.
How: from the reserved area you can immediately download your data and request deletion of your account; for any other right, even without an account, use the form on the “Rights and corrections” page or write to privacy@trustinsider.com. If we have reasonable doubts about your identity, we may ask for the information needed to confirm it, for example to reply from the email address the data relates to (art. 12(6) GDPR).
Timing: we reply without undue delay and at the latest within 30 days of receipt (one month, art. 12(3) GDPR). If the request is complex or we receive many, the deadline may be extended by two further months: in that case we tell you within the first month, explaining why. If we do not act on the request, we explain why and how you can seek a remedy. We notify rectifications, erasures and restrictions to the recipients to whom we disclosed the data, unless this is impossible or involves disproportionate effort (art. 19 GDPR).
Complaint: if you believe the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it), or with the supervisory authority of the country where you live, work or where the alleged infringement took place (art. 77 GDPR), and you can go to court (art. 79 GDPR).
Your right to object
You can object at any time, on grounds relating to your particular situation, to the processing that has legitimate interest as its basis in the table of purposes, including the analysis of public sources. We stop processing your data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the data is needed to establish, exercise or defend legal claims (art. 21(1) GDPR).
You can always object, without giving a reason, to commercial communications: from that moment you no longer receive them (art. 21(2) and (3) GDPR).
To object, choose “Objection to processing” on the “Rights and corrections” page or write to privacy@trustinsider.com. If it concerns public content, paste the link and explain why: while we examine it the content is not collected, is hidden and is not used, but it is not deleted; if the objection is upheld we delete it, if it is rejected it returns as it was. Press articles are not stopped automatically: a person assesses them.
Consents and withdrawal
We ask for your consent only for what is not needed to provide the service: statistics cookies, marketing cookies and commercial communications. Each consent has its own box, separate and never pre-ticked, and we keep proof of it with the text version and the time.
Withdrawing is as easy as consenting: for cookies use “Manage cookies” on the Cookies page, linked at the bottom of every page; for commercial communications untick the box in the consents section of the reserved area; or write to privacy@trustinsider.com. Withdrawal takes effect immediately and does not affect processing already carried out.
The box with which, when opening the account, you confirm you have read this notice is not consent: it records that we have informed you. When the notice changes, at your next sign-in we show you the new version and ask you to confirm that you have read it.
Minors
The service is reserved for businesses and professionals: whoever opens an account declares they act for their own business. It is not intended for minors under 18 and we do not knowingly collect data concerning them; in public sources we discard content concerning minors. If you believe we process data of a minor, write to privacy@trustinsider.com: we will delete it.
Security
We protect data with measures appropriate to the risk (art. 32 GDPR): encrypted connections and security headers, sign-in by one-time link and two-step verification, encryption of integration credentials, request limits, hashed IP addresses where possible, a database in the European Union with encrypted backups, limited and logged staff access, and deletion when retention ends. In the event of a personal data breach we notify the Garante within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people, and, where the risk is high, we inform the people concerned without undue delay (arts. 33-34 GDPR). Every breach, even if not notified, is documented in our register.
Users in the United States and Canada
California (CCPA/CPRA): in the last 12 months we have collected the categories of data described above (identifiers, commercial information, internet activity, professional information) for the purposes stated. We do not sell personal information and do not share it for cross-context behavioural advertising without your consent to marketing cookies, which you can refuse or withdraw from the cookie banner. We honour your browser’s Global Privacy Control signal as a refusal of optional cookies. You have the right to know, access, correct and delete your data and not to be discriminated against for doing so; to exercise it, write to privacy@trustinsider.com.
Canada (PIPEDA): we collect, use and disclose personal information only for the purposes stated and with your consent where required by law. Information may be processed outside Canada by the providers listed and may be accessible to the authorities of those countries. You can request access and correction and withdraw consent by writing to our privacy contact at privacy@trustinsider.com; you may also contact the Office of the Privacy Commissioner of Canada.
Changes to this notice
We update this notice when our processing, our providers or the law change. Each version shows its date at the top of the page. When a change concerns account holders, at the next sign-in we show the new version and ask for confirmation that it has been read; if a change required new consent, we would not process data for the new purpose without obtaining it. Previous versions are available on request at privacy@trustinsider.com.
Data processing (DPA)
Parties and scope
This agreement is entered into between the Customer, as controller, and NEURALWORD S.r.l., VAT number IT03570180244, as processor under art. 28 of Regulation (EU) 2016/679 (GDPR). It applies to personal data TrustInsider processes on the Customer’s behalf in providing the service and forms part of the Terms of service. Capitalised terms have the meaning given in the Terms and the GDPR.
Subject matter, duration, nature and purpose
TrustInsider processes the data for the term of the contract and for the time needed to return or delete it, solely to provide the features chosen by the Customer: reading integrations, monitoring, reports, Ask, managing hosted pages and newsletters, publishing to authorised destinations. The categories of data and data subjects are described in annex 1.
Customer instructions
TrustInsider processes the data only on the Customer’s documented instructions, consisting of this agreement, the Terms and the settings the Customer configures in the service, unless required by Union or Member State law; in that case it informs the Customer, where the law allows. If it considers that an instruction infringes data protection law, TrustInsider informs the Customer immediately. The Customer warrants the lawfulness of the data and of its instructions.
Confidentiality and staff
Persons authorised to process the data are bound by confidentiality and access only what their task requires. Staff access to Customer data is limited, logged and justified, for example for support requested by the Customer.
Security
TrustInsider applies the technical and organisational measures in annex 2, appropriate to the risk under art. 32 GDPR, and may update them provided the level of protection does not decrease.
Sub-processors
The Customer gives TrustInsider general authorisation to engage the sub-processors listed in annex 3. TrustInsider imposes on them, by contract, data protection obligations no less protective than those of this agreement and remains liable for their performance. Before adding or replacing a sub-processor, TrustInsider updates the list on this page and notifies Customers on a paid plan at least 30 days in advance; the Customer may object on reasonable data protection grounds and, if no solution is found, terminate without penalty with a refund of the prepaid, unused part.
International transfers
Data may be transferred outside the European Economic Area only to sub-processors covered by an adequacy decision, the EU-U.S. Data Privacy Framework or the standard contractual clauses of decision (EU) 2021/914, with any necessary supplementary measures. For transfers that require them, the parties agree that the standard contractual clauses, module 2 or module 3, apply and are deemed incorporated into this agreement.
Assistance to the Customer
Taking into account the nature of the processing, TrustInsider assists the Customer with appropriate measures to respond to data subject requests, forwarding without delay those received directly, and assists it with its obligations on security, breach notification, impact assessment and prior consultation (arts. 32-36 GDPR), with the information available to it.
Personal data breaches
TrustInsider notifies the Customer of any personal data breach affecting data processed on its behalf without undue delay and in any case within 48 hours of becoming aware of it, at the account email address, with the information under art. 33(3) GDPR available at that time, supplementing it as soon as possible, and immediately takes measures to contain it. The Customer may report incidents to privacy@trustinsider.com.
Return and deletion
During the contract the Customer can export its data from the reserved area. At the end of the contract TrustInsider deletes or anonymises the data processed on the Customer’s behalf within 30 days, unless Union or Member State law requires its retention; encrypted backups are overwritten according to their ordinary cycle.
Information and audits
TrustInsider makes available to the Customer the information necessary to demonstrate compliance with this agreement. The Customer may carry out, or have an independent auditor bound by confidentiality carry out, one audit per year with at least 30 days’ notice, without disrupting the service or accessing other customers’ data; audit costs are borne by the Customer unless a material breach is found. Audits requested by a supervisory authority are always possible.
Liability and precedence
The parties’ liability is governed by the Terms, within the limits permitted by art. 82 GDPR. On data protection matters this agreement prevails over the Terms; the standard contractual clauses, where applicable, prevail over both. A signed copy of the agreement is available to Enterprise Customers who request it at privacy@trustinsider.com.
Annex 1 — Description of the processing
- Data subjects: the Customer’s authorised users; visitors to the Customer’s website, in aggregate form, through analytics integrations; newsletter subscribers and people filling in forms on pages hosted for the Customer; individuals mentioned in content the Customer uploads or publishes.
- Categories of data: contact and account data, traffic and search statistics normally in aggregate form, content and documents, identifiers of connected accounts, operation logs. No special category of data is required: the Customer undertakes not to enter any.
- Operations: collection through authorised integrations, storage, analysis, processing with artificial intelligence models, generation of reports and drafts, publishing to authorised destinations, deletion.
Annex 2 — Technical and organisational measures
- Encryption in transit (HTTPS with HSTS) and encryption at rest of the database and backups; application-level encryption of integration credentials with keys kept only in the production environment.
- Access control: sign-in by one-time link, two-step verification, workspace roles, SSO and SCIM provisioning for the Enterprise plan; limited and logged administrative access.
- Data separation by workspace, minimisation of data sent to model providers and masking of confidential data in assistant logs.
- Perimeter protection: security headers, request limits, anti-bot protection, verified webhook signatures, secrets only in environment variables.
- Continuity: encrypted backups, point-in-time database recovery, monitoring of errors and service status.
- Limited retention with automatic deletion on expiry, a documented breach management procedure and periodic review of the measures.
Annex 3 — Sub-processors
The list is updated at every change. Providers indicated as independent controllers process data on their own account, under their own terms, when the Customer connects or uses their services.
