Privacy Policy

Straightforward: what we collect, why we collect it, who we share it with, and how you control it.

Last updated: 17 July 2026 · Data controller: TruthCast Ltd, London, UK

1. Who we are & how to reach us

TruthCast Ltd ("we", "us") is a UK company based in London and is the data controller for the personal data described in this policy.

For any privacy question, request, or complaint contact us at hello@truthcast.io. We aim to respond within 5 working days and no later than the 30 days required by UK DPA / GDPR.

2. Data we collect

Category	Examples	Source
Account	Email, name, hashed password, WhatsApp number (optional), country, primary language, creator type	You provide directly at signup / in Settings
Connected platforms	URLs of your Instagram, TikTok, X, Facebook, LinkedIn, YouTube, personal website	You paste them during onboarding
Public content about you	Post captions, follower counts, bio text, engagement metrics, news mentions	Retrieved by our scanners from public web sources
Reference photos	Face photos you upload for Identity Shield	You upload via device file picker
Payment	Stripe customer ID, subscription plan, invoice history	Stripe (we never see full card numbers)
Usage	Which features you use, when, from which IP, in which browser	Automatic on interaction with the app
Communications	Support emails, WhatsApp alerts you opt into, weekly briefs	You (support) / us (alerts & briefs)

3. Biometric data (special category)

When you use Identity Shield's face verification:

• Your reference photos are stored as raw bytes on our secure Postgres database in the EU/UK — never on third-party image hosts
• They are transmitted only to AWS Rekognition for face comparison. Rekognition performs the comparison and returns a similarity score; per AWS's terms, Rekognition does not retain the images after the comparison completes
• We use them exclusively to detect impostor accounts using your face — never for marketing, training our own models, or sharing with anyone else
• You can delete any reference photo any time from Settings → Identity Shield → Reference Photos. Deletion removes it from our database and prevents future comparisons

Legal basis for biometric processing: your explicit consent, given by uploading a reference photo and using the Identity Shield feature. You can withdraw consent at any time by deleting the photos and disabling the feature.

4. Why we collect it

Every piece of data has a purpose:

• Account & connected platforms — to log you in, associate scan results with you, and know what to monitor
• Public content about you — to compute your Trust Score, generate perception analysis, and detect impersonation
• Reference photos — to face-verify candidate impostor accounts
• Payment — to charge for paid tiers and manage subscriptions
• Usage — to detect abuse, size infrastructure, and improve the product
• Communications — to send you alerts you asked for (impostor detected, weekly brief) and answer support requests

We do not sell or rent your data to anyone. We don't train AI models on your data for use in other customers' products.

5. Legal bases we rely on

Under UK DPA / GDPR we rely on:

• Contract (Art 6(1)(b)) — to deliver the service you signed up for
• Legitimate interests (Art 6(1)(f)) — for usage analytics, security, and abuse detection, always balanced against your rights
• Consent (Art 6(1)(a) & Art 9(2)(a)) — for biometric data (face photos), optional WhatsApp alerts, and any marketing communications. Withdrawable any time
• Legal obligation (Art 6(1)(c)) — for accounting, tax, and lawful investigator requests

6. Who we share it with

We share data only with the vendors we need to operate TruthCast. Each processes data on our written instructions under a Data Processing Agreement.

7. Third-party sub-processors

Vendor	Purpose	Data shared	Region
Railway	App + database hosting	All account & scan data	US / EU
Vercel	Frontend hosting + CDN	Public assets, no personal data server-side	Global edge
Stripe	Payment processing	Email, name, card details, billing address	US / EU
AWS Rekognition	Face comparison	Reference photos + candidate images (transient, not retained)	us-east-1
Apify	Public content scraping	Your platform URLs (to know what to scrape)	EU
SerpAPI	Google Lens reverse image, Google Search, Google Autocomplete, YouTube transcripts	Reference photo URL, your name, search queries	US
Google Gemini API	AI perception + threat classification	Public content summaries, candidate metadata (no biometric data)	US / EU
Anthropic Claude API	AI perception narratives (paid tier)	Public content summaries only	US
Resend	Transactional email (verification, alerts, weekly briefs)	Your email, name, alert content	eu-west-1 (Ireland)
WhatsApp Business API	Real-time alerts (opt-in only)	Your WhatsApp number, alert content	Meta global
NewsData.io	News monitoring	Your name (query only)	EU

8. International transfers

Some sub-processors are based outside the UK/EEA (primarily US). Where we transfer personal data internationally we rely on:

• Adequacy decisions by the UK government where they exist (currently applies to the US via the UK-US Data Bridge)
• Standard Contractual Clauses (SCCs) with each vendor for other transfers
• Additional technical safeguards (encryption in transit + at rest)

9. How long we keep it

Data type	Retention
Active account data	Until you delete your account
Reference photos	Until you delete them individually or your account
Scan results & threats	Kept for the life of the account; deleted with account deletion
Payment records	7 years (UK HMRC requirement)
Server logs	90 days rolling
Backups	30 days rolling, encrypted

When you delete your account we remove your data from live systems within 24 hours and from backups within 30 days.

10. Your rights

Under UK DPA / GDPR you have the right to:

• Access — request a copy of everything we hold about you
• Rectification — correct anything that's wrong
• Erasure ("right to be forgotten") — delete your data. Use Settings → Delete Account, or email us
• Portability — receive your data in a machine-readable format (we provide JSON export)
• Restrict processing — pause certain uses of your data (e.g. stop weekly briefs)
• Object — to processing based on legitimate interests
• Withdraw consent — for anything we do based on consent (biometrics, WhatsApp alerts)
• Complain — to the UK Information Commissioner's Office (ico.org.uk) if you believe we've mishandled your data

To exercise any right, email hello@truthcast.io. We'll respond within 30 days and never charge for a legitimate request.

11. Security

We take security seriously because our product's value depends on it:

• All connections are HTTPS/TLS encrypted
• Passwords are hashed with bcrypt (never stored in plaintext)
• API access is authenticated with signed JWTs
• Database access is restricted to our application servers
• Reference photos are stored as bytes in Postgres, never on public URLs
• AWS access keys are stored only in Railway environment variables, never in source code
• We run automated dependency scans and patch known vulnerabilities within 7 days

If we discover a data breach affecting your data, we will notify you and the ICO within 72 hours as required by law.

12. Cookies & tracking

TruthCast uses only essential cookies and local storage — no analytics or advertising trackers:

• tc_token — your login session (JWT)
• tc_user — cached user profile for fast dashboard load
• tc_scan_data, tc_perception_data — cached scan results to avoid re-fetching
• tc_currency — your preferred display currency
• tc_ref_code, tc_pending_code — referral / founding code tracking

All of these are functional / strictly necessary — no consent banner is required under UK PECR because we don't use tracking cookies.

13. Children

TruthCast is not for children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email hello@truthcast.io and we'll delete it.

14. Changes to this policy

We'll update this policy as the product changes. Material changes (new sub-processors, new data categories, changed purposes) will be announced by email and a dashboard banner at least 14 days before taking effect.

The "Last updated" date at the top of this page always reflects the current version.