Privacy notice for TrueScreen services and website
Version 1.1, last updated 4 October 2026.
1. Who processes your data
The controller is TrueScreen Srl, Via della Zecca 1, 40121 Bologna, Italy, VAT number IT03920081209 (“TrueScreen”, “we”, “us”).
For any question about this notice or to exercise your rights, write to customersupport@truescreen.app. For help with your account, write to customersupport@truescreen.app.
2. What this notice covers
This notice covers the personal data we process when you use TrueScreen services, whatever the channel:
- the TrueScreen apps for iOS, iPadOS, Android and macOS, including the apps TrueScreen builds under a partner’s brand;
- Portal (portal.truescreen.io);
- Forensic Browser;
- the browser extension;
- the APIs, SDKs and MCP server.
It also applies to anyone who visits the truescreen.io website, writes to us through its forms, uses support or TrueBot, and to people whose public information we collect for business contacts: the details are in section 15. From version 1.1 it replaces the previous website privacy policy. The website’s cookies are covered by the cookie policy (https://truescreen.io/cookie-policy/).
3. When we are controller and when we are processor
We are the controller for your account data, payments, support, service security, analysis of how the service is used, and promotional communications.
We are a processor when a company, organisation or professional (the “Customer”) uses TrueScreen to collect data about other people: for example someone filling in a guided form (TrueFlow), someone signing a document, participants in a certified meeting, or the Customer’s employees or counterparties. In these cases the Customer decides why and how the data is processed, and you should contact the Customer to exercise your rights. We assist the Customer, as provided in the data processing agreement (DPA) we have with them.
4. What data we process
| Category | Examples |
|---|---|
| Account data | First name, last name, email, language, account and Workspace identifiers, Workspace role, sign-in method (email, Google, Apple, Microsoft), phone number for two-factor authentication |
| Company and billing data | Company name, address, VAT number, tax code, billing details, purchase and Credit history. Full payment card details are processed by Stripe, Apple or Google, not by us |
| Content you capture | Photos, videos, audio, screen recordings, web pages and sessions, emails, documents, online meetings, and the data they contain, including data about other people |
| Capture context data | Precise device location, date and time, IP address, network information (for example Wi-Fi network name and mobile carrier), device and operating system information. With Forensic Browser: network traffic of the session, cookies and technical data of the pages visited, information about the IP address and the domains contacted |
| Electronic signature data | First name, last name, phone number for the OTP code, signature confirmation video, text of the terms accepted, technical data of the signing session |
| Analysis results | Results of AI-based analysis run on Content (for example detection of generated or manipulated content, summaries, data extraction) |
| Usage and diagnostic data | Interactions with the apps and Portal, screens viewed, features used, events, errors and crashes, performance, device and installation identifiers |
| Advertising identifiers | On Android, the device advertising identifier; information about the source of the installation and about campaigns |
| Communications | Support requests, reports, emails exchanged with us |
| Proof of acceptance | Version of the terms and of the consent choices, date, account |
Location data and Content are collected only when you start a capture and after you grant the permissions requested by your device.
We do not ask for health data, ethnic origin, opinions or other special categories of data. They may, however, appear in the Content you choose to capture: in that case we process them only to store and certify them.
5. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account and Workspaces, authenticating you, providing the service: capturing, certifying, storing and making Content verifiable, generating reports, running the features you request (analysis, signature, meetings, TrueFlow, APIs and MCP) | Performance of the contract (Art. 6(1)(b) GDPR) |
| Managing purchases, subscriptions, Credits, invoicing and payments | Performance of the contract and legal tax and accounting obligations (Art. 6(1)(b) and 6(1)(c)) |
| Answering support requests and reports | Performance of the contract (Art. 6(1)(b)) and our legitimate interest in handling requests (Art. 6(1)(f)) |
| Protecting the service, preventing fraud and unlawful use, checking the integrity of the device and of captures | Legitimate interest in the security of the service and the reliability of certifications (Art. 6(1)(f)) |
| Analysing how the apps and Portal are used, fixing errors, improving features | Legitimate interest in improving the service (Art. 6(1)(f)) |
| Measuring the effectiveness of our advertising campaigns and the source of installations | Legitimate interest in assessing our promotional activities (Art. 6(1)(f)) |
| Sending you emails about products and services similar to those you bought | Legitimate interest, as permitted by Article 130(4) of the Italian Privacy Code (Legislative Decree 196/2003); you can object at any time |
| Sending you newsletters, offers and promotional communications other than those in the previous row | Consent, optional and revocable at any time (Art. 6(1)(a)), except for the short series of contacts described in section 15 for people who write to us from our campaign pages |
| Complying with legal obligations and requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Protecting our rights in legal proceedings and managing corporate transactions (for example mergers or sales) | Legitimate interest (Art. 6(1)(f)) |
6. Do you have to give us your data?
Account data, billing data and Content are necessary to provide the service: without them we cannot register you or perform certifications. Capture context data, including location, is part of the certification: if you deny a permission, some captures will not be possible or the report will be less complete. Consent to promotional communications is optional, and refusing it has no effect on the service.
7. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The results of AI-based analysis support the people who consult them, who remain responsible for the decisions. Automated security checks may block a capture or flag an anomaly: you can always ask for human review by writing to customersupport@truescreen.app.
8. Who we share data with
We share data only with those we need to provide the service, acting as our processors bound by contract, or as independent controllers where the law or their role requires it.
| Recipient | What they do | Where they process data |
|---|---|---|
| Amazon Web Services | Infrastructure, databases, Content storage, email and SMS delivery, AI models | Germany and Ireland |
| Google (Firebase, Google Maps, Google Play) | Authentication, notifications, usage and error analytics, app integrity checks, maps and conversion of coordinates into addresses, Android purchases | EU and United States |
| Apple | Sign in with Apple, iOS purchases | United States and EU |
| Microsoft | Sign-in with a Microsoft account | EU and United States |
| Stripe | Web payments and subscriptions | Ireland and United States |
| PostHog | Usage analytics for the apps and Portal | EU |
| Customer.io | Emails, in-service messages and notifications | EU and United States |
| Sentry | Error logging | United States |
| Meta | Advertising campaign measurement and app events | United States and Ireland |
| Adjust | Attribution of Android app installations | EU and other countries |
| Recall.ai | Joining and recording certified online meetings | Germany (company based in the United States) |
| IPRoyal | Browsing from another country with Forensic Browser, when you enable it | Lithuania and other countries |
| IP address information services | Enriching the technical context of Forensic Browser captures | United States |
| AI-based analysis service providers | Analysing Content when you use the analysis features | EU and non-EU countries |
| Trust service providers | Timestamp and electronic seal for certifications | Italy |
| Lokalise | Updating app translations | EU |
| Slack | Internal notifications to our team about sign-ups, purchases and requests | United States |
| Pipedrive | Managing support requests and business relationships | EU |
We may also share data with:
- advisers, auditors and professional firms bound by confidentiality;
- public, judicial or police authorities, where the law requires it;
- in corporate transactions, potential buyers and their advisers, under confidentiality safeguards.
We do not sell your personal data. The up-to-date list of our processors is available in Annex 3 of the data processing agreement (https://truescreen.io/dpa/) or on request at customersupport@truescreen.app.
9. Transfers outside the European Union
Some recipients are located, or may access data, outside the European Economic Area, in particular in the United States. These transfers take place only with the safeguards required by the GDPR:
- an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for recipients certified under it;
- or standard contractual clauses approved by the European Commission, with the necessary supplementary measures.
You can ask for information about the safeguards in place and for a copy of the clauses by writing to customersupport@truescreen.app.
10. How long we keep data
| Data | Period |
|---|---|
| Account data | For as long as the account exists. On closure it is anonymised immediately |
| Content, certifications and reports | For as long as the account exists and up to 90 days after closure. After deletion we keep only the fingerprint, the timestamp and the minimal data of each certification, without the content, so that reports already downloaded remain verifiable |
| Billing and accounting data | 10 years, as required by law (Art. 2220 Italian Civil Code) |
| Support requests | 2 years after the request is closed |
| Usage and diagnostic data | 24 months |
| Technical and security logs | 12 months |
| Data for promotional communications | Until consent is withdrawn or you object, and in any case no longer than 24 months after the last contact |
| Proof of acceptance of terms and consents | 10 years after the contract ends |
| Data of accounts suspended for fraud or unlawful use | For as long as needed to protect our rights and cooperate with the authorities, until any proceedings are concluded |
Data may be kept longer where needed to comply with a legal obligation or an order from an authority, or to defend a legal claim.
11. Your rights
You can ask us at any time for:
- access to your data and a copy of it;
- rectification of inaccurate or incomplete data;
- erasure of your data, in the cases set out in Article 17 GDPR;
- restriction of processing;
- portability of the data you provided to us, in a structured, machine-readable format;
- withdrawal of consent, without affecting processing already carried out.
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. You can object at any time and without giving reasons to promotional communications, including through the unsubscribe link in every email.
To exercise your rights, write to customersupport@truescreen.app. We reply within one month, extendable by two months for complex requests, and may ask you to verify your identity. You can close your account at any time from the app or Portal settings.
If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live or work.
12. Other people’s data in your Content
If you capture Content showing other people, for purposes that are not purely personal, you are the controller of that processing: you must have a legal basis and inform the people concerned where the law requires it. The general terms of service set out specific obligations, for example for recording meetings.
13. Children
You must be at least 14 years old to register for TrueScreen services, the age from which, in Italy, people can consent on their own to information society services. Purchases by users under 18 require a parent’s authorisation. We do not knowingly collect data from children under 14: if you believe a child under 14 has registered, write to customersupport@truescreen.app and we will delete the account.
14. Security
We protect data with technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access control, logging of operations and integrity verification of certifications. Our information security management system is ISO/IEC 27001 certified.
15. Visitors to truescreen.io
This section covers the data we process when you visit truescreen.io, write to us through the website forms or use TrueBot, the website’s AI-based assistant.
| When | What data | Why and on what legal basis | How long |
|---|---|---|---|
| Contact forms, demo requests and advertising campaign pages | First name, last name, email, phone number if you provide it, industry, message. Also the page you write from, language, country and where your visit came from (source, campaign, ad click identifiers) | To answer your request (Art. 6(1)(b) GDPR). If you wrote to us from one of our campaign pages, to introduce our services through a short series of contacts, up to 4 emails and 3 phone calls over about 19 days, based on our legitimate interest (Art. 6(1)(f)): you can object at any time and the series stops. To understand which channels bring in requests, based on our legitimate interest (Art. 6(1)(f)) | 24 months from the last contact, unless a contract follows |
| Support requests (the “Support” window and the support page) | First name, last name, email, phone number if you provide it, product, message, page, technical browser data and IP address | To handle the request (Art. 6(1)(b) or, if you are not a customer, Art. 6(1)(f)) | 2 years from when the request is closed |
| TrueBot | The conversation text and any contact details you choose to write | To answer your questions and, if you ask, to put you in touch with us (Art. 6(1)(b) and 6(1)(f)) | 24 months from the last contact |
| Browsing the website | IP address, browser and pages requested, in the server’s technical logs | Security and operation of the website, based on our legitimate interest (Art. 6(1)(f)) | 12 months |
To route sales requests, an artificial intelligence system reads your message and we look up public information about you and the company you work for: the company website, the business register and your public professional profile (for example LinkedIn), in particular your role, company and industry. From this we derive a score showing how relevant the request is to our services (profiling), which helps us decide who answers and with what priority, based on our legitimate interest (Art. 6(1)(f)). You can object at any time (section 11). We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.
When you submit a form, we link your visit to the name, email and industry you entered in our PostHog analytics tool, to understand which pages and campaigns bring in requests, based on our legitimate interest (Art. 6(1)(f)). You can object at any time.
If you no longer want us to contact you, reply to any of our emails, tell us during a phone call or write to customersupport@truescreen.app.
You will find the full list of cookies and measurement tools, with their purposes and durations, in the cookie policy (https://truescreen.io/cookie-policy/).
| Recipient | What it does for the website | Where it processes data |
|---|---|---|
| Amazon Web Services | Website hosting | Germany |
| Pipedrive | Handling requests and business relationships | EU |
| Sending emails, Google Analytics, Google Ads, Tag Manager, TrueBot (Firebase), YouTube videos, Google Fonts | EU and United States | |
| Meta | Meta Pixel and campaign measurement | Ireland and United States |
| Insight Tag and campaign measurement | Ireland and United States | |
| PostHog | Website usage analytics | EU |
| Customer.io | On-site messages and communications | EU and United States |
| Apollo.io | Identifying companies that visit the website and, in the United States, individuals | United States |
| Slack | Internal notifications about incoming requests | United States |
| jsDelivr | Library that checks phone numbers in forms | EU and other countries |
| Artificial intelligence service providers | Routing requests and TrueBot answers | EU and non-EU countries |
For transfers outside the European Union, the safeguards described in section 9 apply.
16. Changes to this notice
We may update this notice when our processing or the law changes. We inform you of significant changes by email or within the service before they take effect. Previous versions are available on request at customersupport@truescreen.app.
