How TrustXP collects, uses, and protects your personal data.
Effective date: 24 August 2026
TrustXP ("we", "us", "our") operates the TrustXP platform at platform.trustxp.com and related services. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights under the General Data Protection Regulation (GDPR) and other applicable data protection laws.
For a detailed technical overview of our infrastructure and data handling, see our Trust, Security & Data Locations page.
The data controller for TrustXP is TrustXP, based in the Netherlands. You can contact us at privacy@trustxp.com.
When an organization signs up for TrustXP, we collect the administrator's name, work email address, and organization details (name, size, time zone). Authentication is handled by our identity provider, Clerk; we store a user identifier, name, and email but never passwords or authentication secrets.
Administrators upload a list of the people who will receive pulses. This typically includes name, work email address, team, role, and start date. We use this data solely to deliver pulse invitations and to associate people with the correct organization.
When someone responds to a pulse, we store the numerical score (1-5), an optional written comment, the trust dimension, and a timestamp. Responses are stored without any link to the individual who submitted them. See "Anonymity" below.
Our marketing website (trustxp.com) uses Google Analytics to collect anonymized usage data such as pages visited, referral source, and device type. We do not use this data to identify individual visitors. If you subscribe to the newsletter, your email address and any tags describing where you signed up are stored with the email provider until you unsubscribe. Every issue carries a one-click unsubscribe link.
If you contact us through our website, we collect your name, email address, and the content of your message, along with any optional fields you choose to fill in (organization name, team size).
We process personal data under the following legal bases as defined in GDPR Article 6(1):
Where we process data on behalf of your organization (as a data processor), the legal basis for that processing is determined by your organization as the data controller. Our Data Processing Addendum governs this relationship.
We use personal data to:
We do not sell personal data. We do not use personal data to build advertising profiles. We do not use customer data to train machine learning models.
Anonymity in TrustXP is structural, not a policy promise. Pulse responses are stored without any reference to the individual who submitted them. There is no technical path from a response to a named person in any part of the system accessible to your organization's administrators.
To deliver invitations, we necessarily track which invitation was sent to which person. This delivery mapping is kept in a separate, internal part of the database and is never exposed through any customer-facing screen, report, export, or API endpoint.
Scores and comments for a dimension are only displayed once enough people have contributed. Below that threshold, the dashboard shows nothing rather than risk de-anonymization.
We share personal data only with the subprocessors necessary to deliver the service:
Each subprocessor is bound by a data processing agreement. We will notify customers before adding a new subprocessor that handles personal data. A current list is maintained on our Trust, Security & Data Locations page.
All customer data is stored in the European Union (Netherlands). Some subprocessors (Clerk, Resend, Stripe) may process limited data outside the EU. Where personal data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses and the providers' data processing addenda.
We retain your data for the duration of your organization's account. After account termination, we retain data for a limited period as required for legal, tax, or accounting purposes. On request, we will delete your organization's data. Where data has been passed to a subprocessor (for example, billing records at Stripe), deletion follows that provider's retention rules and any applicable legal obligations.
We protect personal data with encryption in transit (TLS 1.2+) and at rest, tenant-isolated database queries, short-lived authenticated sessions, and verified webhook processing. For a complete description of our security controls, see our Trust, Security & Data Locations page.
Under the GDPR, you have the right to:
To exercise any of these rights, contact us at privacy@trustxp.com. We will respond within the timeframe required by applicable law (typically 30 days).
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Our marketing website uses Google Analytics cookies for anonymized usage statistics. The TrustXP platform uses only essential cookies required for authentication and session management. We do not use advertising or tracking cookies.
We may update this Privacy Policy from time to time. We will notify affected parties of material changes by email or through the platform. The effective date at the top of this page indicates when the policy was last revised.
For any questions about this Privacy Policy or our data practices, contact us at privacy@trustxp.com.