Legal
This policy explains what personal data Trimora collects, why, how long we keep it, and what your rights are. We have written it in plain language on purpose. If anything is unclear, contact us.
Trimora is a financial awareness tool for small and medium-sized businesses. It analyses your uploaded bank statements and email inbox to identify unnecessary costs, unused subscriptions, and wasteful spending — and tells you exactly what to do about it.
The data controller responsible for your personal data is:
If you join our waitlist at trimora.ai, we collect your email address. We use it solely to notify you when Trimora launches. We do not send marketing emails. We do not share this with third parties.
When you create a Trimora account, we collect your name, email address, and company name. We use this to operate your account, send you product notifications, and provide support.
With your explicit action, you upload your business bank statement (PDF or CSV) to Trimora. We never request access to your online banking or require your bank credentials.
Important: We operate a strict two-layer data model. Raw transaction data (merchant name, amount, date, reference number) is processed in memory and deleted within minutes of the scan completing. We never store raw bank transactions permanently. What we do store is the derived output — for example: "Notion — €16/month — detected 3rd March — next renewal 3rd April." This is your product data, not your financial data.
With your explicit consent, Trimora connects to your business email inbox (Gmail or Outlook) to detect subscription renewals, invoices, and vendor communications. We scan email metadata and relevant content to identify financial patterns. We do not read, store, or index personal correspondence.
Payments are processed by Stripe. Trimora never sees, stores, or processes your card details. Stripe is an independent data controller for payment data. Their privacy policy is available at stripe.com/privacy.
All personal data is stored in the European Union — specifically on Supabase infrastructure in Frankfurt, Germany. Data does not leave EU servers.
Uploaded statement data and any derived findings are encrypted at the application layer using AES-256 before being written to the database. Even in the event of a database breach, data is not readable without the encryption key.
Row-level security is enforced in our database — your data is never accessible to other Trimora users.
We do not sell your data. We do not share your data with advertisers. We share data only with the following sub-processors, who are contractually required to protect it:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| Vercel | Application hosting | EU (Frankfurt, fra1) + SCCs for edge functions |
| Resend | Transactional email delivery | US (SCCs in place) |
| Stripe | Payment processing | US (independent controller) |
| Cloudflare | DNS, CDN, and waitlist storage | EU/US (SCCs in place) |
For Vercel, Resend, and Cloudflare, data transfers outside the EU are covered by Standard Contractual Clauses (SCCs) as required under GDPR Chapter V.
Trimora does not use cookies, tracking pixels, analytics scripts, or any third-party tracking technology on the trimora.ai landing page. No consent banner is shown because none is required — there is nothing to consent to.
The Trimora application uses one type of cookie only: a strictly necessary session cookie to keep you logged in. This cookie:
We do not use Google Analytics, Facebook Pixel, HotJar, Intercom, or any other third-party tracking or analytics service.
As a data subject under GDPR, you have the following rights:
To exercise any of these rights, contact us. We will respond within 30 days. There is no fee.
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.
We take the following technical and organisational measures to protect your data:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.
Trimora is a business tool. It is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it immediately.
We may update this policy as the product evolves. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page.
For any privacy-related questions, requests, or concerns, please use our contact page or write to us at:
We aim to respond to all privacy requests within 5 business days.