Privacy Policy
1. Who we are and scope
Lumetica, Inc. ("Lumetica," "we," "us"), a Delaware corporation, operates the website at trellsystems.com and any other domains we operate that direct to it (the "Site") and provides the Trell platform, the as-executed evidence layer for GMP (the "Platform" or "Trell"). This Privacy Policy explains how we handle personal information in connection with the Site and our marketing activities.
This policy does not govern data that our customers upload to or process within the Platform ("Customer Data"). We process Customer Data solely on our customers' behalf under the applicable customer agreement, and, for production data, a Data Processing Agreement (DPA). For questions about Customer Data, contact your organization's administrator.
2. Information we collect
Information you provide: when you contact us, request a demo, subscribe, or correspond with us, we collect your name, business email, company, role, and anything you include.
Information collected automatically: IP address, browser and device data, pages viewed, referring URLs, and timestamps, through cookies and similar technologies.
Information from third parties: limited professional information from platforms such as LinkedIn or business-data providers where you interact with us.
We do not intentionally collect sensitive or special-category personal information through the Site.
3. How we use information
- respond to inquiries and provide requested materials or demos;
- operate, secure, maintain, and improve the Site;
- send business communications and marketing where permitted, with an option to opt out;
- measure Site usage and the effectiveness of our content;
- comply with legal obligations and protect our rights.
4. Legal bases (EEA / UK visitors)
Where the GDPR or UK GDPR applies, we rely on your consent (marketing and non-essential cookies), our legitimate interests (operating and improving the Site, business-to-business outreach), and compliance with legal obligations. You may withdraw consent at any time.
5. Cookies and analytics
The Site uses strictly necessary cookies, which are required for it to function and are always active, and first-party cookies for basic, aggregate analytics. In jurisdictions that require consent, including the EEA and UK, we set non-essential cookies such as analytics only after you consent through our cookie banner, and you can change or withdraw that choice at any time through the banner or your browser settings. We honor recognized opt-out preference signals, including Global Privacy Control, where required by law. We do not use cookies for cross-context behavioral advertising.
6. How we share information
- Service providers and subprocessors supporting the Site and our operations, including cloud hosting (Amazon Web Services, United States) and email/marketing tools (Brevo), under confidentiality and data-protection terms;
- Professional advisors and authorities where required by law or to protect rights and safety;
- A successor entity in a merger, financing, or sale of assets.
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.
We do not use personal information collected through the Site to train or improve artificial-intelligence or machine-learning models. Any processing of Customer Data by the Platform is governed solely by the customer agreement and the applicable Data Processing Agreement. A Data Processing Agreement and security documentation are available to prospective and existing customers on request under a non-disclosure agreement.
7. Data retention
We retain personal information only as long as needed for the purposes above, to meet legal obligations, resolve disputes, and enforce agreements, then delete or de-identify it. As an indication for information handled through the Site: business-contact and marketing records are kept until you opt out and then for a short suppression period so we can honor your choice, typically up to 24 months after your last interaction; demo and inquiry correspondence for up to 24 months after the last exchange; and server and analytics logs for up to 13 months, in each case unless a longer period is required by law. These periods describe information handled through the Site and do not govern Customer Data, which is retained and deleted as set out in the customer agreement and, for production data, the applicable Data Processing Agreement.
8. Security
We maintain administrative, technical, and organizational measures designed to protect personal information, including United States cloud hosting, encryption in transit and at rest, role-based least-privilege access with multi-factor authentication for administrative access, logging and monitoring, and a formal security program. Our controls are assessed against a recognized security framework, and our security documentation is available to qualified customers and prospects under a non-disclosure agreement. To report a security concern or a suspected vulnerability affecting the Site, contact support@lumetica.io. While we work to protect your information using the measures above, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. International transfers
We are US-based and host data in the United States. If you access the Site from outside the US, your information will be transferred to and processed in the US. Where required, we use appropriate safeguards such as the EU Standard Contractual Clauses for EEA personal data and the UK International Data Transfer Agreement (or the UK Addendum to the EU SCCs) for UK personal data.
10. Your rights
Depending on your location, you may have rights to access, correct, delete, port, or restrict processing, and to object or withdraw consent.
- EEA / UK: rights under the GDPR / UK GDPR, including the right to complain to a supervisory authority.
- California (CCPA / CPRA): the right to know, delete, correct, and opt out of sale/sharing (we do neither), and to non-discrimination for exercising rights.
- Other US states: if you reside in a US state with a comprehensive consumer privacy law, including Virginia, Colorado, Connecticut, Utah, and Texas, and other states as those laws take effect, you may have the right to confirm whether we process your personal information, to access, correct, delete, and obtain a portable copy of it, and to opt out of targeted advertising, the sale of personal information, or certain profiling. We do not sell personal information and do not process it for targeted advertising or for profiling that produces legal or similarly significant effects.
To exercise a right, contact us at privacy@lumetica.io. We will verify and respond as required by law. If we decline your request, you may appeal by replying to our response or by emailing privacy@lumetica.io with the subject line "Privacy Appeal," and we will respond within the time required by applicable law. You may also have the right to contact your state attorney general.
11. Children
The Site is intended for business users and is not directed to children under 16. We do not knowingly collect personal information from children.
12. Third-party links
The Site may link to third-party sites we do not control; their practices are governed by their own policies.
13. Changes
We may update this policy. Material changes will be posted here with a new "Last Updated" date.
14. Contact
Lumetica, Inc.
145 Tremont Street, Suite 201, Boston, MA 02111
privacy@lumetica.io