Privacy Policy

TrustHelm (“we,” “us,” or “our”) operates the TrustHelm platform at trusthelm.ai. This policy explains what we collect and how we use and protect it. It also explains your privacy rights.

We handle sensitive estate planning documents. We take that seriously. This policy is written in plain language because we believe you should understand exactly what happens with your data.

What information we collect

Information you provide directly

Account information. When you create an account, we collect your email address and name. We record connections between your account and any professional or firm linked to your trust. This includes connections made through a professional's referral link.

Trust documents. We store uploaded trust agreements, amendments, wills, powers of attorney, and financial statements in encrypted private storage. We also store other documents you upload. These documents may contain sensitive information including Social Security numbers, financial account details, beneficiary names, asset descriptions, and legal provisions.

Trust data you enter manually. We store any trust details, assets, duties, financial records, or reminders you add manually.

Financial records. We store the income, expenses, distributions, and financial documents you add to your account. This includes records imported from bank statements and brokerage documents.

Payment information. When you subscribe to a paid TrustHelm plan, your payment is processed by Stripe. We do not store your credit card number, expiration date, or CVV on our servers. Stripe handles all payment data under their own PCI-DSS compliant security practices. We receive and store only your Stripe customer ID, subscription status, and billing history.

Communications. When you email us at support@trusthelm.ai or contact us through the site, we store that correspondence.

Information collected automatically

Usage data. We use PostHog to collect usage analytics about pages visited, features used, and session duration. This data helps us understand which features are valuable and where people get stuck.

Device and browser information. We collect your browser type, operating system, and screen size to ensure TrustHelm works correctly on your device.

IP address. We collect your IP address for security purposes, including rate limiting and fraud prevention. We use Upstash Redis for rate limiting on certain features.

Cookies. We use strictly necessary cookies for authentication and session management. We do not use advertising cookies, tracking cookies, or third-party marketing cookies. See the Cookies section below for details.

Information generated by our AI

AI-extracted data. Our AI extracts parties, roles, assets, duties, key provisions, and trust structure from documents you choose to scan. Extracted data is stored in your account. We map extracted duties to trust statutes across all 50 states and the District of Columbia.

AI financial extraction. Our AI extracts dates, amounts, categories, and descriptions from financial documents you import. This includes bank statements, brokerage documents, and tax forms. Extracted data is stored in your financial records.

How we use your information

We use your information for the following purposes and no others:

To provide the TrustHelm service. This includes storing your documents, running AI analysis, displaying your trust dashboard, tracking duties and reminders, maintaining financial records.

To process AI analysis. We send documents you choose to scan to Anthropic for AI analysis. Anthropic does not use these documents to train AI models. We may send individual page text to TypeSafe AI to identify which pages belong to your trust agreement. TypeSafe AI processes that text under a data processing agreement. Google Cloud Document AI reads scanned pages that lack a usable text layer.

To send you transactional emails. We use Postmark to send account-related emails (password resets, email code logins, subscription confirmations). We use Loops to send product-related behavioral emails (onboarding sequences, duty reminders, check-in notifications). You can unsubscribe from non-essential emails at any time.

To process payments. We use Stripe to handle subscription billing for paid TrustHelm plans.

To improve the product. We use usage analytics to understand how people use TrustHelm and to prioritize improvements. We do not send trust documents or financial records to product analytics.

To provide support. When you contact us, we use your information to respond to your questions and resolve issues.

To maintain security. We use IP addresses and access patterns to detect and prevent unauthorized access, abuse, and fraud.

How we protect your information

Encryption at rest. All data stored in our database and file storage is encrypted using AES-256 encryption at rest.

Encryption in transit. All data transmitted between your browser and our servers is encrypted using TLS 1.2 or better.

Private storage. Uploaded documents are stored in private storage buckets that are not publicly accessible. Authorized trust members and connected professionals can access documents according to their permissions.

Row-level security. Our database uses row-level security to restrict access to trust data. Access depends on trust membership, roles, and sharing permissions. Some firm services apply these access checks in application code.

Access controls. Trust data can be shared with authorized family members, advisors, and connected professionals or firms. Their access depends on the roles and permissions assigned to the trust.

Infrastructure. TrustHelm runs on Vercel (application hosting) and Supabase (database, authentication, and file storage). Supabase is SOC 2 Type II compliant. All infrastructure is hosted in the United States.

AI processing security. Documents sent to Anthropic for AI analysis are transmitted over encrypted connections. Anthropic does not use your documents for model training. Page text sent to TypeSafe AI for classification is also transmitted over encrypted connections.

How we share your information

We do not sell your personal information. We have never sold personal information and we will never sell personal information.

We do not share your data with advertisers. We do not display ads and we do not provide your information to advertising networks or data brokers.

We share information only in the following limited circumstances:

Service providers. We share data with the third-party services necessary to operate TrustHelm. These include:

• Anthropic: processes documents for AI analysis
• TypeSafe AI: classifies document page text, including names and addresses, under a data processing agreement
• Google Cloud (Document AI): OCR of scanned pages that lack a text layer, processed in the United States since October 2026
• Supabase: database, authentication, and file storage
• Vercel: application hosting
• Stripe: payment processing
• Postmark: transactional email delivery
• Twilio: SMS notifications
• Loops: receives email addresses, event names, and event properties
• PostHog: usage analytics, including analytics IDs, event names, properties, and sometimes page paths
• Upstash: rate limiting infrastructure
• Cloudflare: DNS, TLS, edge proxy, and storage of nightly document backups
• Sentry: error monitoring and diagnostics

People and professionals you give access to. You control who has access to each of your trusts and what they can see. When you invite someone, you choose their access level.

Co-trustees, successor trustees, and other authorized members can see trust contents according to their access level. This can include documents, assets, financial information, and duties.

Professionals connected to a trust receive view access by default. They can see documents, assets, financial information, and duties without changing them. An administrator can grant edit access when inviting a professional or later. You can change or revoke a professional's access through the trust's access settings.

Invited beneficiaries receive Restricted access by default. They can see the trust name, a summary without financial details, and the people involved and their roles. They also see their own role and notifications about recorded grantor death or succession. They cannot see funding, documents, finances, or the trust's Record.

You can change or revoke any person's access at any time from your sharing settings. We record a connection to the referring professional or firm when you sign up through their referral link. The access rules above apply to that connection.

Legal requirements. We may disclose information if required by law, subpoena, court order, or government request. If this happens, we will notify you unless legally prohibited from doing so.

With your consent. We may share information with your explicit consent for purposes not listed here. We will always ask first.

Data retention

Account data. We retain your account information, trust documents, and financial records while your account is active.

After account deletion. Email support@trusthelm.ai to request deletion of your account and data. Shared trust records and records required by law may remain. Automated deletion does not cover every storage location or provider copy.

Payment records. Stripe retains payment records according to their own retention policies and legal requirements.

Cookies

TrustHelm uses only strictly necessary cookies:

Authentication cookies. These maintain your login session so you do not have to sign in on every page. They expire when you log out or after your session times out.

We do not use analytics cookies, advertising cookies, social media cookies, or any third-party tracking cookies. PostHog analytics is configured without cookies.

Your privacy rights

Rights for all users

Regardless of where you live, you have the following rights:

Access your data. You can view the trust data your access level allows through the TrustHelm dashboard.

Export your data. You can export your data through the TrustHelm dashboard. Exports are free on every plan.

Delete your data. You can delete individual records or documents at any time. Email support@trusthelm.ai to request deletion of your account and data.

Correct your data. You can update information through the dashboard, subject to your access permissions.

Unsubscribe from emails. You can unsubscribe from non-essential emails at any time using the unsubscribe link in any email. Transactional emails (login links, security alerts) cannot be unsubscribed from while your account is active.

Additional rights for California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to know. You have the right to request the specific categories and pieces of personal information we have collected about you. You can exercise this right by emailing support@trusthelm.ai.

Right to delete. You have the right to request deletion of your personal information. Email support@trusthelm.ai to request deletion of your account and data.

Right to opt out of sale. We do not sell your personal information. There is nothing to opt out of.

Right to non-discrimination. We will not discriminate against you for exercising any of your CCPA rights.

Categories of personal information we collect: We collect identifiers such as your name, email address, and IP address. We collect financial details you enter and documents you upload. We collect usage analytics and data extracted by AI.

Categories of personal information we sell: None. We do not sell personal information.

Categories of personal information we share for business purposes: We share data with the providers listed above. They help us operate TrustHelm.

Additional rights for European residents (GDPR)

The General Data Protection Regulation (GDPR) provides additional rights for residents of the European Economic Area and the United Kingdom.

Legal basis for processing. We process data with your consent and when needed to provide the service. We also process data for security, fraud prevention, and service improvement. These uses rely on consent, contractual necessity, or legitimate interests.

Right to access. You can request a copy of all personal data we hold about you.

Right to rectification. You can request correction of inaccurate personal data.

Right to erasure. You can request deletion of your personal data, subject to any legal retention requirements.

Right to restrict processing. You can request that we limit how we use your data.

Right to data portability. You can request your data in a machine-readable format. Our CSV and PDF export features support this.

Right to object. You can object to our processing of your data based on legitimate interests.

Right to withdraw consent. To withdraw consent, email support@trusthelm.ai.

Data transfers. TrustHelm's infrastructure is hosted in the United States. By using TrustHelm, your data is transferred to and processed in the United States. We rely on our providers' data processing agreements and Standard Contractual Clauses for international transfers. These providers include Supabase, Vercel, Anthropic, TypeSafe AI, Google Cloud (Document AI), and Stripe.

To exercise any GDPR right, email support@trusthelm.ai.

Children's privacy

TrustHelm is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete that information promptly.

Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will email you and post a dashboard notice before the changes take effect. Your continued use of TrustHelm after changes become effective constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or your data, contact us:

Email: support@trusthelm.ai

TrustHelm
Birmingham, AL

This privacy policy is specific to the TrustHelm platform and its data practices. It is not legal advice.