Privacy Policy

Last updated: July 27, 2026

1. Introduction

This policy explains how Itay Rose Ari, a sole proprietor operating from Yehuda Hanassi 13, 6920013, Israel ("trolbi", "we", "us"), collects and uses personal data when you use the trolbi application and website (the "Service"). It applies together with our Terms of Service.

We built trolbi to remember your work for you. That principle shapes this policy: your data is used to provide the Service to you — not for advertising, not for training AI models, and never sold.

We comply with the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA), each to the extent it applies to you.

2. Information We Collect

Information you provide:

• Account information — your email address; and if you sign in with Google, your name and profile photo as provided by Google.
• Your content — messages you send to the assistant, files you upload, and the knowledge, working methods, and work products the assistant keeps in your projects with your approval. This may include personal or sensitive information you choose to share (for example, business or financial details). You control what you put in.
• Support communications — emails you send us.

Information collected automatically:

• Usage and billing metering — a count of messages you send each month and the computing cost of serving them, used to operate your plan.
• Technical logs — IP address, browser type, and request logs generated by our hosting and infrastructure providers for security and reliability.
• Local storage — we use browser storage only for essential sign-in state and basic preferences (such as your last-opened project). We use no analytics, advertising, or tracking cookies.

Payment information is collected and processed by Lemon Squeezy, our merchant of record — we never see or store your card details.

3. How We Use Your Information

• To provide the Service: processing your messages and files through AI models, running code you ask for in isolated sandboxes, and storing your projects' knowledge.
• To operate your subscription: metering messages, enforcing plan allowances and abuse limits.
• To secure the Service: preventing fraud, abuse, and unauthorized access.
• To communicate with you about the Service (account, billing, material changes). We will not send marketing email without your consent.
• To comply with legal obligations.

Legal bases (GDPR): performance of our contract with you (Art. 6(1)(b)) for providing the Service and billing; legitimate interests (Art. 6(1)(f)) for security, abuse prevention, and service communications; legal obligation (Art. 6(1)(c)) where applicable; consent (Art. 6(1)(a)) for anything optional, which you may withdraw at any time.

AI processing. Your messages and relevant project content are sent to our AI-model provider to generate responses — this is the core function of the Service. Neither we nor our AI provider use your content to train AI models. Our provider (Anthropic) does not train on API customer content by default and retains API inputs and outputs only for limited-time abuse prevention.

4. How We Share Your Information

We share personal data only with the service providers ("sub-processors") needed to run trolbi:

We may also disclose data if required by law or valid legal process, in connection with a business transfer (you would be notified), or with your direction or consent.

We do not sell personal data and do not share it for advertising. Ever.

5. Data Retention

• Active accounts: your data is kept for as long as your account exists — persistence is the product.
• Deletion: when you delete a project or your account, the data is deleted immediately from our live systems, and any residual copies in backups are purged within 30 days.
• AI provider: inputs and outputs sent to Anthropic are retained by them only for limited-period trust-and-safety purposes under their API terms, then deleted.
• Payment records are retained by Lemon Squeezy as required by tax and accounting law.
• Technical logs are retained for short rolling periods by our infrastructure providers.

6. Your Rights

Wherever you live, we give you the same core rights, exercisable directly inside the Service:

• Access & portability — download everything trolbi knows about you as a file (account menu → download).
• Deletion — delete individual projects, or your entire account and all its data (account menu → delete).
• Correction — edit or ask the assistant to update anything it has remembered; contact us for account-level corrections.

Additional rights depending on your jurisdiction:

• Israel (PPL, incl. Amendment 13): rights to access, correct, and delete personal information held about you, and to complain to the Privacy Protection Authority.
• EU/UK (GDPR): rights to restrict or object to processing, withdraw consent, and lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA): rights to know, delete, correct, and non-discrimination. We do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of.

To exercise any right you cannot complete in-app, email support@trolbi.com. We respond within 30 days.

7. Security

Your data is encrypted in transit (TLS) and at rest (Google Cloud default encryption). All data access goes through authenticated server-side checks; direct client access to the database is disabled. Code the assistant runs executes in isolated, disposable virtual machines that cannot reach other users' data. No system is perfectly secure, but security is reviewed as part of every change we ship. If a breach materially affects your data, we will notify you and the relevant authority as required by law.

8. International Transfers

We are based in Israel; our providers process data primarily in the United States. Israel benefits from an EU adequacy decision. For transfers from the EU/UK to US providers, we rely on the providers' participation in the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, as applicable to each provider listed in Section 4.

9. Children

The Service is for adults. It is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Third-Party Links

The Service links to external communities and resources (e.g., WhatsApp, YouTube). Their privacy practices are their own; this policy does not cover them.

11. Changes to This Policy

We will update the "Last updated" date when this policy changes and notify you by email or in-app for material changes before they take effect.

12. Contact

Itay Rose Ari (trolbi) Yehuda Hanassi 13, 6920013, Israel support@trolbi.com

If you are in the EU/UK and believe we have not resolved your concern, you may contact your local data protection authority. In Israel, you may contact the Privacy Protection Authority (רשות הגנת הפרטיות).