Privacy Policy
As of November 2, 2026.
Who we are and what Truvon is
Truvon is a directory of businesses built for AI agents: assistants such as Claude or ChatGPT search it to find a business, check its facts, and act for a person, such as booking or ordering. This policy covers truvon.ai, its API and its MCP connector.
Most of what Truvon holds is about businesses, not people. We collect very little about the people whose agents use Truvon, and searching needs no account, name, or email.
Information about businesses
We build each business's record from public sources and show every fact with where it came from and when we saw it.
- Public websites: our crawler reads a business's own pages (home, menu, services, pricing, hours, contact), obeys robots.txt and identifies itself.
- Open datasets: places data from the Overture Maps Foundation (names, addresses, phones, categories, and websites of businesses, combined from datasets such as Foursquare OS Places) and Web Data Commons (business details that websites publish as structured data, extracted from the Common Crawl web archive). Sources and licenses: truvon.ai/open-data.
- Platforms' listing feeds: booking and ordering platforms may send us the public details of the businesses that use them.
- Business owners: what an owner adds or corrects after claiming the listing.
- Agent reports: outcomes and answers reported by agents that used the listing (see the next section).
This can include names and work contact details of people who run a business, such as a sole proprietor's name or a business phone. We list only what the business itself or a public record publishes, and an owner can correct or remove a listing (see Choices and rights).
When a business is one person, its listing can show that person's name and business phone. Anyone listed can see, correct, or remove what we hold about them (see Choices and rights).
Information from AI agents and the people they act for
When an agent uses Truvon, we keep what it asked and what happened, so results get better. We do not learn who the person is unless they choose to verify.
| What | Examples | Why |
|---|---|---|
| Searches | the need as written ("plumber who can come today"), the area searched, the results shown, and why | to answer, and to improve ranking |
| Choices and outcomes | which result the agent opened; booked, ordered, called, failed, and the reason | to keep each business's track record |
| Follow-up answers | did it happen, was it as described, satisfaction 1 to 5 | to keep each business's track record |
| Answers and flags | what a business told the agent; a result flagged as the wrong kind of business | to correct the record |
| Technical data | user agent, request signatures, and the IP address, which we keep only as a salted one-way hash for about two days to enforce daily limits | to identify which AI platform is calling and to stop abuse |
| Connector installs | an install identifier created when someone clicks Allow; no name or email | to tell one person's reports from another's |
Phone verification (planned). To make a report count as one real person's, the agent may ask for a phone number. We text a code; the person gives the code to their agent; we return a sign-in token that the agent keeps. We use the number only to send that code. We store a keyed one-way hash of it, never the number itself, so we cannot read it back or contact the person. Virtual and throwaway numbers may be refused. Verifying is never required to search or act.
Text messages. We text only the code a person or business asked for, plus help and opt-out replies. Message and data rates may apply. Reply STOP to stop or HELP for help. We do not share mobile numbers or text-message consent with anyone for their marketing, and our texting provider (Sinch) uses them only to deliver our messages.
People should not put sensitive details in a search (health, finances, identity numbers). Searches are stored with the need as written, the requirements, the town and state or ZIP, and the identity of the agent or connector install that asked, never an IP address. We do not keep precise locations: a street address is reduced to its town before the search is stored, and exact coordinates, when an agent sends them, are kept only in the short-lived record that serves later pages of results (about two days).
Business owners
Owners who claim a listing give us what we need to confirm they run the business and to bill them.
- Claiming: a contact at the business (a phone or email the business publishes) to send a confirmation code, who confirmed and when, and that the owner accepted the owner terms. What an owner confirms or adds is published on the listing for anyone and any AI agent to read; it stays the owner's.
- The plan: payments go through Stripe. We receive the plan, status, and the last four digits of the card; Stripe holds the card itself.
- Statistics: owners see how agents found and used their listing. These figures are about the business, never about named people.
- Opt-out: an owner can ask us to correct a listing or stop listing the business (see Choices and rights).
Website visitors and invited readers
- The public site: no advertising or cross-site tracking cookies. Our hosting provider's request logs (which can include IP addresses) are used only for security and debugging.
- Invited readers (the deck, timeline, and statistics): access uses a passkey on your device and an invitation tied to your phone number, stored as a keyed hash. We record when invited pages are opened.
- Site analytics, without cookies: for each visit to the public pages we record the page, the referring site (its name only), any campaign tag in the link, a few clicks (such as copying the connector address), and a code made from your network and browser that changes every day. It lets us count a day's visitors; it cannot follow you from one day to the next or connect you to an assistant you connect. No cookie is set.
How we use information, and what we never do
We use information to answer searches, keep business records accurate, rank fairly, stop fraud and enforce our terms, bill owners, and improve Truvon.
We never:
- sell personal information or share it for cross-context behavioral advertising;
- build profiles of the people whose agents search;
- let a business pay for a higher place in results;
- text or call a verified phone number for any reason other than sending its code;
- use searches to target people with ads.
We may publish statistics about how agents use Truvon, only in aggregate, never about an identifiable person.
Sharing and service providers
Business records are public by design: any agent can read them. What we keep about people is shared only with providers that run Truvon for us, under contract, or when the law requires it.
| Provider | What it does |
|---|---|
| Cloudflare | hosting, storage, search, and AI models that read web pages |
| Stripe | owner payments |
| Sinch (planned) | sending verification codes |
AI platforms that call Truvon receive the answers to their own requests. If Truvon is sold or merged, records may pass to the new owner under this policy.
Retention
Proposed periods, for counsel to confirm:
| Information | Kept for |
|---|---|
| Business records and their history | as long as the business is listed; history stays so changes can be checked |
| Searches | kept, including an archived copy, because they are what ranking learns from; never stored with an IP address |
| Outcomes and follow-up answers | as long as the business is listed (they form its track record) |
| IP addresses | only as salted one-way hashes, for about two days (daily limits) |
| Site analytics (pages, clicks, daily visitor codes) | 400 days |
| Phone hashes and sign-in tokens | until the person asks us to delete them; tokens expire after a year |
| Owner billing records | as long as tax law requires |
Choices and rights
Anyone can ask us to see, correct, or delete information about them, and we answer within 45 days. We do not charge for this or treat anyone worse for asking.
- People who verified a phone: ask to delete the hash and tokens; your past reports then stop counting as a verified person's.
- Business owners: correct any fact, or ask us to stop listing the business. Facts from public records may stay visible as public records with their source.
- California and other states with privacy laws: you have the rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information for advertising, so there is nothing to opt out of; we honor Global Privacy Control signals anyway.
- Outside the U.S.: Truvon lists U.S. businesses and is run from the U.S.
- Searches: a search carries no name, email, phone, or IP address, so we usually cannot find a person's searches, and we will tell you so rather than guess. If you connected Truvon to an assistant, we can delete that connection's history when you disconnect it and send us its details.
- How to ask: email support@truvon.ai or use the form at truvon.ai/privacy/request. Business owners confirm they run the business the same way they claim a listing: a code sent to a phone or email the business publishes.
Security, children, changes, and contact
- Security: data is encrypted in transit and at rest; admin access needs a passkey; phone numbers are hashed with a secret key.
- Children: Truvon is not meant for children under 13, and we do not knowingly collect their information.
- Changes: we post changes here with the date; a change that uses information in a new way gets notice before it applies.
- Contact: support@truvon.ai, or the form at truvon.ai/privacy/request.