Privacy Policy

Trivo Lab ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Swedish data protection law.

The data controller is: Haven Media Development AB, 556823-7753, Parkallén 5, 183 41 Täby, Sweden. Contact: privacy@trivolab.com.

1. Data We Collect

We collect the following categories of personal data:

• Account data: company name, your name, work email address, and password (hashed).
• Billing data: invoice address, country, and VAT number. Payment card details are processed directly by Stripe and never stored by us.
• Usage data: team check-in responses (morale, quality, and flow ratings), comments you submit, and timestamps.
• Technical data: IP address, browser type, operating system, pages visited, and session identifiers collected automatically when you use our service.

2. Legal Basis for Processing

3. How We Use Your Data

• To create and manage your account and subscription.
• To provide team pulse check-ins and AI-generated insights to team managers.
• To send transactional emails (account creation, password reset, billing receipts).
• To detect and prevent fraud, abuse, and security incidents.
• To improve and develop our product using aggregated, anonymised analytics.
• To comply with our legal and regulatory obligations.

We do not sell your personal data to third parties.

4. Third-Party Processors

We share data only with trusted sub-processors under appropriate data processing agreements:

Transfers to the USA are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission.

5. Data Retention

• Account data: retained for the duration of your subscription and deleted within 90 days of account closure, unless a longer retention is required by law.
• Billing records: retained for 7 years to comply with Swedish accounting law.
• Check-in responses: retained for the duration of the subscription and deleted within 90 days of account closure.
• Technical/log data: retained for up to 12 months.

6. Cookies

We use cookies in the following categories:

• Strictly necessary: session cookies required for login and security. These are set without consent.
• Analytics (consent required): Google Analytics cookies to understand how visitors use our site. These are only set after you accept analytics cookies in our cookie banner.

You can withdraw your cookie consent at any time by clicking the cookie icon in the footer or clearing your browser cookies.

7. Your Rights

Under GDPR you have the following rights. To exercise any of them, contact us at privacy@trivolab.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) at www.imy.se.

8. Security

We apply technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS), hashed password storage, access controls, and application-level error monitoring. We will notify you and the relevant supervisory authority of any data breach without undue delay where required by law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect. The latest version is always available at trivolab.com/privacy-policy.