Privacy Policy
Last updated: September 25, 2026
Trovia Technologies Inc. ("Trovia", "we", "us", "our") is a British Columbia company based in Vancouver, Canada. Trovia is a knowledge platform that grounds AI assistants in an organization's own validated knowledge. This policy explains what information we collect, how we use it, where it is stored, and our commitments about your content.
Our commitments
Your originals stay where they are. Trovia reads the source content you give it and builds a working copy and an index so it can answer questions and cite its sources. Your original files stay in your systems, unchanged. We do not become your system of record. If you stopped using Trovia tomorrow, your document estate would be exactly where it is today.
You own your content. Everything in your organization's knowledge domains belongs to your organization. We claim no rights to it.
Never shared, never trained on. Your content is never shared with other customers and is never used to train or fine-tune any AI model.
Encrypted in transit and at rest. Everything you upload or connect is encrypted in transit and at rest.
Isolated inference. AI processing runs on models inside Amazon Bedrock under the Trovia platform. The model providers receive no access to your prompts, content, or answers, and AWS does not retain them or use them to improve its own services. Trovia keeps short-lived operational logs of model requests and responses in its own encrypted, access-controlled storage in Canada, which only Trovia can read. We use these logs only to operate, debug, and secure the Service, and we delete them within 30 days.
Scoped by domain. Each knowledge domain is indexed and access-controlled separately. Retrieval is limited to the domain being queried, and nothing crosses between domains.
Who is responsible for what
Customer Content. For the content an organization puts into Trovia (files it uploads or connects, emails, voice memos, messages, questions and the answers Trovia generates), the organization controls that data. Trovia processes it only on the organization's behalf and under its instructions, acting as a service provider or processor. If you are an individual whose information appears in an organization's content, please contact that organization first; we will help them respond to you.
Account and service data. Trovia is responsible for the account, authentication and usage information described below.
Information we collect
- Account information: name, email address, phone number, organization and role.
- Authentication data: identifiers from Google, Microsoft or another sign-in provider you choose, and records of one-time passcodes we send.
- Customer Content: files and documents you upload or connect, emails you forward, voice memos and transcripts, chat messages, questions, AI-generated answers, and feedback.
- Derived data: text extracted from your content, embeddings, search indexes, structured tables and citation records created from Customer Content. Derived data is treated as Customer Content.
- Usage and technical data: log data, IP address, device and browser information, feature usage, and error and performance events.
- Billing information, where applicable: billing contact and invoice details. We do not store payment card numbers.
How we use information
Customer Content
We use Customer Content only to provide the service to your organization: to index it, retrieve it, generate answers, show citations, and perform the tasks your users ask for. We do not use Customer Content to train or fine-tune any model or to advertise.
Account, usage and technical data
- To authenticate users, secure accounts and deliver one-time passcodes by SMS or email at your request, and to send invitations and notifications.
- To operate, maintain, troubleshoot and improve the reliability and features of the platform.
- To provide support and communicate about your account, service changes and security.
- To bill for paid plans and meet legal obligations.
When we analyze usage to improve Trovia, we use operational metadata such as feature usage counts, latency and error rates, not the contents of your documents or conversations.
Where your data is stored
Trovia hosts Customer Content, derived data and account data in Canada, in the Amazon Web Services Canada (Central) region, unless your order form specifies a different region.
Amazon Bedrock may process some AI inference requests in another AWS region. AWS processes each request transiently and does not retain it. Trovia stores its own operational logs of these requests only in Canada, in the Amazon Web Services Canada (Central) region. Customers who need inference to stay within a specific country can contact us to discuss options.
Security
- Encryption in transit using TLS, and encryption at rest using keys managed through AWS Key Management Service.
- Isolation between organizations, and separate indexing and access control for each knowledge domain.
- Role-based access within your organization (for example admins, contributors, readers and guests).
- Least-privilege access for Trovia personnel. Our staff access Customer Content only to provide support you request, to investigate a security incident, or where required by law.
- If we become aware of a security incident affecting your data, we will notify your organization without undue delay.
No system is perfectly secure. Please protect your sign-in credentials.
Sharing
We do not sell or rent personal information, and we do not share it for advertising. We share information only with the service providers (subprocessors) that help us operate Trovia, only as needed to deliver the service, and under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, storage and AI inference (Amazon Bedrock); email for one-time passcodes, invitations and notifications (Amazon SES); SMS for one-time passcodes (AWS End User Messaging) |
| Sign-in, if you choose Google sign-in | |
| Microsoft | Sign-in, if you choose Microsoft sign-in |
The companies that build the AI models we use (for example Anthropic and Amazon) are not subprocessors of Customer Content: the models run inside Amazon Bedrock, and those companies receive no access to your prompts, content or answers. We keep our subprocessor list current and provide it on request.
We may also disclose information if the law requires it, such as a valid legal request, or where we reasonably believe disclosure is necessary to protect the rights, safety or security of our users, the public or Trovia, or to enforce our agreements. Where the law allows, we will notify the affected organization first. This does not change our commitments never to sell Customer Content, never to use it to train AI models, and never to share it with other customers.
Retention and deletion
- We keep Customer Content while your organization's account is active.
- When you delete a document from a domain, we delete its stored copy, along with its index, embeddings and other derived data, immediately.
- When you delete a knowledge domain, we delete the documents and derived data in it immediately.
- Short verbatim excerpts shown in citations are removed after 90 days.
- When a user is removed from an organization, we revoke that person's access and delete their personal information, such as name and email, and their sign-in identifiers, immediately. The organization's Customer Content is not affected.
- When an organization is deleted, its knowledge domains and the documents and derived data in them are deleted immediately; copies held in backups are purged on our standard backup cycle. Customers can agree specific timelines in their order form.
- We keep short-lived operational logs of model requests and responses, which may include prompt and response content, for no longer than 30 days, then delete them.
- We keep account and billing records as long as needed to provide the service and meet legal, tax and accounting obligations, and keep system logs only for a limited period.
Your rights and choices
- You can update your account information from your profile at any time.
- You can request access to, correction of, or deletion of your personal information by emailing privacy@trovia.ai. We respond within 30 days, or within any longer period applicable law allows.
- You can opt out of SMS one-time passcodes by replying STOP to any message.
- In Canada, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
- Residents of U.S. states with privacy laws, such as California, may have rights to know, delete and correct their personal information. We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your rights.
Children
Trovia is a business service for adults acting on behalf of organizations. It is not directed to children, and we do not knowingly collect their personal information.
Changes to this policy
We will post any update here and revise the date above. For material changes, we will give account administrators reasonable notice by email or in the product before they take effect. We will not weaken the commitments at the top of this policy for existing customer content without the customer's consent.
Contact
Privacy Officer, Trovia Technologies Inc., 550 Burrard Street, Vancouver, British Columbia, Canada. Email privacy@trovia.ai.