Privacy policy
What Trylane collects, why it is needed, and the choices you have.
Effective 25 October 2026, version 2026-10-25
Who is responsible
Trylane is operated by Kevin Tuyizere, an individual developer based in Rwanda. In this policy, “we” means Kevin Tuyizere. Contact privacy@trylane.app about personal data, or contact@trylane.app for general questions.
We act as controller for our website, accounts, billing administration, support and service security. When a workspace instructs us to handle its demo-session metadata, we act as its processor under our Data Processing Addendum. The workspace operator is responsible for its own application and visitor privacy notice.
Information we handle
| Information | Purpose and source |
|---|---|
| Account and workspace | Email, identity-provider ID, authentication status, workspace name, membership and roles; supplied by you, your workspace owner and Clerk. Google or GitHub sign-in shares the profile fields needed by the authentication flow when you choose it. |
| Project configuration | Names, allowed origins, SDK key hashes, safety declarations, recipe versions, scenarios and permitted actions; supplied by workspace members and integration agents. |
| Demo operations | Opaque visitor/session IDs, hashed access credentials, lifecycle times, resource counts, command outcomes, approved named milestones and an optional link source (the ?ref= name the workspace put on its demo link). A workspace may create personal demo links whose short values (such as a prospect’s company name) are passed to its own sample data. A workspace may also choose to ask its demo visitors for a work email; we then store that unverified address with the session for the workspace, as its processor, and send at most one reminder email before the demo ends if the workspace turns reminders on. Visitors see the workspace’s privacy notice next to the field. Network providers still receive IP addresses when serving requests. |
| Keep this workspace | When a visitor chooses to keep their demo work, the workspace’s own systems encrypt those records with a key Trylane never receives; we hold only that ciphertext and a hash of the claim code. If the workspace’s product passes one, we store a short account label it chooses for the claimed account. |
| Alerts | Each member’s alert choices and the verified email address alerts go to, and an optional Slack incoming-webhook URL for the workspace, stored encrypted. Alert messages are sent through Resend or Slack. |
| Billing | Polar customer/subscription identifiers, plan, payment status, period dates and webhook receipt IDs. Polar collects checkout, payment and tax details; Trylane does not store full card numbers. |
| Support and invitations | Your email and message, invitation recipient email and delivery status. Mail is sent through Resend; incoming role-address messages are routed by Cloudflare to the operator’s private primary inbox. |
| Optional analytics and diagnostics | Consent choices and, only after the relevant opt-in, normalized page routes, analytics identifiers and filtered browser errors. Necessary server errors use a separate, restricted diagnostic pipeline. |
Why we process it
Providing account and project information is necessary to provide the corresponding service. You can browse public information without creating an account. Please use synthetic data: do not submit production customer records, health data, financial account data or other sensitive personal information in recipes, project names or support messages. Trylane does not offer AI processing or use your content to train models.
- Contract: create and administer your account/workspace, authenticate access, run requested demos, apply quotas, deliver invitations, provide support and administer subscriptions.
- Legitimate interests: prevent abuse, enforce authorization, recover failed cleanup and diagnose service failures with limited technical information. These interests are balanced against your rights; you may object where this basis applies.
- Legal obligations: applicable financial, tax, regulatory and lawful disclosure requirements.
- Consent: optional Google Analytics, PostHog and browser Sentry reporting. Refusing or withdrawing consent does not prevent use of the service. We do not use consent as a substitute for necessary service processing.
Cookies, analytics and error reports
Optional tools are off until you make a choice. Accept and reject are available together. Analytics and browser diagnostics have separate controls under “Privacy choices”, available on every page. Global Privacy Control and Do Not Track signals keep both optional categories off.
Google Analytics receives manually configured public-page views, with advertising features disabled. Its tag is excluded from authentication, demo, support-form and workspace pages. PostHog receives selected public/workspace page views using an in-memory identifier; autocapture, identification, replay, surveys and feature-flag requests are disabled. Project IDs are replaced with route placeholders, and query strings and fragments are excluded.
Browser Sentry reporting requires diagnostics consent. Server Sentry reporting, when configured, is used for necessary reliability and security. Error payloads omit raw messages, user context, cookies, request bodies, headers and breadcrumbs; they contain generic error types, technical stack locations and normalized routes. Reporting services receive network information such as the sending IP and basic protocol headers. These restrictions reduce collection; they do not make third-party processing anonymous.
Who receives information
We use hosting, authentication, database, transactional email and monitoring providers to deliver the service. Authorized access is limited to the operator and providers performing their roles. Workspace members can see information their roles permit, including operational metadata. We may disclose necessary information where legally required, to protect rights and safety, or in connection with a lawful transfer of the service with appropriate notice and safeguards.
We do not sell personal information, share it for cross-context behavioral advertising, or use advertising audiences. Polar and identity providers also process some information as independent controllers under their own notices. Customer demo applications are separate services with their own controllers.
Retention and deletion
These schedules describe ordinary processing; narrowly scoped legal preservation may require longer retention. Database deletion is not instant erasure of backups. For account deletion beyond a workspace, contact us so identity and relevant provider records can be addressed. We do not promise immediate deletion while resource cleanup is unconfirmed.
| Record | Retention |
|---|---|
| Account, membership and project configuration | While the account/workspace is active and needed to provide the service. Workspace deletion revokes access first; control-plane records are purged after every customer resource and command is confirmed cleaned. Unresolved cleanup is retained until recovery is complete. |
| Milestone events and cleaned sessions | Milestones: 30 days. Acknowledged expired sessions and associated jobs/admissions: 30 days after cleanup. Maintenance runs while the lifecycle worker is operating. |
| Keep this workspace and alerts | Encrypted kept records: until claimed or 24 hours, whichever is first. Claim records, account labels, visitor emails and personal-link values used by a session: with that session, 30 days after cleanup. Personal links: until turned off or the product is deleted. Sent alerts: 30 days. Alert preferences and Slack connection: until changed, the member leaves, or the workspace is deleted. |
| Other control records | Expired invitations: seven additional days; operations: 30 days; webhook receipt IDs: 180 days; completed hashed deletion receipts: 90 days; usage buckets: three months. |
| Access and security tokens | One-use handoffs expire after 30 seconds; request nonces after three minutes; expired records are removed by worker maintenance. Visitor cookies last at most one hour, with shorter server-enforced session deadlines. |
| Support correspondence | Normally up to 12 months after a matter closes, unless needed for an ongoing dispute, legal requirement or security investigation. This includes copies in the sending service and the operator’s inbox and requires provider/inbox deletion. |
| Optional analytics and diagnostics | Consent choice: 180 days. Google event/user retention is configured separately from aggregated reports. PostHog event retention is plan-dependent (currently one year on free plans and seven years on paid plans); changing your choice stops future collection and does not itself delete stored events. Sentry retention depends on its project plan. Contact us for the deployed project’s retention and deletion requests. |
| Customer resources, provider records and backups | Synthetic application rows are cleaned by the customer agent. Minimal resource tombstones can remain to prevent replay. Clerk identity, Polar financial records and backups have separate schedules; deleting a workspace does not automatically delete them. Restricted backup copies age out through their backup schedule and are not used for ordinary service processing. |
International processing
The operator is in Rwanda. The providers listed on our provider page may process information in the European Economic Area, United Kingdom, United States and other countries in their published subprocessor lists. Choosing an EU project region does not prevent all international support or network processing.
International processing must have a lawful transfer basis and any required Rwanda authorization. Where applicable, contractual safeguards such as approved standard contractual clauses and additional measures are required. Contact us for information about the safeguards applicable to your data. No adequacy decision, regulatory registration or transfer authorization is implied merely by using these providers.
Your rights and requests
Depending on applicable law, you may request access, correction, deletion, portability, restriction, or object to processing based on legitimate interests. You may withdraw optional consent at any time through Privacy choices without affecting processing that was lawful before withdrawal. We do not make decisions with legal or similarly significant effects solely through automated profiling.
Email privacy@trylane.app. We may request proportionate information to verify your identity or authority, without asking for unnecessary identity documents. We respond within applicable legal deadlines, ordinarily within one month for GDPR requests, and explain any lawful extension or refusal. Requests concerning a customer’s demo application should go to that customer; we assist where we act as processor.
You may complain to Rwanda’s Data Protection and Privacy Office or another competent authority, including your local EEA authority or the UK Information Commissioner where applicable. You may exercise rights without discrimination.
Children
Trylane is intended for professional users aged 18 or over and is not directed at children. Do not knowingly submit children’s personal data. If you believe a child has provided personal information, contact privacy@trylane.app; we will investigate and delete it where required. We do not claim to verify every visitor’s age.
Changes to this policy
The date and version on this page identify the current notice. Material changes are communicated through the service or account email when appropriate. We explain new purposes before using information for them and obtain fresh consent where required. A changed policy does not silently expand an existing consent choice.
Questions about this document? contact@trylane.app