Privacy policy
Effective November 6, 2026
This policy explains what personal information TrustStore ("we") collects when you use truststorehq.com and the TrustStore application at app.truststorehq.com, how we use it and the choices you have.
Our role
Firms (our customers) use TrustStore to exchange documents with their own clients. The documents and the recipient details a firm enters belong to that firm, and we process them on the firm's behalf and according to its instructions. If you received a link from a firm, contact that firm about the documents it holds. We are responsible for the account and technical information described below.
Information we collect
- Account information for firm staff: name, email address, organization and role, and sign-in details (passwords are handled by our authentication provider and are never visible to us).
- Recipient information: the email address a firm enters when it shares or requests documents, and a name if one is provided.
- Documents that firms and recipients upload, with their file names, sizes and scan results.
- Activity and security records: what was viewed, uploaded or downloaded and when, IP address and browser type. We use these to secure the service and to give firms an accurate activity history.
How we use it
Only to provide and secure the service: to deliver documents and requests, send the emails the service needs (verification codes, invitations and reminders), scan files for malware, prevent abuse and fraud, and support our customers. We do not sell personal information, we do not use it for advertising and we do not send marketing emails to recipients.
Cookies
We use only cookies that the service needs to work: a session cookie and a security cookie after a recipient confirms their email address. We do not use advertising, analytics or tracking cookies. This website sets no cookies.
Where your information is stored
Documents and data are stored in Canada, in Amazon Web Services' Canada Central region. We use these service providers to run TrustStore:
- Amazon Web Services (hosting, storage, authentication, email delivery and malware scanning). Web pages are delivered through AWS's global content network.
Service providers may only use the information to provide their services to us.
Security
Information is encrypted in transit and at rest. Each firm's data is isolated from every other firm's. Recipients must confirm their email address with a one-time code, files are malware-scanned before anyone can download them, and access is recorded. No system is perfectly secure; if a breach affects your personal information we will notify you and the authorities as the law requires.
How long we keep it
Documents are kept until the firm deletes them or closes its account. Files that never finish uploading are removed after two days, and verification codes and recipient sessions after 30 days. Activity records are kept for the life of the firm's account so that its history stays complete.
Your rights
You may ask to access or correct your personal information, or ask questions about how it is handled, by writing to teren@truststorehq.com. If your request concerns documents a firm holds, we will pass it to that firm. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.
Changes
If we change this policy, we will post the new version here with a new effective date.