Privacy policy

Last updated: 24 October 2026

Trovaso (trovaso.com) is a tool that helps brands find TikTok, Instagram and YouTube creators, talk to them, sign collaborations and measure what the videos bring. Trovaso is operated by Onda Dev (“we”, “us”). This policy explains what personal data we handle, why, who we share it with and what you can ask of us. It covers two groups of people: the brands and teams who use Trovaso (“customers”), and the creators whose public profiles Trovaso shows to customers and who customers contact.

Questions or requests: team@trovaso.com.

1. Who is responsible for your data

• Customer accounts, billing, and creator discovery: Onda Dev decides how this data is used and is the controller.
• What customers keep and send in Trovaso — their creator roster, their conversations with creators, contracts, payment confirmations, sales data: the customer is the controller and we process it on their behalf, only to run the service for them. If you are a creator and a brand contacted you through Trovaso, that brand is responsible for its conversation with you; you can also write to us and we will pass your request on or help.

2. Data about customers

• Account: your email address, name, and a user id. If you sign in with Google, the name and email Google shares with us.
• Your workspace: your product and website description, targeting settings, logo, team members' email addresses and roles, creator roster, notes, uploaded documents and files you import.
• Email sending: the domain you send from, its DNS settings, the name shown as sender, and counts of what was sent. Replies to your outreach come back to Trovaso and are stored in your Deals inbox.
• Contracts and payment confirmations: the legal details you enter for your company (name, address, VAT id, signer).
• Sales data: if you connect a sales source (RevenueCat, Adapty, Superwall, Shopify, WooCommerce, Stripe, Paddle) or import a file, daily totals per country and discount-code sales. We do not store your own customers' identities from these sources. Connection keys are stored encrypted.
• Billing: payments are handled by Stripe. We never see or store your card; we keep your Stripe customer and subscription ids, your plan and your credit balance.
• Usage and security: product analytics events (for example “signed up” or “started a checkout”) linked to your user id, IP addresses in rate-limit records, and server logs.

3. Data about creators

Trovaso helps brands find creators for paid collaborations. To do that it reads information that creators have made public on TikTok, Instagram and YouTube, and on their own link-in-bio pages and websites:

• handle, display name, bio, profile picture, follower count, posts, captions and their view and like counts;
• a business contact email, when the creator published one in their bio, link-in-bio page or website;
• estimates Trovaso makes from that public content with the help of AI models: likely country and language, likely audience (gender and age range of the creator and of the people who comment), how well the creator fits a brand's product, and where their audience is, from the languages and countries of public comments. We keep only the aggregated audience shares, not the commenters.

When a customer works with a creator, the customer's workspace can also hold the emails and messages exchanged, the deal terms and fees, discount codes, payout details the creator sends (such as an IBAN or PayPal address), signed contracts and payment confirmations. When a creator signs a contract or confirms a payment on a Trovaso page, we record the typed or drawn signature, the time, the IP address and the browser, as evidence of the signature; if the brand asks, the confirmation can include a tax id, address and tax residence certificate.

Creators can opt out. If you are a creator and do not want to be suggested to brands on Trovaso, email team@trovaso.com with your handle (and email, if you like). We will add you to our do-not-suggest list, which keeps you out of every customer's new results, and remove the data we hold about you where we can.

4. Why we use it, and on what basis

• To provide Trovaso to customers — accounts, discovery, the inbox, contracts, results, team features, the ChatGPT/Claude plugin: performance of our contract with the customer.
• To show creators to brands looking for collaborations and help brands reach them: our legitimate interest, and that of brands, in connecting with creators who publicly present themselves as available for brand work. We limit this to public, professional information, and anyone can object (see the opt-out above).
• Billing, tax and accounting: legal obligation and contract.
• Security, abuse prevention and improving the product: legitimate interest.
• Service emails (new results ready, a creator replied if you turned that on, team invites, signed contracts): contract. We do not send marketing emails to creators on our own behalf.

Outreach emails that customers send to creators through Trovaso are the customer's communications, sent from the customer's own domain under their name. Customers are responsible for having a lawful basis for them and for honouring any request to stop (see our terms).

5. AI

Trovaso uses AI models (from Anthropic and OpenAI) to judge creators' fit, estimate audiences, read and draft replies in the Deals inbox, translate messages, draft contracts and read files you import. Before any text is sent to a model, Trovaso replaces payment details, card numbers, phone numbers and tax ids with placeholders. Our AI providers process this data to return the result and, under their API terms, do not use it to train their models. AI estimates can be wrong; they are suggestions, and the customer decides whom to contact and what to send.

6. Who we share data with

We do not sell personal data. We share it with the providers that run parts of Trovaso for us:

• Google Cloud / Firebase — accounts, database, file storage, and bot protection (reCAPTCHA);
• Hetzner (Germany) — the servers Trovaso runs on;
• Stripe — payments and subscriptions;
• Resend (with Amazon Web Services) — sending and receiving email;
• Anthropic and OpenAI — the AI features above;
• Apify and ScrapeCreators — reading public creator profiles, posts and comments;
• PostHog (EU) — product analytics.

We also share data:

• Within your workspace: team members see the workspace's roster, inbox and results.
• With an assistant you connect: if you connect Trovaso to ChatGPT, Claude or another assistant, the data you or the assistant ask for is sent to that assistant's provider (OpenAI, Anthropic…) under your agreement with them, with payment details and phone numbers replaced as above. You can disconnect at any time from the assistant.
• When the law requires it, or to protect our rights and users, and with a buyer if Onda Dev sells or merges the business, under this policy.

Some of these providers are in the United States. Where data from the EU, the UK or Switzerland goes there, we rely on the safeguards the law provides, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

7. How long we keep it

• Customer workspace data: for as long as the account exists, then deleted on request (see below).
• Conversations and attachments in the Deals inbox: as long as the workspace keeps them.
• Signed contracts and payment confirmations: as long as the customer keeps them, as they are evidence of an agreement or a payment.
• Billing records: as long as tax and accounting law requires.
• Security records such as rate limits and sign-in codes: from minutes to 30 days.
• Creator discovery data: while it is useful to customers' searches, and removed on request.

8. Your rights

Depending on where you live, you can ask us for a copy of your data, to correct it, delete it, restrict or object to how we use it, or to receive it in a portable format, and withdraw any consent you gave. Email team@trovaso.com; we answer within 30 days and may ask you to prove who you are. To close your account and have its data deleted, write to the same address. If you are in the EU or the UK, you can also complain to your data protection authority. If you live in California, you have the right to know, delete and correct your data and not to be discriminated against for using these rights; we do not sell or share personal data for cross-context advertising.

9. Cookies and storage in your browser

Trovaso does not use advertising cookies. Our analytics keep no cookie: they live in memory for the page you are on. The app stores your session and a copy of your workspace in your browser so it loads fast and works offline. Google reCAPTCHA (against bots) and Stripe (on its payment pages) may set their own cookies.

10. Security

Data travels encrypted (HTTPS). Access to customer data is limited to the account's team and to us for support and running the service. Connection keys for sales sources are encrypted, plugin access tokens are stored only in hashed form, and sign-ins can be revoked. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

11. Children

Trovaso is a business tool and is not meant for anyone under 18.

12. Changes

We update this policy when Trovaso changes. The date at the top says when; for significant changes we will tell customers by email or in the app.

Contact

Onda Dev · team@trovaso.com