Privacy Policy

1. Information We Collect

1.1 Information We Do Not Collect

TruePuff is designed to operate without collecting personal data from consumers.

We do not require or collect:

• Consumer accounts
• Names
• Email addresses
• Phone numbers
• Government IDs
• Payment information from consumers

Consumers can verify products without providing personal information.

1.2 Information Collected From Brand Customers

If you are a brand, partner, or business customer, we may collect:

• Business name
• Contact name and business email
• Billing information (processed by third-party payment providers)
• Account configuration data
• Usage and system metadata related to your account

1.3 Verification, Scan & Tap Data

When a product credential is verified — by scanning a QR code or tapping an NFC identifier — we may collect:

• Timestamp of the scan or tap
• Approximate geographic location (city/region level), IP-derived
• Device and browser metadata (non-identifying)
• Which credential channel was used (QR or NFC) and the verification status

Because this includes IP-derived location and device metadata, verification events are not “zero data.” This information is used solely for authentication, fraud and reuse detection, analytics, and system security. NFC taps and QR scans are recorded as distinct events but analysed together for the same product unit.

We do not attempt to identify individual consumers.

1.4 Credential Programming & Operator Data

When a brand’s staff enroll or program credentials (for example, writing an NFC tag or exporting programming data), we record operational audit data to keep the process accountable:

• The acting brand user and the action taken (generate, reserve, write, readback, activate, revoke, export, reconcile)
• Credential lifecycle state and timestamps
• Non-sensitive device metadata from the programming session

We never store or log the raw credential token itself — only a keyed hash used for verification.

2. How We Use Information

We use collected information to:

• Provide and operate the Services
• Verify product authenticity
• Detect and prevent fraud, credential copying, and reuse
• Maintain system security and integrity
• Provide analytics and insights to brand customers
• Communicate with business customers
• Comply with legal obligations

Automated / AI processing. We apply deterministic rules and automated intelligence to verification events to flag anomalies (for example, impossible-travel, bulk reuse, or lifecycle violations) and to help brands investigate suspected counterfeiting. Automated analysis never runs on the synchronous consumer verification response, and raw credential tokens are never included in any AI processing.

3. Data Sharing

We do not sell personal data.

We may share limited information:

• With service providers (hosting, analytics, payment processing)
• To comply with legal obligations or lawful requests
• To protect the rights, safety, and security of TruePuff or others

All service providers are required to protect data consistent with this policy.

4. Data Retention

We retain data only as long as necessary to:

• Provide the Services
• Meet contractual obligations
• Maintain security and auditability
• Comply with legal requirements

Brand customers may configure retention periods depending on their plan.

5. Security

We implement reasonable technical and organizational measures to protect data, including encryption, access controls, and logging. No system is 100% secure, but we design our platform to minimize risk and exposure.

6. International Use

TruePuff may process data in multiple jurisdictions. By using the Services, you consent to the transfer and processing of information in accordance with this policy.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on our website with an updated effective date.

8. Contact

For privacy questions or requests, contact:

support@truepuff.io