Privacy Policy

TrustMatch is operated by The Big Fat Dad LLC, a Delaware limited liability company (“TrustMatch,” “we,” “us”). This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

It applies to:

• our website at trustmatch.app, including our blog;
• the TrustMatch consumer app at app.trustmatch.app and our TrustMatch mobile apps;
• the TrustMatch developer portal at portal.trustmatch.app and the TrustMatch API.

It does not apply to any third-party website or service we link to, each of which has its own privacy practices.

TrustMatch is not a consumer reporting agency, and a TrustCheck is not a consumer report or an investigative consumer report under the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681 et seq., or any equivalent state law.

We verify identity signals only. We do not collect, compile, or provide criminal records, credit history, employment history, rental history, or education records, and we do not evaluate anyone's character or general reputation.

You may not use TrustMatch, in whole or in part, as a factor in deciding a person's eligibility for employment, housing or tenancy, credit, or insurance, or for any other purpose regulated by the FCRA. Doing so violates our Terms of Use and may violate federal law.

Most privacy policies describe one relationship. Ours describes two, and your rights differ depending on which one applies to you.

Account holders

People who create a TrustMatch account, subscribe to a plan, or use our API. You give us your information directly, and you control it through your account.

Search subjects

People whose name, phone number, or email address is submitted to TrustMatch by someone else. If you are reading this because you were searched, you did not give us your information and you did not agree to anything — so we describe separately, in Section 6 and Section 9, what we hold and how to have it suppressed.

Information you give us

• Account information — your email address, your name if you provide one, and an authentication identifier. Accounts are handled by Google Firebase Authentication. If you sign in with Google, we receive your email address and basic profile from Google; we never receive your Google password.
• Search inputs — the name, phone number, email address, or postal address you submit to run a TrustCheck.
• Billing information — your plan, subscription status, and billing history. Payments are processed by Stripe. Card numbers are entered directly into Stripe and never reach our servers; we store only a Stripe customer reference and the resulting subscription state.
• Messages you send us — the contents of any email or support request.

Information we generate

• TrustCheck results — the score, verdict, signal breakdown, and plain-English summary produced for each search, along with the underlying response from our identity data provider.
• Usage records — checks used against your plan quota, API key usage, and timestamps.

Information collected automatically

• Device and log data — IP address, browser and device type, operating system, referring page, and pages viewed.
• Analytics and session activity — see Section 8.

We do not use TrustCheck search inputs or results to build marketing profiles, and we do not sell them.

TrustMatch does not maintain its own dossier on the general public. To run a TrustCheck we pass the submitted details to a third-party identity verification provider, which checks them against phone-carrier records, email-validity data, identity registries, and commercially available digital-footprint signals, and returns match-quality indicators.

One of the signals we receive is a commerce-derived risk indicator. It reflects transaction behaviorassociated with an identity — not a person's character, honesty, or criminal history — and we label it in the product as transaction risk for exactly that reason.

We retain the result of a search so the account holder who ran it can see their history. Where that result concerns you as a search subject, you can ask us to suppress it — see Section 9. Suppressing our copy does not remove your information from the underlying data sources, which we do not control; those sources maintain their own opt-out processes, and we will point you to the relevant one on request.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We disclose information only to the service providers below, each bound by contract to use it solely to provide services to us:

We may also disclose information:

• when required by law, subpoena, or other valid legal process, or to protect the rights, safety, or property of TrustMatch, our users, or the public;
• in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy;
• at your direction or with your consent.

We use cookies and similar technologies that are strictly necessary (keeping you signed in, security, load balancing) and analytics cookies. We do not run third-party advertising cookies.

Analytics and session replay

We use PostHog to understand how the service is used and to reproduce errors. This includes session replay, which records page views, navigation, clicks, and scrolling.

Session replay masks every form input across our sites, and in the signed-in app it additionally masks all on-screen text. The intent is that a replay shows us how an interface behaved without exposing what was typed into it or who a result was about.

Do Not Track and Global Privacy Control

Where your browser or extension transmits a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of analytics on that browser. Because we do not sell personal information or serve targeted advertising, there is no advertising opt-out to apply. Browsers also send a legacy Do Not Track signal that has no agreed standard; we honor GPC instead.

Marketing email

Every marketing or product-update email we send contains an unsubscribe link, and unsubscribing takes effect for all future marketing email. You can also email trust@trustmatch.app with the subject line UNSUBSCRIBE.

You cannot opt out of transactional email while your account is open. Receipts, password resets, security alerts, and notices of changes to these policies are part of the service, not marketing. To stop those, close your account.

Analytics and session replay

Turn on Global Privacy Control in your browser, or email trust@trustmatch.app and we will suppress analytics collection for your account.

Deleting your account and your data

You can permanently delete your account from your account settings in the TrustMatch app. Deletion removes your profile, your verification history and stored results, and your billing customer record, and cancels any active subscription. It is immediate and cannot be undone. If you also hold a developer account, that is a separate record — email us to have it removed as well.

If you were searched: identity record suppression

If someone ran a TrustCheck involving your name, phone number, or email address, you can ask us to suppress it. Email trust@trustmatch.app with the subject line OPT OUT and include the phone number or email address you want suppressed.

When we receive a suppression request we will:

1. verify that you control the phone number or email address in question, so that one person cannot suppress another person's records;
2. delete stored TrustCheck results keyed to that identifier;
3. add the identifier to a suppression list so that future TrustChecks against it return no result;
4. tell you which upstream data source held the information, so you can use its own opt-out process for records we do not control.

We respond to suppression requests within 45 days and charge nothing for them.

Depending on where you live, you may have some or all of the following rights: to know what personal information we hold and how we use it; to access a copy of it; to correct inaccurate information; to delete it; to opt out of sale, sharing, or targeted advertising (we do none of these); to limit the use of sensitive personal information; to portability; and to non-discrimination for exercising any of them.

California residents hold these rights under the CCPA as amended by the CPRA. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana and other states with comprehensive privacy laws hold substantially similar rights, including the right to appeal a denied request. Residents of the EEA, UK, and Switzerland hold rights under the GDPR, including the right to object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority.

Where the GDPR applies, our legal bases for processing are: contract (providing the service you signed up for), legitimate interests (security, abuse prevention, and product improvement), consent (marketing email, where required), and legal obligation.

To exercise any right, email trust@trustmatch.app. We will verify your identity before acting — usually by confirming control of the email address on the account — and respond within 45 days, extendable once where the law allows. You may use an authorized agent where the law permits.

• Account information — for as long as your account is open, then deleted when you delete your account.
• TrustCheck results and history — until you delete the result, delete your account, or successfully request suppression.
• Billing records — retained by Stripe and by us as required by tax and accounting law, typically seven years, even after account deletion.
• Server and security logs — up to 30 days in the ordinary course.
• Analytics data — retained in de-identified or aggregated form, which we may keep and use indefinitely because it is no longer linked to you.

We may retain information longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

We encrypt data in transit with TLS and at rest. Access to production systems is restricted and authenticated. API keys are stored only as SHA-256 hashes — we cannot recover a key after it is issued, which is why a new key is shown exactly once. Card numbers never touch our infrastructure.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

TrustMatch is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, email trust@trustmatch.app and we will delete it.

We operate in the United States, and our service providers process data there. If you access TrustMatch from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your country. Where required for transfers out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will give you notice by email or through the service before they take effect. Continuing to use TrustMatch after an update means you accept the revised policy.

For any privacy question, request, or complaint — including opt-out and suppression requests — contact us:

The Big Fat Dad LLC
Email: trust@trustmatch.app
Web: trustmatch.app/contact

The Big Fat Dad LLC is the data controller for the purposes of the GDPR.