Privacy Policy

1. Introduction

This Privacy Policy explains how Trellis Corporation and its affiliated entities worldwide ("Trellis," "we," "us," or "our") collect, use, disclose, retain and protect Personal Information when you visit our websites, use our products and services, communicate with us, attend our events, or otherwise interact with us.

This Privacy Policy applies to www.gotrellis.com, associated website pages and other websites or online services that expressly reference this Privacy Policy, as well as information processed in connection with the Trellis platform and related services, except where a separate privacy notice applies.

Trellis is committed to respecting privacy and protecting Personal Information. We seek to collect and use information in a manner that is appropriate for the purposes described in this Privacy Policy and applicable law.

2. Scope and Definitions

For purposes of this Privacy Policy:

"Personal Information" or "Personal Data" means information about an identified or identifiable individual, as defined by applicable privacy law.

"Customer Data" means information submitted to, stored in, transmitted through, or otherwise made available to Trellis by or on behalf of a customer in connection with the Trellis Services. Customer Data may include business, product, advertising, marketplace, sales, inventory, performance, analytics and other commercial information, including Personal Information contained within that information.

"Usage Data" means technical, diagnostic and interaction information concerning use of our websites and Services.

"Services" means the Trellis websites, software, applications, platform, Qore and related products and services.

Where Trellis processes Customer Data on behalf of a business customer, Trellis generally acts as a service provider, processor, or other equivalent role as determined by applicable law and the parties' agreement. The customer remains responsible for determining the purposes for which Customer Data is collected and used, subject to the applicable agreement and law.

3. Information We Collect

We collect information from several sources depending on how you interact with Trellis.

3.1 Information You Provide

You may provide information when you create an account, request a demonstration, subscribe to a service, contact us, register for an event or training session, download materials, participate in discussions, submit support requests, enter into an agreement, communicate with us, or otherwise interact with Trellis.

This information may include your name, business email address, mailing address, telephone number, company and job information, account credentials, billing and transaction information, communications with Trellis, and other information you choose to provide.

3.2 Customer and Account Information

When you use the Trellis Services, we may collect information associated with your Trellis account, including account identifiers, user roles and permissions, configuration information, service selections, authentication information, support records and information about your use of the Services.

3.3 Customer Data and Connected Services

Customers may connect third-party platforms and services to Trellis, including marketplace, advertising, commerce, analytics and other platforms. Depending on the services enabled by a customer, Trellis may receive and process information made available through those integrations.

This information may include product and catalog information, marketplace account information, advertising campaign and performance data, sales and transaction information, search and keyword information, inventory information, pricing and promotional information, shopper or audience insights, reporting information, identifiers, and other data made available through the connected service.

The availability and type of information depend on the third-party service, permissions granted by the customer, the applicable API or integration, and the customer's configuration of Trellis.

3.4 Website, Device and Usage Information

We automatically collect certain information about how you interact with our websites and Services, including IP address, date and time of access, browser and operating system information, device information, pages and features viewed, links clicked, referring pages, approximate location information, and other technical or diagnostic information.

We may use cookies, pixels, SDKs, local storage and similar technologies to collect some of this information.

3.5 Information from Third Parties

We may receive information from third parties, including business partners, service providers, publicly available sources, advertising and analytics providers, event organizers, and platforms that you authorize to connect to Trellis.

4. How We Use Information

We may use Personal Information, Customer Data and other information for the following purposes, subject to applicable law and the applicable customer agreement:

• Providing, operating, maintaining and supporting the Trellis Services;
• Creating and administering accounts and authenticating users;
• Connecting to and retrieving information from authorized third-party services;
• Delivering analytics, reporting, optimization, recommendations and other requested functionality;
• Operating Qore and other AI-powered or automated features;
• Processing customer requests, support cases and communications;
• Processing payments, subscriptions and other transactions;
• Monitoring performance, reliability and usage of the Services;
• Detecting, preventing and investigating fraud, abuse, security incidents and unauthorized activity;
• Protecting the rights, property and safety of Trellis, our customers and others;
• Improving, developing and testing our products, services and technology;
• Generating aggregated or de-identified information for analytics, benchmarking and product development, where permitted by law;
• Communicating with you about your account, service changes, security matters and support;
• Sending marketing communications where permitted by law and consistent with your preferences;
• Complying with legal, regulatory and contractual obligations; and
• Performing other purposes described at the time information is collected or otherwise authorized by applicable law or agreement.

5. Legal Bases for Processing

Where applicable law requires a legal basis for processing Personal Data, Trellis may rely on one or more of the following:

• Performance of a contract — where processing is necessary to provide requested Services or perform our agreement with you or your organization;
• Legitimate interests — where processing is necessary for purposes such as operating, securing and improving our business and Services, provided those interests are not overridden by applicable privacy rights;
• Consent — where consent is required or where we choose to rely on consent;
• Legal obligations — where processing is necessary to comply with applicable law, regulation, legal process or governmental request; and
• Other lawful bases available under applicable law.

Where processing is based on consent, you may withdraw consent as permitted by applicable law. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Customer Data and Trellis's Role

Trellis generally processes Customer Data to provide the Services to its business customers. Depending on the circumstances and applicable law, Trellis may act as a processor, service provider, or equivalent role, while the customer acts as the controller, business, or equivalent role.

Customers are responsible for ensuring that they have an appropriate legal basis and required notices, consents and permissions for information they provide to Trellis or make available through connected services.

Trellis will process Customer Data in accordance with the applicable customer agreement, data processing terms, this Privacy Policy and applicable law.

Except as described in the applicable agreement or this Privacy Policy, Trellis does not sell Customer Data. Trellis may use aggregated or de-identified information that cannot reasonably be used to identify a customer or individual for purposes such as analytics, benchmarking, security, research and development, and improving our Services, to the extent permitted by law and contract.

7. Qore, Artificial Intelligence and Automated Technologies

Certain Trellis Services, including Qore and other AI-powered features, use artificial intelligence, machine learning, large language models and automated technologies to analyze information, generate responses, provide recommendations, summarize information and, where enabled and authorized, perform actions at a customer's direction.

Depending on the features enabled, AI-powered functionality may process prompts, questions, instructions, Customer Data, information retrieved from connected services, outputs and related interaction or diagnostic information.

Trellis may use third-party technology and AI/model providers to support these capabilities. Where third-party providers process Customer Data, Trellis will seek to impose appropriate contractual and security requirements consistent with the applicable customer agreement and applicable law.

Trellis does not use Customer Data, prompts, outputs, or interaction logs to train general-purpose or generalized artificial intelligence or machine learning models. Where third-party AI/model providers process Customer Data on our behalf, they do so under commercial terms that prohibit them from using that data to train or improve their models.

AI-generated information may be incomplete, inaccurate or unsuitable for a particular purpose. Customers remain responsible for reviewing outputs and decisions before relying on them or taking consequential action.

Trellis may use limited information relating to interactions with AI-powered Services for purposes such as providing the Services, maintaining security, preventing misuse, debugging, monitoring performance and improving the Services, subject to applicable law, the customer's agreement and Trellis's actual technical practices.

8. Google User Data

Certain Trellis Services, including Qore, allow you to connect your Google account so that we can provide features you request. Depending on the permissions you grant, these features include:

• importing the content of Google Sheets, Google Docs, or Drive files that you explicitly select (via the Google file picker) into analyses and workflows you create;
• exporting results and reports you generate back to Google Sheets, Docs, or Slides in your Google Drive; and
• reading your Google Calendar events to schedule and manage recordings of meetings you have asked Trellis to record.

Trellis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide and improve the user-facing features described above that you request.
• We do not use Google user data — whether raw, aggregated, anonymized, or derived — to create, train, or improve generalized or foundational artificial intelligence or machine learning models, whether our own or those of any third party.
• We do not sell Google user data, use it for advertising purposes, or use it to determine creditworthiness or for lending purposes.
• We do not transfer Google user data to third parties except as necessary to provide or improve the user-facing features described above, for security purposes (such as investigating abuse), to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice to you.
• Our personnel do not read Google user data except with your express permission (for example, to provide support you request), where necessary for security purposes or to comply with applicable law, or where the data has been aggregated and de-identified for internal operations in accordance with applicable law.

AI features and Google user data. When you direct an AI-powered feature to process content from your connected Google account (for example, analyzing a spreadsheet you selected), that content is processed by the third-party AI service providers identified below, acting as our service providers under commercial terms that prohibit them from using your data to train their models:

• Anthropic PBC — large-language-model analysis and generation (Claude models, accessed via the Anthropic API under Anthropic's Commercial Terms of Service);
• Recall.ai (AWS Labs Technologies, Inc.) — meeting recording and transcription. When you connect your Google Calendar for meeting recording, calendar access is shared with Recall.ai so that it can identify and join the meetings you have asked to be recorded. Transcription is performed by Recall.ai's own transcription engine, and Recall.ai does not use your data to train AI models.

Retention and revocation. We retain Google user data only as long as needed to provide the features described above, and you may disconnect your Google account at any time from your account settings, which terminates our access. You may also revoke Trellis's access at any time via your Google security settings. Upon disconnection or account deletion, we delete Google user data in accordance with Section 11 (Data Retention) and the applicable customer agreement.

Precedence. Notwithstanding any other provision of this Privacy Policy (including Sections 4, 6, 7 and 8.5), Google user data is collected, used, retained, and shared only as described in this section.

9. How We Share Information

We may disclose information in the following circumstances:

9.1 Service Providers and Subprocessors

We may share information with third-party service providers that process information on our behalf, including providers of cloud hosting, storage, databases, analytics, customer support, communications, security, fraud prevention, payment processing, professional services and AI or machine-learning infrastructure.

These providers are generally authorized to process information only as necessary to provide services to Trellis or our customers, subject to applicable contractual restrictions.

Our AI service providers are identified in the "Google User Data" section above and in our Subprocessor List.

9.2 Connected Platforms and Business Partners

Where a customer authorizes a connection or integration, Trellis may exchange information with the applicable third-party platform or service to provide the requested functionality. We may also share information with business partners where necessary to provide a jointly offered service, where you have requested or authorized the sharing, or as otherwise permitted by law.

9.3 Legal, Safety and Security

We may access, preserve and disclose information when we reasonably believe it is necessary to comply with applicable law, regulation, legal process or governmental request; enforce agreements; detect or investigate fraud or security issues; or protect the rights, property or safety of Trellis, our employees, customers, users or others.

9.4 Corporate Transactions

If Trellis is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy or similar transaction, information may be transferred as part of that transaction, subject to applicable law and confidentiality requirements.

9.5 Aggregated and De-identified Information

We may use and disclose aggregated or de-identified information that does not reasonably identify an individual or customer for analytics, benchmarking, research, security, product development and other lawful purposes.

10. Cookies and Similar Technologies

We use cookies and similar technologies to operate our websites and Services, remember preferences, understand usage, measure performance, support security, and, where permitted, deliver or measure marketing and advertising.

Some cookies may be placed by third-party providers. Your browser or device may provide controls for managing cookies. Where required by applicable law, Trellis will provide appropriate consent or preference mechanisms.

Trellis may maintain a separate Cookie Policy describing categories of cookies and similar technologies in greater detail.

11. Marketing Communications

We may send transactional and service-related communications necessary to administer your account or provide the Services.

Where permitted by applicable law, we may also send marketing communications about Trellis products, events, services and offers. You may unsubscribe from marketing communications by following the unsubscribe instructions in the communication or contacting us at [email protected].

Unsubscribing from marketing communications does not prevent us from sending non-promotional communications relating to your account, security, transactions or Services.

12. Data Retention

We retain Personal Information and Customer Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the Services, comply with legal and contractual obligations, resolve disputes, enforce agreements, maintain security, and establish or defend legal claims.

Customer Data retention and deletion following termination of Services are also governed by the applicable customer agreement and data processing terms.

Retention periods may vary depending on the type of information, the purpose for which it was collected, legal requirements, security considerations and contractual obligations. When information is no longer required, Trellis will delete, anonymize or otherwise dispose of it in accordance with applicable law and our policies.

13. Security

Trellis maintains technical and organizational safeguards designed to protect Personal Information and Customer Data against unauthorized access, use, alteration, disclosure, loss or destruction.

Safeguards may include access controls, authentication mechanisms, encryption in transit, security monitoring, logging, employee access restrictions, contractual controls for service providers, and other administrative, technical and physical measures appropriate to the nature and sensitivity of the information.

No method of transmission or storage is completely secure. Accordingly, we cannot guarantee absolute security.

Where a privacy or security incident occurs, Trellis will respond in accordance with applicable law, contractual obligations and our incident-response procedures, including any required notifications.

14. International Data Transfers

Trellis and its service providers may process and store information in Canada, the United States and other countries where Trellis or its service providers operate.

When Personal Information is transferred across borders, Trellis will use appropriate contractual, organizational and technical measures and comply with applicable legal requirements governing international transfers.

Depending on the jurisdiction, individuals may have rights relating to information about where their Personal Information is processed or the safeguards used for international transfers.

15. Your Privacy Rights

Depending on where you live and subject to applicable legal exceptions, you may have rights concerning your Personal Information, including the right to:

‍

• Request access to Personal Information we hold about you;
• Request correction of inaccurate or incomplete Personal Information;
• Request deletion or erasure of Personal Information;
• Request restriction of or object to certain processing;
• Withdraw consent where processing is based on consent;
• Request portability of certain Personal Information;
• Opt out of certain marketing communications or other processing where required by law; and
• Lodge a complaint with an applicable privacy or data protection authority.

We may need to verify your identity before completing a privacy request. We may also be permitted or required to retain or continue processing certain information under applicable law.

Where Trellis processes information solely on behalf of a business customer, we may direct your request to that customer or assist the customer in responding to the request, as required by applicable law and the customer agreement.

16. Canadian Privacy

Trellis is committed to complying with applicable Canadian privacy laws. Depending on the circumstances, these may include the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial privacy legislation.

Trellis seeks to follow principles relating to accountability, identifying purposes, meaningful consent where required, limiting collection, limiting use and disclosure, retention, accuracy, safeguards, openness, access and complaint handling.

If you have a privacy concern or wish to exercise a privacy right, contact us at [email protected]. We will handle requests and complaints in accordance with applicable law.

17. U.S. State Privacy Rights

Depending on your state of residence and whether the applicable law applies to Trellis, you may have additional rights relating to your Personal Information, including rights to access, correct, delete, obtain a portable copy of information, opt out of certain forms of targeted advertising or other processing, and appeal certain decisions.

Trellis does not knowingly sell Personal Information for monetary consideration. Where a jurisdiction defines "sale," "sharing," targeted advertising or similar concepts more broadly, Trellis will comply with applicable requirements and provide any required notices and opt-out mechanisms.

18. Children's Privacy

The Trellis Services are intended for businesses and professional users and are not directed to children under the age of 13. Trellis does not knowingly collect Personal Information directly from children under 13 through the Services. If we learn that we have collected Personal Information from a child in circumstances where collection is not permitted, we will take reasonable steps to delete it.

Where a different minimum age applies under local law, Trellis will comply with applicable requirements.

19. Third-Party Websites and Services

Our websites and Services may contain links to or integrations with third-party websites, applications and services. Their privacy practices are governed by their own policies, not this Privacy Policy.

When you connect a third-party account to Trellis, you authorize Trellis to access information made available through that service according to the permissions and configuration you select. We encourage you to review the privacy policies and terms of those third parties.

20. Data Accuracy

We seek to maintain Personal Information that is accurate, complete and current for the purposes for which it is used. You may request correction of Personal Information as described in the "Your Privacy Rights" section.

Customers are responsible for the accuracy of Customer Data they provide to Trellis and for maintaining appropriate permissions for connected third-party accounts.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, business practices, technology, applicable law or other circumstances.

When we make changes, we will update the "Last Updated" date. Where required by law, we will provide additional notice or obtain consent. We encourage you to review this Privacy Policy periodically.

22. Contact Us and Privacy Complaints

If you have questions about this Privacy Policy, wish to exercise a privacy right, or have a privacy complaint, please contact:

Trellis CorporationEmail: [email protected]

We will investigate and respond to privacy inquiries and complaints in accordance with applicable law. Where applicable, you may also have the right to contact the privacy or data protection authority in your jurisdiction.

23. Related Privacy Resources

Trellis may provide additional privacy documentation to complement this Privacy Policy, including:

• Cookie Policy;
• Data Processing Addendum (DPA);
• Subprocessor List;
• Security or Trust Center information; and
• Jurisdiction-specific privacy notices.

Where a separate notice or agreement applies to a particular service, the applicable notice or agreement will govern to the extent of any conflict.

‍

‍