TRIOVUS
Data Policy

Data Policy

Last Updated: January 2025

At TRIOVUS, we are committed to protecting your data and maintaining transparency about how we collect, use, store, and delete your information. This Data Policy explains our practices regarding your personal data and the rights you have over it.

Data We Collect

Personal Information:

  • Name, email address, and profile information
  • Payment information (processed securely via Stripe)
  • Shipping addresses for e-commerce transactions
  • User-generated content (posts, videos, products, comments)

Usage Data:

  • Activity logs and engagement metrics
  • Device information and IP addresses
  • Cookies and similar tracking technologies

Integration Data:

  • Data imported from third-party services (e.g., Canva designs, Printful products)
  • OAuth tokens for connected services (stored securely and encrypted)

How We Use Your Data

We use your data to:

  • Provide Services: Enable account creation, authentication, and platform functionality
  • Process Transactions: Facilitate purchases, payments, and order fulfillment
  • Personalize Experience: Deliver personalized content, recommendations, and AI-driven features
  • Communicate: Send transactional emails, notifications, and updates
  • Improve Platform: Analyze usage patterns to enhance features and user experience
  • Security: Detect fraud, abuse, and ensure platform security
  • Legal Compliance: Meet regulatory requirements and enforce our terms

Data Storage & Security

Storage:

  • All data is stored on secure, encrypted databases provided by our Host Platform
  • Data at rest is encrypted using industry-standard algorithms (AES-256)
  • Data in transit is protected using TLS 1.2 or higher
  • Backups are performed regularly and stored in geographically distributed locations

Security Measures:

  • Role-based access control (RBAC) ensures only authorized personnel can access sensitive data
  • API keys and credentials are stored as encrypted secrets, never exposed to frontend code
  • Webhook signatures are verified to ensure data integrity and authenticity
  • All redirect and webhook URLs are owned and controlled by TRIOVUS (triovus.com domain)
  • Regular security audits and vulnerability assessments
  • Automated monitoring and alerting for suspicious activities

Hosting:

TRIOVUS is built on our Host Platform, which uses enterprise-grade cloud infrastructure with automatic scaling, redundancy, and disaster recovery capabilities.

Third-Party Integrations

TRIOVUS integrates with trusted third-party services:

  • Stripe: Payment processing (Stripe handles all credit card data; we never store it)
  • Printful: Print-on-demand fulfillment
  • Canva: Design tool integration
  • Agora: Live streaming infrastructure

OAuth Token Management: When you connect a third-party service (like Canva), we store OAuth access and refresh tokens securely. Upon disconnecting or uninstalling an integration, these tokens are immediately revoked with the third-party service and deleted from our systems.

Data Retention & Deletion

Retention Policy:

  • We retain your personal data only as long as necessary to provide our services and comply with legal obligations
  • User-generated content may be retained after account deletion if required for legal, regulatory, or business purposes (e.g., transaction records)
  • Anonymized or aggregated data may be retained indefinitely for analytics and platform improvement

Account Deletion & Data Removal:

  • When you delete your account or request data deletion, we initiate the removal process immediately
  • Personal data is deleted within 30 days of your request or account termination
  • OAuth tokens for third-party integrations are revoked immediately upon disconnection
  • Backup copies are purged during the next scheduled backup cycle (typically within 30 days)
  • Some data may be retained longer if required by law (e.g., financial records for tax purposes)

Right to Be Forgotten: You have the right to request deletion of your personal data at any time by contacting support@triovus.co.uk. We will process your request within 30 days.

Your Data Rights

You have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your personal data (subject to legal requirements)
  • Portability: Export your data in a machine-readable format
  • Object: Object to certain types of data processing (e.g., marketing)
  • Withdraw Consent: Revoke previously granted permissions at any time

To exercise these rights, contact us at support@triovus.co.uk.

Vulnerability Disclosure Program

At TRIOVUS, we take security seriously and appreciate the contributions of security researchers and ethical hackers who help us protect our users.

Reporting Security Vulnerabilities:

If you discover a security vulnerability in TRIOVUS, we encourage responsible disclosure:

  • Email detailed information about the vulnerability to security@triovus.co.uk
  • Include steps to reproduce the issue and any proof-of-concept code (if applicable)
  • Allow us reasonable time to investigate and address the issue before public disclosure
  • Do not access, modify, or delete user data without explicit permission

Our Commitment:

  • We will acknowledge receipt of your report within 48 hours
  • We will provide regular updates on our progress investigating and addressing the issue
  • We will credit researchers who responsibly disclose vulnerabilities (if desired)
  • We will not pursue legal action against researchers who follow responsible disclosure practices

Bug Bounty Program:

While we currently do not have a formal public bug bounty program, we are evaluating this option for the future. Security researchers who report critical vulnerabilities may be eligible for recognition and rewards on a case-by-case basis.

Scope: Our vulnerability disclosure program covers security issues in the TRIOVUS web application (triovus.com), backend APIs, and infrastructure managed by our Host Platform. It does not cover third-party services we integrate with (e.g., Stripe, Printful).

Security Best Practices

TRIOVUS is designed with security at its core. Our application and integrations incorporate measures to mitigate risks outlined in the OWASP Top 10, including:

  • Broken Access Control: Role-based access control (RBAC) at API gateway level
  • Cryptographic Failures: TLS 1.2+ for data in transit, AES-256 for data at rest
  • Injection Attacks: Parameterized queries and input validation prevent SQL/NoSQL injection
  • Insecure Design: Secure-by-default architecture with least privilege principles
  • Security Misconfiguration: Automated security scanning and secure defaults
  • Vulnerable Components: Regular dependency audits and updates
  • Authentication Failures: Managed authentication system with password hashing and JWTs
  • Data Integrity: Webhook signature verification and database constraints
  • Security Logging: Comprehensive audit logs and real-time monitoring
  • SSRF Prevention: Strict validation of external API requests

Questions or Concerns?

If you have any questions about this Data Policy or how we handle your data, please don't hesitate to reach out:

General Inquiries: info@triovus.co.uk

Data Protection: support@triovus.co.uk

Security Vulnerabilities: security@triovus.co.uk

Policy Updates: We may update this Data Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of significant changes via email or prominent notice on our platform. Your continued use of TRIOVUS after such updates constitutes acceptance of the revised policy.