Privacy Policy

1. Who we are and what this covers

Elbruz Teknoloji Limited Şirketi, trading as Elbruz Technologies (Elbruz, we, us), publishes Triplo AI. Where we decide why and how personal data is processed, we are the controller of that data.

This policy covers the Triplo AI desktop and mobile applications, the hosted endpoints we operate, the websites at triplo.ai and its subdomains, our documentation and support, and our dealings with customers, partners and business contacts.

It does not cover what a model provider does with a prompt you send it, what an external Hermes gateway or MCP server does, or what a website the Service fetches at your request does. Those are separate controllers with their own policies. It also does not cover personal data we process on behalf of a business customer as a processor — there, that customer's own policy applies and our agreement with them governs.

2. Three things that shape everything below

1. Your content lives on your disk. Prompts, instructions, automations, conversations and knowledge bases are plain files in your Documents folder. We hold no copy of them.
2. We are not a model provider. When you send a prompt it goes to the endpoint you selected. Choose a local model and it goes nowhere.
3. Knowledge search is local. Indexing and retrieval run on your machine with a model bundled in the application, roughly 52 MB, never downloaded at runtime. A knowledge base works on a machine that has never had internet access.

3. What leaves your machine, feature by feature

This is the whole list. Anything not in it does not leave your machine.

It is possible to run the Service with no content leaving your machine at all. The documentation sets out how: a local model, knowledge bases left unenriched, no media, no scraping, device sharing off. Licence validation and update checks still need the network, and neither carries your content.

4. Agents and your data

We do not receive, log or store what an Agent reads, writes or does. A Pi session runs locally and talks to the provider of the model you chose; a Hermes session talks to the gateway you connected to. Our involvement is the application on your machine, nothing more.

Your acceptance of the in-app risk acknowledgement for each Agent is recorded in that installation's own settings, on your machine. It is not sent to us.

5. What we collect, and why

Licence and account data. When you buy, activate or validate a licence we process your licence key, a device fingerprint, your CPU model, your operating-system username, and your platform, plus the name, email address and billing details you or the marketplace gave us. We use this to activate and validate licences, enforce device limits, handle billing and tax, prevent licence abuse and fraud, and provide support. Legal basis: performance of our contract with you, and our legitimate interest in preventing abuse.

Feature calls. When you use enrichment, image or audio processing, or allowance models, the content described in the table above reaches our endpoint for the time it takes to process it, and is returned to you. We do not use it to train models. [VERIFY: state the actual retention at each endpoint — ideally "processed in memory and not retained", if that is true.]

Diagnostics and usage statistics. We collect aggregate statistics about how features are used, along with your time zone, country, dates and times of access, application version, device type and IP address. This is anonymised or aggregated where it can be. We use it to find faults and to decide what to improve. Legal basis: legitimate interest, and your consent where the law requires it. We do not read, process or store your clipboard.

Support. If you contact support we process what you send us, including any Copy Debug Data you attach. Copy Debug Data contains your licence key and an encoded copy of your configuration — send it only to support, and only when asked.

Website and marketing. When you browse triplo.ai, request a trial, subscribe to a list or register for an event, we process the contact details you give us and standard web data — browser, IP address, referrer, pages viewed, links clicked. We use it to reply to you, to send you what you asked for, to measure our marketing, and to keep the site working and secure. Legal basis: your consent for marketing where required, otherwise legitimate interest. You can opt out of marketing at any time.

Business contacts. If you deal with us as a partner, reseller, supplier or investor, we process your business contact details to manage that relationship.

6. Who we share data with

We use service providers who process personal data only on our instructions and under contract: cloud hosting and infrastructure, payment processors and marketplaces, email and support platforms, analytics, CRM and marketing automation, and error and crash reporting. [VERIFY: publish the actual sub-processor list, or link to a page that keeps it current — an EU business customer will ask for it.]

Model providers are independent controllers, not our processors. When you send a prompt to a provider — with your own key or through an allowance model — that provider handles the prompt under its own terms and privacy policy. Read them. The same is true of any Hermes gateway, MCP server or website the Service reaches at your request.

We may disclose data where the law requires it, or where we reasonably need to in order to establish or defend legal claims, investigate fraud or protect someone's safety. Unless we are prohibited from doing so, we will try to tell you first. If we are involved in a merger, acquisition or sale of assets, data may transfer as part of it; we will tell you if that changes anything material for you.

7. International transfers

We are based in Türkiye and use infrastructure in more than one country, so personal data may be transferred outside the country you are in, including outside the European Economic Area, the United Kingdom and Brazil. Where that happens we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses or the equivalent mechanism under the law that applies, together with technical measures such as encryption in transit. [VERIFY: confirm the transfer mechanism actually in place, and where the endpoints and licence service are hosted.]

8. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. In practice: licence and billing records for as long as your licence is active and then for the period tax and accounting law requires; support correspondence for as long as it is useful and then deleted; website and marketing data until you opt out or the data stops being useful; diagnostics in aggregated form. Content sent to a feature endpoint is processed and returned, not retained as a record of you. [VERIFY: replace with the real retention periods once confirmed.]

9. Security

Data in transit between the application and our endpoints is encrypted with TLS. Our macOS builds are signed with an Apple Developer ID and notarised, Windows installers are code-signed, and Linux AppImages are published with a checksum; updates come from the official GitHub Releases feed and are signature-checked before installing. The interface runs with context isolation and no direct Node access.

No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data and the law requires us to tell you, we will.

10. Your rights

Depending on where you live, you can ask us to: confirm whether we process your personal data and give you a copy; correct data that is wrong or incomplete; delete data we no longer have a reason to keep; restrict or object to processing, including profiling and direct marketing; port your data to another provider; withdraw a consent you gave, without affecting what we did before you withdrew it; and know who we transferred your data to.

These rights come from the GDPR in the EEA, the UK GDPR in the United Kingdom, the LGPD in Brazil, the KVKK in Türkiye, and the CCPA and CPRA in California, among others. We do not sell personal data or share it for cross-context behavioural advertising as those laws define it, and we do not discriminate against anyone for exercising a right.

To exercise a right, email privacyrequest@triplo.ai. We reply within the time the applicable law sets — thirty days under the KVKK, one month under the GDPR, extendable where a request is complex. We may need to verify who you are before we act, and an authorised agent acting for you needs to show they are authorised. Requests are free unless they are manifestly unfounded or excessive.

If you are in Türkiye and want to use the formal KVKK application route, you may send a written, signed application to the address in Section 13, or email it to support@triplo.ai, including your name, your Turkish identity number or nationality and passport number, your address for notification, your contact details, and your request stated plainly.

You can also complain to a supervisory authority: in the EEA or the UK, the authority where you live or work; in Türkiye, the Personal Data Protection Authority (KVKK); in Brazil, the ANPD. We would rather you came to us first.

11. Cookies

The desktop application does not use cookies. Our websites use cookies and similar technologies: strictly necessary ones that make the site work, preference cookies that remember choices you made, statistics cookies that tell us how the site is used, and marketing cookies set by third parties. You control the non-essential ones through the cookie banner, and you can delete cookies already stored through your browser's settings. [VERIFY: confirm the cookie banner and the current cookie list for the new site before launch — the 2023 policy pointed at a cookie page that may no longer be accurate.]

We do not respond to Do Not Track browser signals, as there is no common standard for them. Use your browser settings and the cookie banner instead.

12. Children

The Service is not intended for children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacyrequest@triplo.ai and we will delete it.

13. Changes, and how to reach us

We update this policy from time to time. The date at the top says when it last changed, and we will tell you about a material change by email or by a notice in the application before it takes effect.

Elbruz Teknoloji Limited Şirketi, trading as Elbruz Technologies. Abdurrahman Nafiz Gürman Mah., G. Ali Rıza Gürcan Cad., Platform Suit B Blok No: 27/148, Güngören, İstanbul, Türkiye.

Privacy and data protection: privacyrequest@triplo.ai · Support: support@triplo.ai · Legal notices: contract-notices@triplo.ai