T-Frame Privacy Notice

T-Frame checks communications the moment before you click, pay, or share personal data with others. It works in your browser, checking digital interactions in seconds and providing a clear fraud risk assessment with reasons in plain language.

T-Frame checks the following communications:

• If you use the T-Frame browser extension: Gmail communications and WhatsApp Web communications accessed via web browser interfaces; any text, including link or page address, that you explicitly select for checking (via the right-click "Check with T-Frame" action) or paste into the extension.
• If you use the T-Frame check service on trusterity.io: Only the specific text that you paste into the form is checked.

T-Frame services do not engage in automated decision-making. They provide only informational fraud risk assessments. Any final decision or action regarding a communication remains the responsibility of the service user.

We collect and use the following information to provide T-Frame services, including the operation of user accounts (if applicable):

• Checked communications, including any text that you select for checking, as specified in the section Which communications T-Frame checks;
• Usage data, including your IP address, the T-Frame fraud risk assessment, and information about how you interact with and use T-Frame services;
• Account information, including your full name, email address, credentials, and authentication tokens stored locally within your browser (if you have a user account).

We collect and use the following information for T-Frame browser extension testing:

• Your email address.

We collect and use the following information for marketing communications:

• Your full name and email address.

We may also use any of the personal data specified above, except checked communications, to comply with applicable laws, or to establish, exercise, or defend legal claims.

First-party personal data

We collect personal data from service users when they use T-Frame services. This notice refers to this data as "first-party personal data".

Our legal basis for collecting and using your personal data to provide T-Frame services to you is:

• Contract – we collect and use this data so we can enter into and carry out a contract with you, including providing T-Frame services.

Our legal basis for collecting and using your personal data for T-Frame browser extension testing:

• Consent – we collect and use this data only after receiving your permission. You have the right to withdraw your consent at any time.

Our legal basis for collecting and using your personal data for marketing communications is:

• Consent – we collect and use this data only after receiving your permission. You have the right to withdraw your consent at any time.

Third-party personal data

T-Frame services check communications as specified in the section Which communications T-Frame checks. These communications may contain the personal data of individuals other than the service user. This notice refers to this data as "third-party personal data". We process this data solely to assist T-Frame service users in detecting fraudulent content and provide T-Frame services.

Our legal basis for collecting and using third-party personal data is:

• Legitimate interests – we collect and use this data because it benefits our company and assists T-Frame service users in preventing fraud. We balance this processing against third-party privacy by ensuring that all third-party personal data is processed in real-time and deleted instantaneously upon delivery of the fraud risk assessment to the service user. Our legitimate interest is to provide T-Frame services; the legitimate interest of T-Frame service users is to detect fraudulent content in their checked communications.

Since we receive third-party personal data from our service users, rather than from the third parties themselves, providing a privacy notice to each third party whose personal data is contained in a checked communication would be impossible or involve a disproportionate effort, and would compromise the core fraud-prevention objective of T-Frame services. Where the General Data Protection Regulation (whether the EU General Data Protection Regulation or the UK General Data Protection Regulation, collectively referred to in this notice as the "GDPR") applies, we rely on the exemption provided under EU GDPR Article 14(5)(b) or UK GDPR Article 14(5)(e) and (f).

Compliance and legal claims

We may also process and share personal data with public authorities, regulatory bodies, and law enforcement where it is required by applicable law or necessary to protect our company, assets, legal rights, and service users, enforce the T-Frame Terms of Service, and prevent fraud. Our legal bases for this processing are:

• Legal obligation – where processing is necessary to comply with a statutory or regulatory obligation under the laws of the legal framework governing the processing of your personal data (such as EU or EEA Member State law for EU users or UK law for UK users);
• Legitimate interests – where processing is necessary to comply with legal requests or statutory requirements from jurisdictions outside the legal framework governing the processing of your personal data, to protect our company, assets, and service users, enforce the T-Frame Terms of Service, establish, exercise, or defend legal claims.

The specific legal basis we rely on may affect your GDPR data protection rights, which are set out in brief below in the section Data protection rights under the GDPR (applicable only to individuals in the EEA and UK).

First-party personal data: We collect your personal data from you when you use T-Frame services.

Third-party personal data: T-Frame service users provide this data to us incidentally when it is present within the communications checked by T-Frame services.

We keep personal data to provide T-Frame services for the following periods:

• Communications checked by T-Frame services: Retained only until a T-Frame fraud risk assessment is provided to the service user;
• Usage data: Retained for 24 hours, with the exception of the T-Frame fraud risk assessment, which is automatically anonymized immediately after providing it to the service user;
• Account information except authentication tokens: Retained for as long as your account is active. Please note that we automatically deactivate user accounts if they have not been used for more than 1 year. Upon deactivation, your account information is permanently deleted, while high-level usage metrics may be fully anonymized for statistical purposes. Authentication tokens stored locally within your browser expire automatically based on their token lifetime (TTL) or are deleted when you log out, clear your browser storage, or uninstall the T-Frame extension.

We keep your personal data for T-Frame browser extension testing for the testing phase or until you withdraw your consent, in which case your data will be deleted without undue delay. Please note that any fully anonymized testing results and performance metrics may be retained for analytical and product development purposes.

We keep your personal data for marketing communications for a period of 2 years, which starts anew with each subsequent active interaction you have with us, or until you withdraw your consent, in which case such data will be deleted without undue delay. Examples of active interactions include submitting a form on trusterity.io, registering for or participating in our webinars or events, logging into your account, and communicating directly with our sales or support teams.

Notwithstanding the retention periods specified above, we may retain any of your personal data, except checked communications, for a longer period if necessary to comply with a legal obligation, resolve disputes, or establish, exercise, or defend ongoing legal claims. In such cases, the data will be retained until the relevant legal matter is fully resolved.

We implement appropriate technical and organizational measures to protect your data. All data transmissions are encrypted using modern cryptographic protocols (including HTTPS/TLS).

The use of information processed by the T-Frame browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

To evaluate communications and provide real-time fraud risk assessments, T-Frame utilizes automated artificial intelligence (AI) models. These models may be hosted and operated by us or provided by specialized enterprise third-party vendors.

Data Protection & Zero Retention Architecture

The AI infrastructure employed by T-Frame is strictly configured to operate on a "stateless" or transient basis. This means that:

• No Data Retention: Inputs (checked communications) and outputs (risk assessments) are processed transiently in volatile memory (in-memory execution) solely to generate the immediate response. Neither we nor our third-party vendors store, log, or cache your checked communications after the assessment is delivered.
• No AI Model Training: Your checked communications and personal data are never used by us or our third-party vendors to train, retrain, or improve any public or proprietary AI models.

Human Control & Non-Automated Decision Making

As highlighted throughout this Privacy Notice, T-Frame services do not engage in automated decision-making and provide only informational fraud risk assessments. Any final decision or action regarding a communication remains the responsibility of the service user.

Practical Limitations on Exercising Data Subject Rights

Because checked communications are processed instantaneously and immediately purged from volatile memory without being written to permanent storage, we do not maintain an identifiable database of checked communications. Consequently, we are practically unable to fulfill data subject rights requests in relation to the content of checked communications, unless you provide additional, conclusive technical information linking you to a specific, isolated processing event.

If you are in the European Economic Area (EEA) or in the United Kingdom, you have the following data protection rights:

The right to request access to your personal data

You have the right to obtain from us (i) confirmation as to whether or not your personal data is being processed, (ii) where that is the case, access to the personal data, and (iii) information about the processing itself.

This also enables you to receive a copy of your personal data we hold.

You can exercise this right by contacting us.

The right to request correction (rectification) of your personal data

You have the right to request that we correct your personal data we hold if it is incomplete or inaccurate.

You can exercise this right in your account or by contacting us.

The right to request deletion (erasure) of your personal data

You have the right to ask us to delete your personal data:

• if it is no longer necessary for the purposes for which it was collected;
• if you withdraw your consent, and the processing has no other legal basis;
• if you successfully object to its processing based on legitimate interests;
• if we have to delete your personal data due to a legal obligation;
• if your personal data has been unlawfully processed.

You can exercise this right by contacting us.

The right to restriction of processing of your personal data

You have the right to request that we limit the processing of your personal data:

• if you dispute its accuracy;
• if the processing is unlawful, and you request restriction of use instead of deletion;
• if we no longer need it, but you require it to exercise a legal claim.

You can request restriction of processing of your personal data we hold by contacting us.

We restrict the processing of your personal data if you have exercised the right to object. The restriction applies for the time necessary to verify whether our legitimate reasons prevail over your legitimate reasons.

Where processing has been restricted, we have the rights:

• To store such personal data;
• To process such personal data otherwise:
  • with your consent, or
  • for the establishment, exercise, or defense of legal claims, or
  • for the protection of the rights of another natural or legal person, or
  • for reasons of important public interest (of the EU, an EEA Member State, or generally as recognized under applicable law).

The right to request the transfer of your personal data

We will provide your personal data to you or a designated third-party in a structured, commonly used, machine-readable format.

Please note that this right only applies if we use your personal data based on your consent or a contract with you.

You can request the transfer of your personal data we hold by contacting us.

The right to object to the processing of your personal data

If we rely on legitimate interests as the legal basis for our processing, you have the right to object to the processing on grounds relating to your particular situation.

We will restrict the processing for the time necessary to verify whether the legitimate reasons pursued by us prevail over your legitimate reasons.

You can object to the processing of your personal data by contacting us.

The right to withdraw your consent

You have the right to withdraw your consent to the processing of your personal data at any time without affecting the lawfulness of processing based on your consent before its withdrawal.

You can withdraw your consent to the processing of your personal data for marketing communications or T-Frame browser extension testing by going to your account settings or by following the unsubscribe link or instructions provided in any email we send. In this case, we will delete your data processed based on your consent without undue delay.

The right to lodge a complaint with a supervisory authority

You have the right to complain to a data protection authority, particularly in the state of your residence, place of work, or the place of the alleged infringement, about our collection, use, and other processing of your personal data. To do so, please contact your local data protection authority. Contact information can be found on the website of the European Data Protection Board (for EEA users) or the Information Commissioner's Office (for UK users).

You can find out more about your GDPR data protection rights on the website of the European Data Protection Board (for EU users) or the Information Commissioner's Office (for UK users).

You may exercise your data protection rights by contacting us. Please note that we may ask you to verify your identity before responding to your request. If you make a request, we will respond to you without undue delay and at the latest within one month of receipt.

Please note that the practical exercise of these rights depends on the category of data processed. Because all third-party personal data is processed in real-time and deleted instantaneously upon delivery of the fraud risk assessment to the service user, we do not store any identifying information regarding third-party individuals. Consequently, pursuant to GDPR Article 11, we are unable to fulfill rights requests for third-party individuals unless the requesting individual provides additional information that conclusively links them to a specific, identifiable real-time processing event.

If you are a resident of the United States, depending on your state of residence, applicable state privacy laws may grant you specific rights regarding your personal data.

No Sale or Sharing of Personal Data

We do not "sell" your personal data for monetary or other valuable consideration, nor do we "share" your personal data for cross-context behavioral advertising or targeted advertising purposes, as those terms are defined under applicable US state privacy laws. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

Your privacy rights

Subject to applicable US state privacy laws, you may have the right to:

• Right to Know and Access: You have the right to request confirmation of whether we are processing your personal data, access to it, and information about the categories of data we collect, the categories of sources from which we collect personal data, the purposes for which it is used, the categories of third parties with whom we share it, and the specific pieces of personal data, as well as the right to know what personal data is sold or shared and to whom;
• Right to Delete: You have the right to request the deletion of your personal data;
• Right to Correct: You have the right to request the correction of inaccuracies in your personal data;
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal data and targeted advertising (as noted above, we do not engage in these activities);
• Right to Limit: You have the right to direct us to limit the use and disclosure of your sensitive personal data to purposes strictly necessary to provide T-Frame services (we do not use sensitive data for any other purposes);
• Right to Non-Discrimination: You will not receive discriminatory treatment from us for exercising any of your privacy rights;
• Right to Data Portability: You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.

How to exercise your rights

To exercise any of these rights, please contact us using the contact details at the end of this privacy notice. We will respond to your request within the timeframe required by applicable state law. Please note that we may need to verify your identity before fulfilling your request.

Practical limitations on exercising rights

As detailed in the section Use of Artificial Intelligence Models, T-Frame services operate on a transient basis with zero data retention for checked communications. Because we do not store, log, or cache checked communications or third-party data after delivering the fraud risk assessment, we are practically unable to fulfill rights requests (such as access or deletion) relating directly to the content of those checked communications, unless you provide additional technical information conclusively linking you to a specific, isolated processing event.

We do not sell your personal data. To provide T-Frame services and operate our business, we may share your data with the following categories of third-party recipients:

• Fraud prevention and security analytics partners: Third-party vendors that provide the processing capabilities necessary to evaluate content patterns, analyze communication safety attributes, and assist to detect potential fraudulent content.
• IT infrastructure and cloud hosting providers: Third-party vendors that provide secure cloud servers, database management, and technical infrastructure necessary to run trusterity.io and the browser extension.
• Marketing and customer relationship management (CRM) platforms: Service providers that host our marketing campaigns, newsletter lists, and event registrations (applicable only if you have consented to marketing communications).
• Public authorities and law enforcement: Courts, law enforcement bodies, regulatory or government agencies, tax offices, or other officials, if required by applicable law, or necessary to establish, exercise, or defend legal claims, protect our company and service users, and prevent fraud.

Your information, including personal data, is processed at our offices and in other places where the parties involved in the processing are located. This means that this information may be transferred to and stored on computers outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction.

We will take all reasonable steps to ensure that your personal data is handled securely and in accordance with this privacy notice. No transfer of your personal data to an onward organization or country will occur unless an adequate level of protection is guaranteed.

If you are in the EEA or UK: As Social Links, LLC is located in the United States and offers services to individuals in the EEA and UK, we comply directly with the GDPR. Consequently, while direct collection from you does not constitute an international transfer under GDPR Chapter V, any onward transfers of your personal data to our service providers located outside the EEA (for EEA users) or UK (for UK users), including the United States, are treated as international transfers under GDPR Chapter V. To ensure the safety of your personal data:

• We maintain executed Data Processing Agreements (DPAs) with service providers.
• If we engage a service provider in the USA, we rely on the EU-U.S. Data Privacy Framework (EU-U.S. DPF) or the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF) for service providers participating in the DPF Program. We periodically verify that they hold an active EU-U.S. DPF or UK Extension to the EU-U.S. DPF self-certification covering the relevant personal data. For transfers to U.S. service providers not covered by the EU-U.S. DPF or UK Extension to the EU-U.S. DPF, and to providers in countries outside the EEA or UK for which an authorized authority (the European Commission or the Secretary of State) has not issued a decision on an adequate level of personal data protection, we use Standard Contractual Clauses (SCCs) or the UK equivalent (such as the UK Addendum or International Data Transfer Agreement).

You can find more information about the Standard Contractual Clauses on the European Commission's website, and about the UK transfer mechanisms on the website of the Information Commissioner's Office.

For further information or to obtain a copy of the specific safeguards applied to the transfer of your personal data, please contact us using the contact details at the end of this privacy notice.

T-Frame services are strictly intended for and directed exclusively to adult users (individuals who are at least 18 years old or have reached the age of majority in their jurisdiction). We do not knowingly offer T-Frame services to, or intentionally collect personal data from, children.

If we obtain actual knowledge that we have accidentally collected personal data from a child under the minimum legal age without verifiable parental consent, we will take immediate steps to terminate their access, disable the associated user account, and permanently delete all the data from our systems.

If you become aware that any child has provided us with personal data, please contact us immediately.

While T-Frame services are not directed at children, communications of adult service users checked by T-Frame services may incidentally contain personal data of children as third-party personal data. We process this data based on legitimate interests, as specified in the section Our legal bases for the collection and use of your data. Because all third-party personal data is processed in real-time and deleted instantaneously upon delivery of the fraud risk assessment to the service user, no third-party personal data of children is retained within our systems.

This privacy notice, trusterity.io, and T-Frame services may contain links to third-party websites that are not operated by us. If you click on a third-party link, you will be directed to that website. We strongly advise you to review the privacy policy of every website you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites and services.

We may update this notice from time to time. If we make changes, we will post the updated notice on this page and revise the "Last updated" date at the top.

We recommend checking this privacy notice periodically for updates. Changes become effective immediately upon being posted on this page.

If you have any concerns or complaints about our use of your personal data, you can contact us using the contact details at the end of this notice.

If you remain unsatisfied with our response, you have the right to lodge a complaint with a competent data protection authority. For individuals in the EEA or UK, please see the section The right to lodge a complaint with a supervisory authority.

Social Links, LLC, a Delaware limited liability company

Post: 228 Park Ave S, STE 85451, New York, NY 10003, United States

EU Representative: Social Links NL B.V., Prof. J.H. Bavincklaan 7, 1183AT Amstelveen, The Netherlands

Email: privacy@trusterity.io