Privacy Policy

This Privacy Policy explains how TrustProto AI OS (“TrustProto”, “we”, “us” or “our”) collects, uses, stores, analyses and shares personal information when you use TrustProto.

TrustProto is designed as a trust infrastructure platform providing identity, verification, reputation, trust scoring, AI analysis, audit and marketplace services.

Because some TrustProto services may involve identity documents, professional credentials, employment information, wallet information and reputation-related data, we take privacy and security seriously.

The organisation legally responsible for personal information processed through TrustProto is:

• Legal entity: MIND 2 HEART
• Registered address: London, United Kingdom
• Privacy email: trustproto@gmail.com

If different TrustProto entities act as controllers for particular services, the relevant entity will be identified at the point of collection or in applicable service documentation.

Depending on how you use TrustProto, we may collect:

Identity Information

• name;
• date of birth;
• nationality where necessary;
• photograph;
• identification numbers where legally necessary;
• identity verification results;
• document information; and
• verification status.

Contact Information

• email address;
• telephone number;
• postal address;
• country;
• professional contact information.

Credentials

You may provide:

• passports;
• driving licences;
• professional licences;
• education credentials;
• employment credentials;
• professional certifications;
• insurance credentials; and
• other evidence.

We do not necessarily need to retain the complete underlying document where verification can be completed using a verification result or other appropriate evidence.

Professional Information

• job title;
• employment history;
• company information;
• skills;
• professional reputation;
• qualifications;
• work history;
• Marketplace information.

Blockchain Information

Where you connect or provide a blockchain wallet, we may process:

• wallet addresses;
• blockchain transactions;
• token and asset information;
• smart-contract interactions;
• transaction history;
• blockchain reputation indicators; and
• related analytical information.

Blockchain information may be publicly available and may be permanently recorded on the relevant blockchain.

Trust and Reputation Information

We may process information used to establish TrustProto trust indicators, including:

• verification results;
• endorsements;
• professional information;
• business information;
• contract history;
• cybersecurity indicators;
• wallet information;
• community information;
• publicly available information;
• AI analysis;
• risk indicators;
• evidence sources;
• confidence measures; and
• user-provided information.

AI Agent Information

Where you register an AI agent, we may process:

• agent name;
• creator or operator information;
• model information;
• cryptographic identifiers;
• permissions;
• configuration;
• audit events;
• task information;
• reputation;
• wallet information;
• performance information; and
• related metadata.

Some information associated with identity verification may constitute particularly sensitive personal information under applicable law.

TrustProto will only process special-category information where an appropriate legal basis and additional condition exists.

We aim to minimise the amount of sensitive information retained and may use verification providers so that TrustProto receives a verification result rather than unnecessarily retaining the underlying document.

We may use personal information to:

• create and manage accounts;
• provide Trust ID services;
• verify identity and credentials;
• maintain credential records;
• calculate or display Trust Scores;
• analyse risk;
• provide AI Trust Engine functionality;
• detect fraud and abuse;
• analyse blockchain activity;
• operate the Marketplace;
• facilitate trust relationships;
• maintain audit trails;
• manage permissions;
• provide customer support;
• communicate with users;
• secure the Platform;
• improve Platform functionality;
• comply with legal obligations;
• establish or defend legal claims; and
• protect TrustProto, users and third parties.

Depending on the activity, TrustProto may rely on one or more lawful bases, including:

• performance of a contract;
• compliance with legal obligations;
• legitimate interests;
• consent;
• protection of vital interests where applicable; and
• other lawful bases recognised by applicable data-protection law.

Where consent is used, you may withdraw it subject to legal and operational limitations.

TrustProto may use personal information to create trust-related profiles and scores.

These may be generated using combinations of verified evidence, user information, public information, blockchain information, third-party verification and automated analysis.

The purpose is to provide users with a structured representation of available trust evidence.

A Trust Score is not intended to represent a person's intrinsic worth or character.

Trust Scores should not be used to make unlawful discriminatory decisions.

TrustProto may use automated systems, including AI, for analysis, classification, risk assessment and scoring.

Where applicable data-protection law provides rights concerning solely automated decisions that have legal or similarly significant effects, TrustProto will implement appropriate safeguards.

These may include:

• information about the decision-making process;
• access to relevant information;
• mechanisms for challenging results;
• human review where legally required;
• correction of inaccurate information; and
• appropriate technical and organisational safeguards.

TrustProto will not rely solely on automated processing where prohibited by applicable law.

AI systems may analyse information supplied to or accessible through TrustProto.

AI systems can make errors.

AI outputs are therefore subject to appropriate limitations, controls and human oversight where required.

Where an AI service is supplied by a third party, relevant information may be processed by that provider in accordance with the applicable contractual and privacy arrangements.

Information may come from:

• you;
• your employer;
• educational institutions;
• professional bodies;
• verification providers;
• business partners;
• public registers;
• public websites;
• blockchain networks;
• Marketplace participants;
• other users;
• AI systems; and
• other lawful sources.

Where information is obtained indirectly, TrustProto will provide appropriate privacy information as required by applicable law.

We may share personal information with:

• identity verification providers;
• cloud infrastructure providers;
• cybersecurity providers;
• AI service providers;
• blockchain analytics providers;
• professional verification providers;
• payment providers;
• communications providers;
• hosting providers;
• legal and professional advisers;
• regulators and public authorities where legally required;
• Marketplace participants where the user has authorised disclosure; and
• other processors and service providers necessary to operate TrustProto.

We do not sell personal information merely because it is available through TrustProto.

TrustProto may provide different visibility settings. Information may be:

• private;
• visible only to the user;
• shared with a specific person or organisation;
• visible to verified members; or
• publicly displayed.

Users are responsible for checking sharing settings before publishing information.

Certain information, particularly blockchain information, may already be public outside TrustProto and may not be capable of being removed from the underlying blockchain.

Some TrustProto providers may process information outside the United Kingdom.

Where a restricted international transfer occurs, TrustProto will use an appropriate lawful transfer mechanism where required.

This may include adequacy regulations, appropriate safeguards or another lawful mechanism.

TrustProto uses appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure;
• misuse; and
• other unlawful processing.

No internet-based system can be guaranteed to be completely secure.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required by law.

Retention periods may vary depending on:

• the type of information;
• the purpose;
• account status;
• verification requirements;
• fraud prevention;
• legal obligations;
• dispute resolution;
• security requirements; and
• contractual obligations.

We will maintain appropriate retention and deletion procedures.

Depending on applicable law, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability;
• withdrawal of consent;
• rights concerning automated decision-making; and
• the right to complain to a data protection regulator.

Some rights are subject to legal exceptions.

If you believe information used in your Trust ID, Trust Score or profile is inaccurate, you may request correction.

We may request evidence supporting the correction.

Where information originates from a third party, TrustProto may need to contact or rely on that source to validate the correction.

You may request closure of your account.

Closing an account does not necessarily remove:

• information required by law;
• information necessary for fraud prevention;
• information required for legal claims;
• records required for security;
• information stored on public blockchains; or
• information lawfully shared with third parties before deletion.

Where appropriate, information will be deleted, anonymised or restricted.

TrustProto may use cookies and similar technologies for:

• authentication;
• security;
• functionality;
• analytics;
• performance; and
• preferences.

Where required, TrustProto will obtain appropriate consent before using non-essential cookies.

TrustProto is not intended to collect sensitive identity and reputation information from children unless the relevant service has been specifically designed and legally authorised for that purpose.

If we learn that personal information has been collected unlawfully from a child, we will take appropriate action.

TrustProto maintains procedures for detecting, assessing and responding to personal-data incidents.

Where required by law, TrustProto will notify the relevant regulator and/or affected individuals.

Privacy concerns should be submitted to trustproto@gmail.com.

If you are dissatisfied with our response, you may have the right to complain to the UK Information Commissioner's Office or another competent supervisory authority.

We may update this Privacy Policy to reflect:

• changes to TrustProto;
• changes to law;
• new technology;
• new processing activities; or
• improvements to our privacy practices.

Material changes will be communicated appropriately.