Trimio, Inc. ("Trimio", "we", "us", or "our") is a Delaware corporation that operates the Trimio AI inference optimization platform at trimio.ai. This Privacy Policy describes how we collect, use, disclose, and retain information when you visit or interact with our website or use our service.
Questions? Contact us at privacy@trimio.ai. For questions about how we process data on behalf of our business customers, see our Data Processing Addendum. For our security posture, see trimio.ai/security. To opt out of advertising and visitor identification, see Your Privacy Choices.
Trimio, Inc. is a corporation organized under Delaware law. We operate the Trimio AI inference optimization platform at trimio.ai.
For privacy questions, contact us at:
This Privacy Policy describes how Trimio collects, uses, discloses, and retains information when you:
This Policy applies to visitors to our Site and to users of the Trimio Service. It does not govern the data that our business customers ("Customers") choose to route through the Trimio proxy — that is governed by the agreement between Trimio and each Customer, and by the Customer's own privacy policies toward their end users.
We are a B2B SaaS company. Our direct users are businesses and their authorized personnel — not individual consumers. We do not knowingly collect data from children under 13.
Accounts and registration: Name, work email address, company name, job title, and password (hashed; we never store plaintext passwords).
Communications: Content of emails, support tickets, or other communications you send to us.
Demo and sales inquiries: Information submitted through demo booking forms (name, company, email, estimated AI spend).
Log data (Site and Service): IP address, browser type and version, operating system, pages visited, referrer URL, time and date of visit, clicks, scroll depth, and session duration.
Cookie, pixel and device identifiers (Site): Identifiers set or read by the analytics, CRM, visitor-identification and advertising technologies described in Section 4 and in our Cookie Policy, together with the pages you view, the ads or links that brought you to the Site, and actions such as starting or submitting a signup form.
Usage data (Service): API request metadata including model called, provider, token counts, latency, cost, routing decisions, virtual key identifier, and customer-assigned tags. Admin UI actions including configuration changes, team management, and virtual key creation/revocation.
Prompt and response bodies: Not collected by default. Customers must explicitly enable prompt/response body logging via the per-organization log_bodies setting in the Trimio Admin UI. When enabled, bodies are retained for the customer-configured retention period (default 90 days). Customers control this setting and their end users' exposure to it.
Identity providers (Google Workspace, Microsoft Entra ID): When you authenticate via SSO, we receive your name and work email from the identity provider. We do not receive your IdP password.
Payment processors: We receive transaction confirmations and last-four-digits of payment cards from our payment processor. Full card numbers are not transmitted to or stored by Trimio.
Visitor-identification services: When you visit the Site, third-party B2B visitor-identification services may match your visit to company information (such as company name, domain, industry and size) and to professional, business-contact profile information (such as your name, job title, company, business email address and LinkedIn profile URL). These services obtain this profile information from their own sources, not only from your visit to our Site. See Section 4.1.
Advertising networks: Advertising networks we use, or may use, send us reports about how our ads perform and which ads led to visits or signups. These reports are generally aggregated.
We use cookies and similar tracking technologies on trimio.ai. See our Cookie Policy for full details. A summary:
| Technology | Provider | Purpose | Type |
|---|---|---|---|
| Google Analytics 4 (GA4) | Google LLC | Site traffic analytics (pageviews, session duration, referrers); where linked to Google Ads, also advertising audiences | Analytics |
| HubSpot | HubSpot, Inc. | CRM integration, form tracking, demo lead capture | Marketing/CRM |
| B2B visitor-identification services | Third-party visitor-identification providers | Matches business visitors to company and professional contact information for sales and marketing outreach and company-level advertising audiences | Marketing/visitor identification |
| Google Ads audiences (via GA4 and Google signals), LinkedIn Insight Tag, Meta Pixel, Reddit Pixel | Google LLC, LinkedIn, Meta, Reddit | Retargeting ads to Site visitors on those networks, measuring conversions, and excluding people who have already signed up (used, or may be used) | Advertising |
| Session cookies | Trimio | Keep you logged in to the Admin UI | Strictly necessary |
| CSRF cookies | Trimio | Security (cross-site request forgery protection) | Strictly necessary |
| Consent cookie | CookieYes (our consent-management provider) | Remembers your cookie choices and opt-outs | Strictly necessary |
Do Not Track (DNT): We do not currently alter our data collection practices in response to browser DNT signals. If a uniform standard is established, we will revisit this position.
Opt-out: You can opt out of GA4 analytics via the Google Analytics Opt-out Browser Add-on. For advertising and visitor identification, see Your Privacy Choices.
We use third-party B2B visitor-identification services on the Site. They use cookies and similar technologies to collect your IP address, cookie and device identifiers, browser information, and the pages you view, and match them to the company and professional contact information described in Section 3.3. One service identifies only the company associated with your visit (for example, from your IP address). Another may also identify you individually; it loads only for visitors in the United States. We use the results to:
We never upload individual visitors' email addresses or other contact details obtained from these services to any advertising platform.
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or online profiles. We (or service providers on our behalf) may then send communications and marketing to these emails or profiles. You may opt out of receiving this advertising by visiting app.retention.com/optout. These services act as independent businesses (controllers) for the data they collect through our Site and may use it in their own databases and services under their own privacy policies; this may be a "sale" of personal information under some US state laws (see Section 6).
In the European Economic Area, the United Kingdom and Switzerland, the company-identification service does not load unless you accept advertising cookies, and the individual-identification service does not load at all. Elsewhere they load by default, and you can opt out at any time as described in Your Privacy Choices; they do not load in a browser that sends a Global Privacy Control signal.
We use, or may use, advertising technologies from Google (Google Ads audiences through Google Analytics 4 and Google signals), LinkedIn (Insight Tag and Conversions API), Meta (Pixel and Conversions API) and Reddit (Pixel and Conversions API). These technologies let the advertising network recognize your browser or device on other websites and apps, so that we can show Trimio ads to people who visited the Site, measure whether those ads lead to signups, and stop showing ads to people who have already signed up. This is "cross-context behavioral advertising" under California law and "targeted advertising" under other US state laws. The technologies, their purposes, durations and opt-out links are listed in our Cookie Policy.
Where the law requires your consent (for example, in the European Economic Area, the United Kingdom and Switzerland), we do not activate these advertising technologies unless you have consented, and you can withdraw consent at any time. Elsewhere, you can opt out at any time as described in Your Privacy Choices. Our cookie banner records these choices; you can change them at any time through Cookie settings.
We never place advertising technologies inside the Trimio Service or on the account-verification page, and we do not share Customer Data (including prompt and response bodies) with advertising networks.
When you verify a new Trimio account, we may send the advertising networks listed above a one-way hashed (SHA-256) copy of your email address, together with the fact and time of your signup and an event identifier. The networks use this to match the signup to an ad you saw, to measure our ads, and to exclude you from further ads. We send it only if you consented to advertising cookies (or, where consent is not required, had not opted out, including through Global Privacy Control) when you signed up.
| Purpose | Lawful basis (where GDPR applies) |
|---|---|
| Providing and operating the Service | Performance of contract |
| Processing payments and managing accounts | Performance of contract |
| Customer support and responding to inquiries | Legitimate interest / performance of contract |
| Transactional emails (alerts, receipts, account notices) | Performance of contract |
| Security: fraud detection, abuse prevention, audit logging | Legitimate interest |
| Analytics: understanding how the Site and Service are used | Consent for analytics cookies on the Site for visitors in the EEA, UK and Switzerland (until you consent, Google Analytics receives only cookieless, aggregate signals); otherwise legitimate interest |
| Visitor identification and B2B sales and marketing outreach | Consent for visitors in the EEA, UK and Switzerland; otherwise legitimate interest in promoting our Service to businesses |
| Advertising: retargeting, ad measurement, conversion sharing and audience exclusion | Consent |
| Marketing: product updates and news to existing customers | Legitimate interest (with opt-out) |
| Legal compliance: meeting obligations under applicable law | Legal obligation |
We do not use Customer Data (including prompt and response bodies) to train AI models, sell to third parties, or for any purpose other than delivering the Service.
Subprocessors: We use third-party vendors to help deliver the Service. These vendors are listed on our Trust Center and are contractually required to protect your information and use it only for the purpose we specify.
Site analytics, CRM and visitor-identification providers: We disclose Site usage data, cookie identifiers and IP addresses to our analytics provider (Google), our CRM provider (HubSpot) and our B2B visitor-identification services so they can provide their services to us. The visitor-identification services also supply us with the company and contact information described in Section 3.3.
Advertising networks: We disclose, or may disclose, cookie and device identifiers, IP addresses, pages viewed, ad-interaction and conversion events, and (with consent) hashed email addresses of verified signups to Google, LinkedIn, Meta and Reddit for the advertising purposes described in Section 4.2 and 4.3. We may also upload lists of company names to LinkedIn for company-level advertising audiences. These networks may use the information in accordance with their own privacy policies.
Business transfers: If Trimio is acquired, merges, or undergoes a similar transaction, customer information may be transferred as part of that transaction. We will notify affected customers before their information is transferred and becomes subject to a different privacy policy.
Legal requirements: We may disclose information if required by law, subpoena, court order, or valid government request, or to protect the safety, rights, or property of Trimio, our customers, or the public.
With your consent: We may share information for other purposes with your explicit consent.
Sale and sharing: We do not sell personal information for money. However, our use of advertising technologies on the Site is "sharing" for cross-context behavioral advertising under California law, and may be a "sale" or "targeted advertising" under California and other US state laws. Our disclosures to the B2B visitor-identification services described in Section 4.1, which may use Site data in their own databases, may also be a "sale". You can opt out at any time; see Your Privacy Choices. We do not knowingly sell or share the personal information of consumers under 16.
California residents have additional rights under the CCPA/CPRA: the right to know what personal information we collect, use, disclose, sell and share about you; the right to request deletion; the right to correct inaccurate personal information; the right to limit the use of sensitive personal information (we do not use sensitive personal information for purposes that require this right); the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising these rights. To submit a CCPA request, email privacy@trimio.ai with the subject line "CCPA Privacy Request." You may use an authorized agent; we may ask you or your agent to verify your identity before we respond.
Categories we sell or share: We sell or share, or may sell or share, the following categories of personal information with the advertising networks listed in Section 4.2 and the B2B visitor-identification services described in Section 4.1: identifiers (cookie and device identifiers, IP address, and, for advertising networks and with consent, hashed email addresses of verified signups); internet or other electronic network activity information (pages viewed, browser information, and ad and conversion events); and approximate geolocation derived from IP address. We do not sell or share Customer Data (including prompt and response bodies).
In the preceding 12 months, we sold or shared identifiers, internet or other electronic network activity information and approximate geolocation of Site visitors with (a) B2B visitor-identification services, and (b) Google, through a link between Google Analytics and Google Ads that let Google Ads use Site-visitor audiences for advertising (in place from May 27, 2026 to October 21, 2026, when we turned off its advertising personalization).
Residents of other US states with comprehensive consumer privacy laws may have similar rights under those laws, including the rights to access, correct and delete personal information, to obtain a copy of it, and to opt out of targeted advertising and the sale of personal information. To exercise these rights, email privacy@trimio.ai with the subject line "Privacy Request"; you may use an authorized agent where your state's law allows it. We will respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell you.
Appeals: If we decline to act on your request, you may appeal by replying to our decision or emailing privacy@trimio.ai with the subject line "Privacy Request Appeal" within a reasonable time (we will accept appeals made within 60 days of our decision). We will respond in writing within 60 days, explaining what we did and why. If we deny your appeal, you may contact your state's Attorney General.
EU and UK residents have rights under the GDPR including: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing (including the absolute right to object to direct marketing), withdrawal of consent at any time where we rely on consent (without affecting processing before withdrawal), and rights related to automated decision-making. To exercise these rights, email privacy@trimio.ai. We will respond within 30 days. If you believe we have violated your rights, you have the right to lodge a complaint with your local supervisory authority.
You can opt out of advertising, of the sale or sharing of your personal information, and of visitor identification in any of these ways:
Cookie-based opt-outs apply to the browser and device you use; if you clear your cookies or use another browser, you may need to opt out again.
| Data type | Retention period |
|---|---|
| Account and profile information | Duration of account + 90 days after deletion request |
| API request metadata (model, tokens, cost, latency) | Duration of subscription + up to 12 months |
| Prompt/response bodies (if body logging is enabled) | Customer-configured TTL (default: 90 days) |
| Billing and payment records | 7 years (US tax law requirements) |
| Security and audit logs | 90 days (application logs); 12 months (privileged audit log) |
| Marketing contact data | Until opt-out or 3 years of inactivity |
| Visitor-identification records (company and professional contact information matched to Site visits) | Up to 2 years from the matched Site visit, or until you opt out, whichever is sooner |
| Advertising cookies and audience membership | Cookie lifetimes as listed in our Cookie Policy; audience membership expires on the schedule we set in each network, generally no longer than 180 days |
| Advertising consent state recorded at signup | Duration of account + 90 days after deletion request |
| Backup data | Up to 210 days |
We implement technical and organizational measures to protect the information we hold:
No security system is impenetrable. In the event of a data breach affecting your information, we will notify you without undue delay and in accordance with applicable law.
Trimio is based in the United States. Our services are hosted on Google Cloud Platform in the US (us-central1). If you are located outside the US, your information may be transferred to and processed in the US. The analytics, CRM, visitor-identification and advertising providers described in Section 4 may also process Site data in the US and other countries. Google, HubSpot, LinkedIn, Reddit and one of our visitor-identification services are certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework; Meta is certified under the EU-U.S. and Swiss-U.S. frameworks. Where a provider's certification does not cover a transfer, it relies on Standard Contractual Clauses (and, for the UK, the UK Addendum) where the provider offers them. One visitor-identification service is not certified and does not offer these safeguards; it does not load for visitors outside the United States.
For EU and UK customers, Trimio offers a Data Processing Addendum (DPA) incorporating Standard Contractual Clauses (SCCs) and the UK IDTA. See trimio.ai/dpa.
The Site may link to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party site you visit.
We may update this Privacy Policy from time to time. We will notify registered users via email and post the updated policy at trimio.ai/privacy with a new "Last Updated" date. Continued use of the Service after the effective date of a material change constitutes acceptance of the updated Policy.
For privacy questions, requests, or complaints:
We will respond to all privacy inquiries within 30 days.