Legal
Privacy policy
Last updated 8 November 2026. This policy covers the Treval website, the dashboard, the tracking snippet and the Treval AI Analytics connectors for Claude and ChatGPT.
Who we are
Treval is run by Treval, 5830 E 2nd St, Ste 7000 #3998, Casper, Wyoming 82609, United States. Questions and requests go to support@treval.app.
Two kinds of data
Account data is about you, the Treval customer. We decide how it is used. Site analytics data is about the people who visit websites that use Treval. For that data the website owner decides what is collected and why, and we process it on their behalf.
Account data
| What | Why |
|---|---|
| Name, email address, password (stored as a hash) | Signing in, password resets, the Monday brief and alerts you opt into |
| Sites you add, goals, saved questions, alert rules, team invitations | Running the product you set up |
| Plan, billing status and Stripe customer id | Billing. Card details go to Stripe and never reach us. |
| Questions you type into Ask | Answering them. They are sent to Anthropic with the query results needed to write the answer. |
| Connected apps: the app name, when it was connected and last used, and hashes of its access tokens | Letting Claude, ChatGPT or another MCP client read your analytics after you approve it |
Site analytics data
The snippet sets no cookies and uses no local storage. For each page view or event it records:
- the page address, the referring address, UTM tags and the channel and source we derive from them
- country, region and city, looked up from the IP address by our host at request time
- browser, operating system, device type and screen size, derived from the user agent
- custom event names and properties the website owner sends, and order revenue if they connect Stripe or Shopify
- a visitor id: a hash of the IP address, user agent, site and a salt that changes every day. It cannot be reversed, and the same person gets a new id the next day, so visitors cannot be followed across days or across websites.
We never store visitor IP addresses. For requests from bots and AI crawlers we record the user agent, the page requested, the response status, whether the IP falls in the range the bot's vendor publishes (verified, spoofed or unverified) and a keyed hash of the IP used only to count distinct crawler instances.
Claude and ChatGPT connectors
When you connect Treval AI Analytics to Claude or ChatGPT you approve read-only access on a Treval consent screen. After that:
- The assistant can call our tools to read the analytics of sites you own or belong to. It cannot change settings, goals or tracking, delete anything or invite people.
- We receive only the tool calls the assistant makes: the tool name and its arguments, such as the site, the period, a dimension or, in Claude, a read-only SQL query. We do not receive your conversation, your other chats, memory or files.
- We use tool calls only to return the requested numbers. We do not store tool arguments or results, and we do not use them to profile you or for advertising.
- Results go to Anthropic or OpenAI as part of your conversation and are then handled under their policies: Anthropic, OpenAI.
- You can disconnect at any time under Account → Connected apps, or from the assistant's settings. Disconnecting deletes the tokens immediately.
Who processes data for us
| Provider | What for |
|---|---|
| Vercel | Hosting and request geolocation |
| Neon | Database, hosted in Frankfurt, Germany |
| Anthropic | Ask answers, the Monday brief and analyst notes (aggregated analytics and your questions) |
| Resend | Account and report emails |
| Stripe | Payments |
| Sentry | Error reports, when enabled, which can include the request that failed |
We do not sell data, share it for advertising or use customer analytics to train AI models.
How long we keep it
- Site analytics: 30 days on Free, 3 years on Pro and for as long as the account exists on Growth. Older data is deleted every night.
- Account data: until you delete the account. Deleting the account deletes its sites, analytics, connected apps and tokens straight away.
- Authorization codes last ten minutes. Access tokens last one hour and refresh tokens 60 days unless used or revoked sooner.
Your choices and rights
- Export a site's data as CSV from the dashboard, and correct your profile under Account.
- Delete your account under Account, or ask us to.
- Visitors to a website that uses Treval should contact that website first; we will help the owner answer.
- Depending on where you live you may have rights to access, correct, delete, restrict or object to processing and to complain to your data protection authority. Write to support@treval.app and we will reply within 30 days.
Security
Data is encrypted in transit and at rest. Passwords, API tokens and OAuth tokens are stored only as hashes. Connector access is limited per account and read-only, and SQL from the Claude connector runs read-only against one site at a time.
Children
Treval is a tool for website owners and is not meant for anyone under 16.
Changes
We will update the date at the top when this policy changes and email account owners about material changes.