Legal

TrustRouter.ai — Privacy Policy

Effective date: 15 January 2026

This Privacy Policy explains how ENQUIRELINK INC. (“Enquirelink”, “TrustRouter.ai”, “we”, “us”, “our”) collects, uses, discloses, and protects information when you use the TrustRouter.ai platform (developed and operated by Enquirelink), including:

• the TrustRouter.ai API, SDKs, and routing services (the “API”);

• the TrustRouter.ai web interface / admin portal (the “Console” or “Admin Panel”);

• trustrouter.ai and related websites, documentation, and services (collectively, the “Platform”).

If you do not agree with this Privacy Policy, do not use the Platform.

  1. WHO WE ARE (CONTROLLER / OPERATOR)

The TrustRouter.ai Platform is owned and operated by:

ENQUIRELINK INC.

Registered in Ontario, Canada

Email: [email protected]

Website: https://trustrouter.ai (the “Website”)

Role of TrustRouter.ai. We act as a controller for account, billing, and Website usage data. When you use the Platform to route messages or otherwise process recipient phone numbers and message content, we generally process such Customer Data as a “processor” (or “service provider”) on behalf of the customer organization that controls the data. Where applicable, a Data Processing Addendum (“DPA”) may govern the processing of Customer Data.

  1. IMPORTANT PRINCIPLES

2.1 Business messaging routing layer. TrustRouter.ai is a routing and observability layer for business messaging (e.g., SMS, WhatsApp, Viber, RCS) that helps you connect providers, control routing policies, and monitor delivery and risk signals. TrustRouter.ai is not a mobile network operator or telecom carrier.

2.2 Bring‑Your‑Own Providers (BYO) and pricing transparency. You can connect your own messaging providers and keep your negotiated rates. Where we display provider prices or allow you to upload price lists, those prices are shown “as provided” and may change over time.

2.3 Price list sharing is optional and controlled by you. The Platform may allow you to store and share provider price lists and route pricing information within your organization or with other users you authorize (for example, via your personal cabinet / workspace settings). You are responsible for ensuring you have rights and permissions to share any pricing information and that sharing complies with contractual and competition/antitrust obligations.

2.4 Fraud and pumping protection; automated controls. We use automated systems to detect suspicious traffic amplification (e.g., OTP pumping, retry storms) and other abusive patterns. Depending on your configuration, these systems may block, throttle, or flag traffic. These protections are designed to reduce risk but do not guarantee detection of all abuse.

  1. INFORMATION WE COLLECT

We collect information in the following categories. Some data is collected automatically when you use the Platform; other data is collected when you provide it or when it is generated by your usage.

3.1 Account and identity information

• name, email address, company/organization name;

• authentication details (login method, account IDs);

• role and permissions within a workspace.

3.2 Billing and payment information

• billing contact details, invoices, and payment status;

• transaction records and plan selections.

• Payment processing is handled by Stripe (or another payment processor). We do not store full payment card numbers. The payment processor may collect and process payment details according to its own privacy practices.

3.3 Provider, API, and integration information

• API keys you generate for TrustRouter.ai and associated usage logs;

• provider connection details you configure (e.g., provider identifiers, credentials/tokens, sender IDs, webhook URLs, IP allowlists).

We store provider credentials only as needed to provide the integration, and we apply reasonable safeguards (e.g., access controls and encryption where appropriate). You should treat API keys and secrets as confidential and rotate them if compromised.

3.4 Messaging and routing data (Customer Data)

When you send or route messages through the Platform, we may process and store:

• recipient identifiers (e.g., phone numbers), sender identifiers (e.g., sender ID/short code), country/operator metadata;

• message payloads (e.g., SMS text, template IDs, variables, media metadata/URLs where applicable);

• delivery receipts (DLRs), error codes, latency metrics, and provider responses;

• routing decisions, failover events, retry outcomes, and policy configurations;

• fraud/risk signals and anomaly indicators (e.g., pumping patterns, unusual retry storms).

You can often configure logging and retention settings. Certain records may still be retained to support billing, dispute handling, security, and legal compliance.

3.5 Pricing data and price lists

The Platform may allow you to upload, store, or view pricing information such as provider rate cards, route pricing, coverage metadata, and effective dates (“Price Lists”). If you enable sharing, Price Lists may be visible to other users you authorize. You are responsible for ensuring you have the right to upload and share Price Lists and that doing so does not violate confidentiality, contractual, or competition/antitrust obligations.

3.6 Website and Console usage data

• IP address, device/browser information, and log files;

• pages viewed, clicks, session activity, and feature usage;

• cookie and local storage data as described in our Cookie Policy.

3.7 Support and communications

• messages you send to our support team;

• feedback, bug reports, and survey responses (if any).

  1. HOW WE USE INFORMATION

We use information to:

• provide, operate, and secure the Platform (including routing messages, enforcing policies, and showing pricing data);

• authenticate users and administer workspaces/personal cabinets;

• run analytics, reporting, and exports (including billing and audit logs);

• detect, prevent, and respond to fraud, pumping, and abuse;

• improve performance, reliability, and product features (including AI routing and planning/simulation);

• provide customer support and communicate with you;

• comply with legal obligations and enforce our Terms.

  1. LEGAL BASES (EEA/UK)

If you are in the EEA/UK, we process personal data under one or more legal bases, such as:

• performance of a contract (to provide the Platform);

• legitimate interests (security, fraud prevention, improving the Platform);

• consent (where required for optional cookies or marketing); and

• legal obligations (tax, accounting, compliance).

  1. HOW WE SHARE INFORMATION

We may share information as follows:

6.1 Service providers (processors). We may share data with vendors that help us run the Platform, such as:

• hosting and infrastructure providers;

• payment processors (e.g., Stripe) for billing and subscription management;

• security, monitoring, and analytics providers (where enabled).

6.2 Messaging providers, hubs, and MNOs. To deliver messages and execute routing, we disclose necessary Customer Data to the messaging provider(s) and routes you select (or that your policies select), including recipient identifiers, message payloads, and related metadata. Those third parties process data under their own terms and policies, and may operate in different jurisdictions.

6.3 Sharing within your organization or with authorized users. Workspace administrators may invite users, assign roles, and enable sharing of certain information (including Price Lists) through workspace or personal cabinet settings. You control whether such sharing is enabled and who can access shared information.

6.4 Legal, safety, and enforcement. We may disclose information if required to do so by law, or if we believe disclosure is necessary to protect rights, safety, and security, investigate fraud/abuse, or enforce our Terms.

6.5 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

  1. DATA RETENTION

We retain information for as long as necessary to provide the Platform, for legitimate business purposes (such as security, auditing, and billing), and to comply with legal obligations. Retention periods can vary depending on the data type and configuration. You may request deletion of certain data, subject to legal and contractual requirements.

  1. SECURITY

We use reasonable administrative, technical, and organizational measures to protect information. No system is perfectly secure. You are responsible for protecting your account credentials, API keys, and provider credentials, and for configuring access controls within your workspace.

  1. YOUR RIGHTS AND CHOICES

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a copy of personal data, and to object to or restrict certain processing. To exercise your rights, contact us at [email protected].

• EEA/UK: You may have rights under GDPR/UK GDPR, including the right to access, rectification, erasure, portability, restriction, objection, and to lodge a complaint with a supervisory authority.

• Canada: You may have rights under PIPEDA and provincial privacy laws to access and correct personal information and to withdraw consent where applicable.

• United States (state privacy laws, including California): Depending on your state (including under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)), you may have additional rights to know/access, delete, correct, and obtain a copy of personal information, and to opt out of certain “sales” or “sharing” (as defined by applicable law). TrustRouter.ai does not “sell” personal information and does not “share” personal information for cross‑context behavioral advertising as those terms are defined under CCPA/CPRA. We will not discriminate against you for exercising privacy rights. You may also authorize an agent to submit a request on your behalf where allowed by law.

9.1 Additional U.S. disclosures (summary). Categories of personal information we may collect can include: identifiers (name, email, company), commercial information (billing records; Price Lists you upload), internet/network activity (logs, cookies), and content/metadata processed to provide the Platform (recipient identifiers, message content, delivery receipts). We collect this information from you, your organization, your devices/browsers, and your integrations. We use it for the business purposes described in Section 4 and share it with the categories of recipients described in Section 6.

  1. INTERNATIONAL TRANSFERS

We are based in Canada and may process or store data in Canada and other countries where our service providers or messaging partners operate (including the United States and the European Union). These countries may have different data protection laws than your jurisdiction. We use reasonable safeguards for cross‑border transfers where required by law (for example, contractual protections such as standard contractual clauses where applicable).

  1. DELETION REQUESTS AND ACCOUNT CONTROL

You may request deletion of your account and certain data by contacting us. Deletion may be subject to retention obligations (e.g., billing records, compliance logs). Workspace administrators may also manage data retention settings where available.

  1. CHILDREN

The Platform is intended for business use and is not directed to children. Do not use the Platform if you are under the age of majority in your jurisdiction.

  1. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will post changes on the Website with a new effective date.

  1. CONTACT

Questions about privacy: [email protected]

ENQUIRELINK INC.,