Privacy.

The controller for this website, account administration and our communications is:

Harwin Singh Malhi & Philip Degenhardt GbR
Bodenseestraße 302D
81249 Munich, Germany

Represented by Harwin Singh Malhi and Philip Degenhardt. For privacy requests, contact hello@trialone.info or call +49 163 3799189. Our provider details are also available in the legal notice.

If an organisation uses TrialONE to process information about its employees or other people, that organisation determines the purposes of that use. The applicable customer agreement governs our role in processing data on its behalf.

We rely on our legitimate interests in operating and protecting the website for necessary technical processing (Art. 6(1)(f) GDPR). More information about the statistics service is available in Vercel's privacy documentation.

Accounts and the application database use Supabase. We process your email address, account ID, timestamps and account settings. You can sign in with an email address and password or through GitHub or Google. With social sign-in, we also receive the profile information supplied by the selected provider, such as your display name and profile picture address.

Access requests contain the information you submit: name, email address, company, team size and a description of what you are building. We keep the request, our access decision and notification status. CLI and agent credentials are stored as hashes, together with a label and their creation, use and revocation timestamps.

These details are used to provide requested access, authenticate you and administer your workspace, including memberships and invitations (Art. 6(1)(b) GDPR). Providing the required account details is necessary to use the signed-in service; you can browse public pages without an account.

Your browser stores the Supabase sign-in session in local storage so you remain signed in. It also stores your selected colour theme. These are distinct from website statistics. You can sign out and clear browser storage; clearing the session will require you to sign in again.

TrialONE reads recordings and live robot data where it runs. Cloud features can upload diagnostic results, channel names and measurements, project paths, file and line references, robot identifiers, history and information you enter about a problem. Free text, photos or camera images may contain personal information as well as confidential project information.

You control uploaded history per robot under Settings → Robots. The history levels are off, incident and full; the default is full. These settings control the history accompanying uploaded results. Uploading the original recording is a separate setting and is off by default.

Cloud results are used to provide your requested diagnosis, history, shared workspace and follow-up functions (Art. 6(1)(b) GDPR). Workspace members can access data according to their assigned role. The service applies account and workspace access checks; an upload is not a public publication.

Uploaded signal history is subject to the workspace retention setting, with a default of 90 days and a daily cleanup. Diagnostic runs and their associated records are not removed by that history cleanup; they remain available until you delete them or delete the account.

The current cloud interpretation and question-answering features send information to Anthropic or OpenRouter, depending on the model selected in Settings → Model. OpenRouter forwards requests to the provider serving the selected model. This means that these requests are processed outside TrialONE's own application.

Depending on the feature, a request can include your question, problem description, diagnostic findings, channel names, measurements, source excerpts and file references, observations, tool results, attached photos and camera frames used during an investigation. The original recording is not automatically sent as a file to the language model; information extracted from it can be included in the request.

This processing provides the explanation or investigation you request (Art. 6(1)(b) GDPR). Using your own provider key on the robot can connect the local installation directly to that provider. That is still an external transfer. Whether a particular request goes through TrialONE's cloud or directly from your installation depends on your configuration.

Photos attached to a problem report are stored in private Supabase storage and can be retrieved by your robot for investigation. The robot's camera buffer is local; frames selected for an investigation can be sent to the model. You can disable camera frames under Settings → Robots. Browser speech recognition is optional: your browser or its speech service processes audio and TrialONE receives the resulting text. Typing avoids that speech service.

Provider retention and handling depend on the provider, account settings and contractual terms. See the privacy information from Anthropic and OpenRouter.

This notice does not grant permission to use your uploaded information to train a model. Any such use would require a separately defined purpose and applicable legal basis.

Where paid features are enabled, Stripe processes checkout, subscriptions, credit purchases and billing. We receive customer and subscription identifiers, billing and invoice details, payment status and payment-method metadata. Payment details are entered with Stripe; TrialONE's checkout does not collect your full card number.

We also record service usage, such as the selected model, token counts, incidents and credit used, to administer and bill the service (Art. 6(1)(b) GDPR). Billing records may need to be kept to comply with commercial and tax obligations (Art. 6(1)(c) GDPR), independently of account deletion.

If you connect Slack, Discord or GitHub, the configured integration sends information needed for that function, such as finding text or issue content, to the service you select. We store connection details such as webhook addresses, installation identifiers and the channel or repository names you authorise. Forwarding is carried out to provide the integration you requested (Art. 6(1)(b) GDPR).

You can disconnect an integration under Settings → Integrations. Disconnecting stops future forwarding; it does not remove messages or issues already sent to the connected service.

Contact forms and email contain your email address, message and any name or other information you provide. We use them to answer your request and keep a record of the conversation. Messages and access requests can be stored in Supabase; email delivery uses Resend and our contact mailbox uses IONOS.

The support chat loads when you open it. The configured service is Crisp, or Intercom where selected instead. At that point the provider receives technical connection information and may store an identifier in your browser to continue the conversation. Your messages, the page you contact us from and, if signed in, your account email can be shared with it. Diagnosis data is not automatically attached to support chat; information you type into the conversation is sent to the support provider.

Where a booking option is available, Cal.com processes the appointment information you submit. Loading its booking interface also establishes a connection to Cal.com.

Requests concerning access or a contract are processed under Art. 6(1)(b) GDPR. Other correspondence and measures against abuse rely on our legitimate interests in answering requests and protecting the service (Art. 6(1)(f) GDPR). Open forms use an IP-based submission counter in server memory over a ten-minute window.

The services used for these functions are Vercel (hosting and website statistics), Supabase (authentication, database and storage), Resend (email delivery), IONOS (contact mailbox), Crisp or Intercom (support chat), Stripe (payments), Anthropic and OpenRouter and the model providers reached through OpenRouter (language models), and Cal.com (appointment booking, where enabled). Slack, Discord and GitHub receive integration data when you connect them.

Some providers operate internationally, including in the United States. Processing outside the EU or EEA depends on the service, region and account configuration. Please contact us for information about the processing arrangements relevant to your proposed use.

Account and workspace data are retained while the account and stored service records exist. The specific history and error-report cleanup periods are described above. Retention by external providers and in their backups is separate from deletion in the TrialONE interface. You can ask us about deletion or the retention applicable to a particular category of data.

Subject to the conditions of the GDPR, you can request access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you can withdraw it for the future without affecting earlier lawful processing.

In Settings, Profile → Your data, you can export your workspace data and request account deletion. Individual runs can be deleted from their own page. For other requests, write to hello@trialone.info.

You may also complain to a data protection supervisory authority, in particular in the country where you live or work. For our establishment in Munich, this is the Bavarian State Office for Data Protection Supervision (BayLDA).

Last updated: 6 October 2026. This is the preliminary privacy notice for TrialONE's early access service. We update it as the service and its processing arrangements develop.