tray.io

Tray.ai Privacy Policy: Key User Implications

1. Data Collection & Use

Tray.ai may collect:

• Contact and account data: Name, email address, phone number, account details, IP address, and login-related information.
• Security information: Passwords are described as inaccessible to Tray.ai; users may instead provide access tokens.
• Usage and technical data: Cookie data, website and platform activity, session information, search history, interactions with advertisements, and analytics data.
• Workflow and feedback data: Information submitted while building workflows, completing surveys, contacting support, or providing feedback.
• Communications: Phone calls may be recorded for staff training or sales-quality purposes.
• Job applicant data: CVs, employment and education history, references, work authorization, address, preferences, and other application information.
• Potentially sensitive categories: California disclosures refer to recorded-call biometric information, geolocation data, and inferences, although the policy does not explain in detail when or how each is collected.

The information may be used to:

• Provide, secure, operate, improve, and personalize the Services;
• Provide customer support and analyze platform usage;
• Detect fraud, misuse, and cybersecurity threats;
• Contact users about the Services and send marketing;
• Support sales activities, including data enrichment;
• Process job applications;
• Comply with law and enforce Tray.ai’s legal rights.

Tray.ai states it will use information only for reasonably necessary and proportionate purposes, but several purposes—such as service improvement, personalization, sales enrichment, and “legitimate business purposes”—are broad.

2. User Rights and Choices

Depending on location, users may have the right to:

• Access and receive a copy of their information;
• Correct inaccurate or incomplete information;
• Request deletion or restriction of processing;
• Object to processing, particularly direct marketing;
• Withdraw consent where processing relies on consent;
• Request data portability;
• Obtain information about international-transfer safeguards;
• Complain to a data-protection regulator (EEA, UK, or Switzerland);
• Avoid discrimination for exercising California privacy rights.

California residents may request categories and specific pieces of information collected, sources, purposes, and disclosure recipients. Access requests are generally limited to twice in a 12-month period. Tray.ai generally aims to respond within 45 days, with a possible 45-day extension.

Users may opt out of marketing by contacting Tray.ai. Opting out of certain sharing may require termination of an account if the sharing is essential to providing the Services. The website and Services do not respond to “Do Not Track” signals.

3. Third-Party Sharing

Tray.ai shares information with:

• Service providers and subprocessors, including support and analytics providers such as Intercom and Segment;
• Providers that perform data enrichment for sales or personalization;
• Authorized partners, with consent, who may offer Tray.ai or third-party services;
• Its UK affiliate, Plan.nr Ltd.;
• A successor entity in a merger, acquisition, or restructuring;
• Government authorities responding to lawful requests;
• Parties involved in enforcing or defending legal rights.

The policy permits broad operational sharing and does not list all providers in the document. Users should review Tray.ai’s separate trust, cookie, and subprocessor information where available.

4. AI/ML Training

Tray.ai expressly states that data authenticated through its Google Workspace OAuth application, service, or API is not used to train generalized AI or machine-learning models, reportedly pursuant to its Google partnership.

This protection is limited in wording. The policy refers users to a separate Merlin AI page for information about AI or model training, but does not state here whether other user data—such as workflows, prompts, outputs, feedback, or non-Google-connected data—may be used for AI features or model improvement. Users should review that separate documentation and their Services agreement.

5. Key User Obligations and Restrictions

• The Services and website are not intended for people under 18.
• Users should provide accurate, complete, and current information.
• Account credentials and access tokens should be protected.
• Use of the platform remains subject to the applicable Terms and Conditions or customer Services agreement.
• Marketing communications may continue unless the user opts out.
• Account termination and data deletion may be limited by contractual, legal, backup, or retention requirements.

6. Liability and Disputes

The policy states that Tray.ai uses industry-standard physical, technical, and organizational safeguards, but does not guarantee immunity from cyberattacks, misuse, malfunctions, mistakes, or other incidents. It does not provide detailed warranties, indemnities, damage caps, or liability rules; those are likely contained in the Terms and Conditions or Services agreement.

EEA, UK, and Swiss users may pursue unresolved Data Privacy Framework complaints through JAMS and, in some circumstances, binding arbitration under the DPF program. Regulatory complaints may also be filed with the relevant supervisory authority.

7. Policy Changes

Minor changes may take effect immediately after notice on the platform, website, email, or within the Services. Substantial changes generally become effective 30 days after notice. Changes required by law may take effect immediately. Continued use after the effective date constitutes acceptance of the revised policy.