1. Scope and responsibility
Rock Application Systems, LLC ("Rockapps," "we," "us" or "our") operates TREX. This Privacy Policy applies to the TREX website, hosted application, support channels, APIs, integrations and feedback widgets that link to it. Contact us about privacy at contact@rockapps.com.br.
We determine how account, billing, service-security and direct support information is used. When an organization uses TREX to manage information about employees, customers or other people in its workspace, that organization generally determines the purposes of that processing, and we process the workspace information on its behalf. The applicable role depends on the activity and applicable law.
Your workspace administrator controls membership, roles, connected services and some information-sharing settings. This policy does not replace your organization's privacy notices or an applicable data processing agreement. For information held by an independently operated deployment, contact its operator as well.
2. Information we collect
The information involved depends on the modules you use, what you submit, and the permissions you grant. Sources include you, other workspace members, your organization, authorized integrations and your interaction with the service.
- Account and profile information: name, email address, profile image, authentication records, account identifiers, language preferences, workspace membership, roles and invitations. Password-based authentication uses password hashes, rather than storing a readable password.
- Workspace content: objectives and key results, projects, tasks, sprints, time entries, check-ins, roadmaps, strategy and research records, customer and opportunity information, contracts, financial records, wiki pages, whiteboards, notes, discussions and uploaded attachments.
- Billing information: workspace and customer identifiers, subscription plan, billable seats, payment status, invoices and transaction references. Stripe processes checkout and payment-method details; TREX does not require you to enter a complete card number into workspace records.
- AI interactions: prompts, conversation history, selected attachments or context, relevant workspace records retrieved for a request, generated responses and actions, and token or usage records.
- Technical information: request and access logs, IP addresses or derived anti-abuse identifiers, browser and device information, timestamps, errors, performance traces, authentication events and records of changes in the service.
- Communications and feedback: support requests, contact details, feedback descriptions, and files you choose to provide. Connected services supply the information covered by the permissions you grant.
3. Purposes and legal bases
We use information to create and secure accounts; deliver workspace features; enable collaboration, search and integrations; process subscriptions; provide support; send service notifications; troubleshoot and improve the service; prevent misuse; and comply with legal obligations.
Where a legal basis is required, processing may be necessary to perform our agreement with you, comply with law, or pursue legitimate interests such as securing and maintaining the service, subject to your rights. Where consent is required, we request it for the relevant activity. You may withdraw consent without affecting the lawfulness of prior processing. For customer-controlled workspace content, the customer is responsible for identifying its own lawful basis and providing the required notices.
Providing some information is necessary to create an account, process a payment or use a connected feature. If you choose not to provide it, that feature may be unavailable. Optional integrations and browser permissions are not required to browse the institutional website.
4. Workspace access and sharing
Content you add to a workspace may be available to its owner, administrators, members, guests or other authorized users according to their permissions and the feature's sharing settings. A private account does not make all content you add to a shared workspace private from its administrators.
An organization may remove your access, change your role or retain business records after you leave. Deleting your personal account does not necessarily delete records controlled by that organization. Direct requests about those records to the organization; we can assist it with requests where appropriate.
Authorized support or administrative access may be used to investigate a support issue, protect the service or comply with law. API credentials, bots and authorized third-party clients can also access data within their granted scope. Review permissions before connecting a client or sharing credentials.
5. AI features
TREX uses external AI services, including the OpenAI API, to provide its assistant and related generation, summarization and analysis features. When an AI feature runs, the prompt and the information needed for that task may be sent to the AI provider. This can include relevant workspace content retrieved by an agent, conversation context, selected files and tool results; it is not necessarily limited to the text of your latest message.
AI conversations, results and usage records may be stored in TREX to provide history, collaboration and usage limits. The AI provider also processes requests under its own applicable service terms and data controls. Consult the provider's documentation for its retention and training settings; this policy does not promise zero retention by an external provider.
Use AI only with information you are authorized to submit. Review generated content and proposed actions before relying on them. AI features are not intended to make legally significant decisions about people without appropriate human review.
6. Google and other connected services
If you use Google sign-in, we receive the identity information necessary to authenticate your account, such as your name, email address and profile image. Connecting Google Calendar is a separate, optional authorization.
The Google Calendar integration requests read-only calendar and event access. It retrieves the connected account identifier, calendar metadata and events from calendars you choose to synchronize so you can view them in TREX. Synced event information can include titles, descriptions, locations, dates, times and attendee or organizer information supplied by Google. Connection tokens are stored to maintain authorized synchronization. This integration does not request permission to edit your Google Calendar events.
TREX's use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used to provide the integration's user-facing features, not for advertising or to train generalized AI models. Access by personnel is restricted to authorized support, security or legal purposes permitted by that policy.
You can disconnect an account in TREX or revoke access in your Google Account. Revocation stops future authorized access; it does not itself erase previously stored copies or records already shared elsewhere. Contact us or your workspace administrator if you also need stored information deleted.
Other integrations, API clients and MCP clients receive data and may carry out actions according to the access you authorize. Their operators' terms and privacy notices also apply. Connecting a service does not authorize unrestricted access to every workspace.
7. Feedback widgets and recordings
An organization can embed a TREX feedback widget on its website. A submission may include the feedback text, contact information you provide, the page address, browser context and attachments. Anti-abuse processing may also use technical information associated with the request.
If you choose a screenshot or screen-recording feature, the resulting capture can include information visible on the page or screen you select. Recording features may involve browser permissions and the options you choose. Check a capture before submitting it, and avoid including passwords, payment details or unrelated personal information.
Feedback is delivered to the workspace operating the widget. That organization is responsible for explaining its collection and use of visitor data. Its privacy notice applies alongside this policy to its use of the submission.
8. Providers and other disclosures
We use providers to operate infrastructure and file storage, deliver email and notifications, process payments, supply AI functionality, and monitor security, errors and performance. Relevant services include Stripe for payments, OpenAI for supported AI requests, Google for integrations you authorize, and Sentry for diagnostic reporting when configured. Providers receive information necessary for their function, subject to applicable contracts and their own responsibilities.
We may also disclose information when you direct us to do so; to comply with lawful requests; to establish or defend legal claims; to protect users and the service; or in connection with a merger, acquisition or transfer of the business, subject to applicable protections and notice requirements.
We do not sell personal information or share workspace content with advertisers for cross-context behavioral advertising. Contact contact@rockapps.com.br for questions about the providers involved in your use of TREX or to request applicable data processing information.
10. Retention and deletion
We retain information for as long as reasonably necessary for the purposes described here, taking into account the account or subscription relationship, workspace instructions, security needs, contractual obligations, dispute resolution and applicable recordkeeping laws. Different categories of information may have different retention periods.
Archiving a project, hiding a record, disconnecting an integration or canceling a paid plan is not the same as deleting all related data. Ask your workspace administrator about available exports and deletion controls, or contact us for an account or workspace deletion request.
Deletion may be subject to identity verification, the requesting person's authority and lawful retention exceptions. Information in backups may remain until the applicable backup lifecycle expires, and records needed for legal or security purposes may be retained longer. We do not promise a single deletion or backup-retention deadline for every data category. We can provide information relevant to a specific request.
11. Security and international processing
We use technical and organizational measures designed to protect information, including authentication, workspace access controls and measures to secure service operations. Access controls do not replace your responsibility to protect credentials, review invitations and integrations, and configure permissions appropriately. No internet service or storage system can guarantee absolute security.
Information may be processed in countries other than the one where you live, depending on the hosting and service providers involved. Where applicable law requires a transfer mechanism or additional safeguards, those requirements apply to the transfer. Contact us for information about the processing locations and safeguards relevant to your account. No specific data-residency region is promised by this policy.
12. Your rights and requests
Depending on the law applicable to you, you may have rights to know about and access personal information, correct inaccurate information, request deletion, receive a portable copy, restrict or object to processing, and withdraw consent. Applicable laws, including the GDPR or Brazil's LGPD where relevant, may also provide rights concerning automated decisions and complaints to a supervisory authority.
Send requests to contact@rockapps.com.br. Tell us which account or workspace is involved and what you are requesting. We may need proportionate information to verify identity or authority; do not send passwords or complete payment-card details. We respond within the period required by applicable law, including any legally permitted extension.
If your request concerns records controlled by a workspace customer, we may refer it to that customer and assist with its response. Some requests are subject to legal exceptions. We will explain an applicable limitation and any available review or complaint channel. We do not retaliate against you for exercising a privacy right.
13. Children
TREX is intended for adults using a business and collaboration service, not for children. We do not knowingly solicit accounts from people under 18. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate and take appropriate action.
14. Updates and contact
We may update this policy to reflect changes in the service, processing practices or legal requirements. The date at the top identifies the latest revision. We will provide additional notice, and obtain consent where required, for changes that require it under applicable law.
Responsible company: Rock Application Systems, LLC. For privacy inquiries, data requests or questions about this policy, email contact@rockapps.com.br. This policy is published in English for every website language.