How this site handles your data
Two forms collect information here, and only if you choose to fill one in. This page says exactly what they take. Everything else is covered by the main TrustLayer privacy policy.
TrustLayer privacy policy
The full policy, covering how TrustLayer collects, stores and processes personal data across the business.
What the partner application collects
If you apply to partner, we collect your first name, last name, work email address and company. Optionally, your phone number, the kind of partner you are, the customer sizes you sell to, the vendors you already carry and anything you choose to add in the notes.
We use it to assess and reply to your application, and to set up your portal access if it goes ahead. We do not add you to a marketing list on the strength of an application.
What deal registration collects
If you register an opportunity, we collect your own contact details and details about the prospective customer: their organisation name, approximate size, the contact you are working with and where the opportunity has got to.
You are giving us information about someone else, so please only register a deal where you have a genuine business relationship with that customer and are entitled to share their details with a vendor. We use it to protect your claim on the opportunity and to support you on it.
The leads table
Once you are signed in, the partner area shows the opportunities you registered and the progress we have made on them. You only ever see leads matched to your own email domain. Other partners' leads are filtered out on our server and are never sent to your browser.
If you post a note against one of your leads, we store the note, your email address and the time you posted it, so we can reply and keep a record of the conversation.
Signing in to the private area
You sign in with your work email address and a password. If you have not set one yet, or cannot remember it, we email you a link instead — clicking it signs you in and you can set a password once you are there. Either way you stay signed in for 90 days.
Sign-in is handled by Supabase, which stores your email address, stores your password in a scrambled form that cannot be read back, records each sign-in, and makes sure an emailed link works only once.
If somebody at TrustLayer issues you a one-time code over the phone because email is not reaching you, that is recorded too: who asked, for whom, and when. The code itself is never written down anywhere.
Access is decided by your email domain. If your company is on our partner list you can sign in; if it is removed, you are signed out on your next page view.
What we do not do
We never see your password. It reaches Supabase scrambled and cannot be turned back into what you typed, by us or by them, so nobody at TrustLayer can read it or tell you what it is.
We do not build a profile of you. Nothing we count is tied to your name, your email address, your company, or any deal you have registered.
Who processes it
Both forms are handled by Formspree, which receives the submission and forwards it to us by email. Formspree is a United States company, so submitting a form involves a transfer of your details outside the UK.
The site is hosted on Cloudflare, a United States company.
Sign-in is provided by Supabase, which holds your email address and a record of your sign-ins. The link itself is delivered by Brevo, a French company storing data in the EU.
Lead records and the notes posted against them are stored in Notion, which is where our team keeps them up to date. Notion is a United States company.
Analytics and cookies
We count page views and downloads. We ask before setting an analytics cookie, which is what the bar at the bottom of the screen is for. You are asked once and we remember the answer.
We use Google Analytics. If you say no, no cookie is set and we still count the page view and the download, but we cannot tell whether you have been here before — which is the only thing the cookie adds. If you say yes, a cookie lets us see that a returning partner came back, without telling us who you are.
You can change your mind by clearing this site’s data in your browser, which makes us ask again.
What is never sent: your email address, your name, your company, or anything about a deal you have registered. We are answering "which material do partners actually use" — not "what is this person doing".
Advertising features and Google Signals are switched off, so nothing here feeds ad targeting anywhere.
Fonts are loaded from Google Fonts, which means Google receives the request for the font file, as it would on most websites.
Signing in sets two cookies, which together keep you signed in. Neither can be read by scripts on the page. They are required for the sign-in to work and are not used for tracking or advertising. Signing out deletes them and cancels the session.
Your rights
Under UK data protection law you can ask for a copy of what we hold about you, ask us to correct or delete it, object to how we use it, or ask us to restrict processing. You can also complain to the Information Commissioner's Office.
Contact details for making any of those requests are in the main privacy policy.