This Privacy Policy describes how Trestle Labs Private Limited (“Trestle Labs”, “we”, “us”, or “our”) collects, uses, stores, processes, transfers, and discloses information in connection with the use of its products, platforms, applications, websites, software services, application programming interfaces (APIs), hardware-enabled solutions, and related offerings (collectively, the “Services”).
The Services are offered under the Kibo brand and may be made available to individual users, enterprises, educational institutions, government bodies, and other organizations through various deployment models, including cloud-based services, APIs, and institution-managed or client-managed environments.
This Privacy Policy applies to information collected:
This Privacy Policy does not apply to:
We recognize that the information processed through the Services may include personal, sensitive, or confidential data. We are committed to handling such information responsibly, transparently, and in accordance with applicable data protection and privacy laws, contractual obligations, and recognized security practices.
This Privacy Policy explains:
By accessing or using any of the Services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of information in accordance with its terms. Where you use the Services on behalf of a Customer or Client, your use of the Services is also subject to that Customer’s or Client’s applicable policies and instructions.
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
The role of Trestle Labs with respect to information processed through the Services depends on the nature of the Services used and the context in which they are provided.
Trestle Labs acts as a data controller with respect to Personal Data collected and processed in connection with:
In these contexts, Trestle Labs determines the purposes and means of processing such Personal Data and processes it in accordance with this Privacy Policy.
Trestle Labs acts as a data processor when processing User Content and related Personal Data on behalf of a Customer or Client in connection with the provision of the Services, including enterprise, institutional, government, or API-based deployments.
In such cases:
Where a User accesses or uses the Services on behalf of a Customer or Client (such as an employer, educational institution, government department, or other organization), the processing of User Content and related Personal Data is subject to the instructions, policies, and permissions established by that Customer or Client.
Users should direct any requests regarding access, correction, or deletion of User Content processed on behalf of a Client to the relevant Customer or Client, in accordance with their internal policies.
We collect information in connection with the provision, operation, and support of the Services. The categories of information collected depend on how the Services are accessed and used, whether directly by an individual or on behalf of a Customer or Client.
When an account is created or managed, or when you interact with us directly, we may collect information such as:
This information is primarily used to establish, administer, and support access to the Services.
We collect and process User Content only when such content is submitted, uploaded, transmitted, or otherwise made available for processing through the Services by or on behalf of a User or Client.
User Content may include documents, images, files, text, audio, or other data provided for processing in connection with the Services. The nature and scope of User Content processed depend on the specific Services used, the configuration or deployment model, and the instructions of the Customer or Client.
User Content is processed solely in accordance with this Privacy Policy and applicable agreements governing the use of the Services.
We collect technical and operational information generated through the use of the Services, including:
This information does not typically include the substantive content of User Content, unless explicitly required for the provision of the Services and agreed under applicable agreements.
When the Services are accessed, we may collect limited information about the device, system, or platform used, such as:
This information is used to ensure compatibility, performance, security, and reliability of the Services and to diagnose technical issues.
When you visit our websites or online properties, we may collect information related to your interaction with those sites, such as:
Such information is used to operate and improve our websites, understand visitor engagement, and maintain security.
If you contact us for support, feedback, or assistance, we may collect and retain the information you provide, including contact details and the content of communications, to respond to your request and improve our support services.
The Services are designed to process User Content in order to deliver intelligent document processing, content understanding, accessibility, analytics, and data protection capabilities, as configured or requested by a User or Client.
User Content is processed solely in connection with the provision of the Services and in accordance with the applicable Service configuration, deployment model, and documented instructions of the Customer or Client.
Depending on the Services used, enabled features, and applicable use case, User Content may be processed for purposes that include, but are not limited to:
The above processing activities may involve multiple stages of transformation, analysis, and output generation and are performed only to the extent necessary to deliver the requested Services.
User Content may be processed:
Processing may occur through different modes of integration, including application interfaces, APIs, or automated workflows, and may be deployed in cloud-based, client-managed, or on-premise environments, as applicable.
Trestle Labs processes User Content solely to perform the functionalities and workflows enabled through the Services. Processing is limited to what is reasonably necessary to deliver the configured outcomes and does not extend beyond the scope of the Services provided.
Trestle Labs does not claim ownership of User Content. Responsibility for the lawfulness, accuracy, and appropriateness of User Content provided to the Services rests with the User or Client that submits or authorizes such content for processing.
Processing of User Content may generate Metadata as part of normal service operation. Metadata is used to support service delivery, monitoring, diagnostics, security, quality assurance, and performance optimization and does not replace or constitute the substantive content of User Content itself.
Trestle Labs collects and processes information solely for legitimate, defined purposes related to the provision, operation, security, and improvement of the Services. Information is not processed in a manner that is incompatible with these purposes.
The specific use of information depends on the category of data involved and the context in which the Services are used.
User Content is processed only to perform the functionalities and workflows enabled through the Services, as configured or requested by the User or Client.
Such use may include processing necessary to:
User Content is not processed for purposes unrelated to the delivery of the Services and is not used in a manner that overrides or contradicts the instructions or agreements governing the Client’s use of the Services.
Metadata and operational data generated through the use of the Services may be used to:
Such data is typically used in aggregated or contextual form and does not replace or expose the substantive content of User Content.
Account-related and business information may be used to:
Information collected through the Services may be used to improve the functionality, performance, reliability, and usability of the Services, including through analysis of usage patterns, system behavior, and operational metrics.
Such improvement activities are conducted in a manner consistent with this Privacy Policy and applicable contractual obligations and do not involve the use of User Content beyond what is necessary to deliver or support the Services.
Trestle Labs does not:
The Services may generate automated outputs such as classifications, extracted fields, structured data, summaries, or risk indicators as part of service delivery. Customers and Clients are responsible for determining how such outputs are used and for implementing appropriate review and validation processes, including human review where required by law or internal policy.
Trestle Labs retains information only for as long as is reasonably necessary to fulfill the purposes for which it is collected and processed, unless a longer retention period is required or permitted by applicable law, contractual obligations, or legitimate business requirements.
Retention periods vary depending on the category of information and the context in which the Services are used.
User Content submitted for processing through the Services is retained only for the duration necessary to perform the requested processing and deliver the corresponding outputs.
Unless otherwise configured or contractually agreed:
Where a Customer or Client configures longer retention, requests storage of outputs, or requires retention for operational, audit, or compliance purposes, User Content may be retained in accordance with such instructions and applicable agreements.
Metadata, logs, and other operational data generated through the use of the Services may be retained for longer periods as reasonably necessary to:
Such data is retained in accordance with internal retention practices and does not typically include the substantive content of User Content.
Account information, billing records, contractual documentation, and communications may be retained for the duration of the business relationship and thereafter as required for:
Upon termination or expiration of access to the Services, User Content and related data may be deleted or returned in accordance with the applicable agreement, Client instructions, and this Privacy Policy.
Deletion may be subject to:
Once data is deleted from active systems, residual copies may persist for a limited period in backups or archives until such systems are refreshed or overwritten in accordance with standard operational practices.
Where the Services are used on behalf of a Customer or Client, including enterprise, government, educational, or institutional deployments, data retention and deletion are governed primarily by the Client’s instructions, policies, and applicable agreements.
Users acting on behalf of a Client should direct any requests regarding retention or deletion of User Content to the relevant Client or organization.
Trestle Labs does not sell, rent, or trade User Content or Personal Data. Information is shared only in limited circumstances and solely to the extent necessary to provide, operate, and support the Services or to comply with legal obligations.
Trestle Labs may engage third-party service providers and sub-processors to perform functions necessary to operate and support the Services, such as infrastructure operations, security, analytics, or support services.
Where such third parties are engaged:
When Trestle Labs processes User Content on behalf of a Customer or Client, including in enterprise, government, educational, or institutional deployments, any sharing of information with sub-processors occurs solely to fulfill the Client’s instructions and deliver the Services.
In such cases:
Trestle Labs does not share, sell, rent, or otherwise disclose User Content or Personal Data to third-party advertising networks, data brokers, or advertising intermediaries for the purpose of targeted advertising, profiling, or cross-platform marketing.
Trestle Labs may, however, use contact information collected directly from Users or Clients to send communications originating from Trestle Labs that relate to:
provided that such communications are sent in accordance with applicable laws and any consent, preference, or opt-out mechanisms required under those laws.
In all cases, Personal Data used for such communications is not shared with third parties for their independent advertising or marketing purposes.
Trestle Labs may disclose information if required to do so by applicable law, regulation, legal process, or governmental request, or where disclosure is reasonably necessary to:
In the event of a merger, acquisition, reorganization, sale of assets, or similar transaction involving Trestle Labs, information processed through the Services may be transferred as part of that transaction, subject to appropriate confidentiality and data protection commitments.
Any successor entity will be required to honor the commitments set forth in this Privacy Policy with respect to such information.
Trestle Labs operates globally and may process or store information in multiple locations in order to provide and support the Services.
Information collected or processed through the Services, including Personal Data, User Content, Metadata, and operational data, may be transferred to, accessed from, or processed in countries other than the country in which the User or Client is located.
Where such cross-border transfers occur, Trestle Labs takes reasonable steps to ensure that information is protected in accordance with this Privacy Policy and applicable data protection laws, including by implementing appropriate contractual, technical, and organizational safeguards.
By accessing or using the Services, you acknowledge and understand that information may be transferred, stored, or processed in jurisdictions that may have data protection laws that differ from those of your jurisdiction.
In enterprise, government, or institutional deployments, cross-border data transfers, where applicable, may be further governed by the terms of the relevant agreement, deployment configuration, or Client instructions.
Trestle Labs implements reasonable and appropriate technical, organizational, and administrative measures designed to protect information processed through the Services against unauthorized access, disclosure, alteration, or destruction.
Security measures are implemented taking into account the nature of the information processed, the context of processing, the state of the art of technology, and the potential risks associated with such processing.
Security measures implemented by Trestle Labs may include, as appropriate:
Access to information processed through the Services is limited to personnel who require such access for the performance of their duties and who are subject to confidentiality obligations.
Trestle Labs maintains internal policies and procedures governing information security, incident response, and access management and reviews such controls periodically.
The security of information also depends on Users and Clients. Users and Clients are responsible for:
Trestle Labs is not responsible for security incidents resulting from actions or omissions outside its reasonable control, including failures in systems, networks, or environments managed by Users or Clients.
While Trestle Labs takes reasonable measures to protect information processed through the Services, no method of transmission over the internet or method of electronic storage is completely secure. Accordingly, Trestle Labs cannot guarantee absolute security of information.
Depending on your relationship with Trestle Labs and the context in which the Services are used, you may have certain rights with respect to your Personal Data under applicable data protection laws.
The availability and scope of these rights may vary based on whether Trestle Labs acts as a data controller or a data processor and on the nature of the Services used.
Subject to applicable laws and contractual arrangements, you may have the right to:
These rights are not absolute and may be subject to limitations or exceptions under applicable laws.
Where Personal Data or User Content is processed by Trestle Labs on behalf of a Customer or Client, Trestle Labs acts as a data processor.
In such cases:
Where Trestle Labs acts as a data controller, you may submit requests relating to your Personal Data by contacting us using the details provided in the Contact Information section of this Privacy Policy.
We may take reasonable steps to verify your identity before responding to a request and may request additional information to help us understand and process your request.
Responses to verified requests will be provided within reasonable timeframes, subject to applicable legal requirements.
You may manage or opt out of non-essential communications from Trestle Labs in accordance with applicable laws and the instructions included in such communications.
Service-related communications necessary for the operation, security, or administration of the Services may not be subject to opt-out.
The Services may be provided to and used by educational institutions, government bodies, public sector organizations, non-profit organizations, and other institutions (collectively, “Institutions”) for purposes such as education, research, administration, accessibility, compliance, digitization, or public service delivery.
Where the Services are used in such contexts, the following principles apply.
When an Institution engages Trestle Labs to provide the Services:
Individuals such as students, educators, librarians, staff members, officers, or other authorized users may access or use the Services under the authority of an Institution.
In such cases:
The Services may enable activities such as digitization, transformation, translation, audio generation, or accessibility enhancement of educational or informational materials.
Users and Institutions are responsible for ensuring that:
Trestle Labs does not assume responsibility for unauthorized use of copyrighted materials submitted to the Services.
The Services may be used by Institutions to support accessibility, inclusion, and assistive use cases.
While Trestle Labs designs the Services to enable accessible processing and delivery of content, Institutions remain responsible for determining how such Services are deployed, accessed, and governed within their environments, including compliance with applicable accessibility, education, or public-sector regulations.
The Services are not directed at children or minors for independent, unsupervised use.
The Services may, however, be used by children or minors under the supervision, authorization, and responsibility of an educational institution, government body, parent, guardian, or other authorized organization (each, an “Authorized Entity”), such as in schools, colleges, libraries, or public institutions.
Where children or minors access or use the Services:
Trestle Labs does not knowingly collect Personal Data directly from children or minors for independent use of the Services.
If Trestle Labs becomes aware that Personal Data relating to a child or minor has been collected outside an authorized institutional or supervised context, reasonable steps will be taken to delete such information in accordance with applicable laws.
Requests relating to access, correction, or deletion of data associated with children or minors should be directed to the relevant Authorized Entity, parent, or guardian, as applicable.
Where Trestle Labs acts as a data processor on behalf of an Institution or Authorized Entity, such requests will be handled in accordance with the applicable agreement and instructions of that entity.
In the event that Trestle Labs undergoes a corporate transaction such as a merger, acquisition, reorganization, sale of assets, insolvency, or similar change of control, information processed through the Services may be transferred as part of that transaction.
Any such transfer will be subject to appropriate confidentiality and data protection commitments. The successor entity or acquiring organization will be required to honor the commitments set forth in this Privacy Policy with respect to such information, unless and until the Privacy Policy is updated in accordance with the Changes to This Privacy Policy section.
Where Trestle Labs processes User Content on behalf of a Customer or Client, such transfer will remain subject to the applicable agreements and documented instructions governing the processing of such User Content.
Trestle Labs may update or modify this Privacy Policy from time to time to reflect changes in legal requirements, business practices, technology, or the Services.
When we make changes, we will revise the “Effective Date” or “Last Updated” date at the top of this Privacy Policy. Updated versions of this Privacy Policy will be made available through our websites or Services, as applicable.
Where required by applicable law, we will provide additional notice of material changes in an appropriate manner. Continued access to or use of the Services after the effective date of an updated Privacy Policy constitutes acknowledgment of the updated terms, to the extent permitted by law.
We encourage you to review this Privacy Policy periodically to stay informed about how information is processed through the Services.
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of information through the Services, you may contact Trestle Labs at:
Email: privacy@trestlelabs.com
In accordance with the Digital Personal Data Protection Act, 2023 (India), individuals may submit requests or grievances relating to the processing of Personal Data through the Services using the contact details above. Such requests will be reviewed and addressed in accordance with applicable laws, contractual obligations, and internal procedures.
Where the Services are used on behalf of a Customer or Client (including enterprise, institutional, or government deployments), requests or grievances relating to User Content or Personal Data may also be subject to the policies and procedures of the relevant Customer or Client, who acts as the primary data controller or data fiduciary.