Privacy Policy

Trifecta (“we”, “us”) is a board operating system for Entrepreneurs’ Organization (EO) chapters. It helps chapter boards track member health, engagement, renewals, and revenue. Trifecta is operated from Dallas, Texas. Questions or requests about this policy: membership@gettrifecta.com.

Chapter data. Chapters provide member rosters, engagement records, CRM exports, sponsor lists, and board correspondence (email sent or copied to the chapter’s Trifecta mailbox). This data belongs to the chapter; we process it to provide the service to that chapter’s board.

Account data. Name, email address, and role for board members who sign in, plus routine security logs.

Google user data. Only if you explicitly connect your Gmail account — described in full in the next section.

Some Trifecta features optionally connect to your Gmail account via Google’s OAuth consent flow. We request the minimum scopes these features need:

• Read your email (gmail.readonly) — used to (a) scan your inbox, at your request, for correspondence with your chapter’s members and prospects so Trifecta can surface relationship signals (for example, a member going quiet), and (b) locate an existing conversation thread so a draft reply is filed on the right thread. Scans are scoped to your chapter’s roster — mail unrelated to chapter members is not extracted, stored, or shown.
• Create drafts (gmail.compose) — used to place suggested outreach drafts in your own Gmail Drafts folder. Trifecta never sends email from your account; you review, edit, and send (or delete) every draft yourself.

What we store. We do not store raw email bodies. Trifecta stores only derived signals (for example “last replied on this date”), short structured extractions, and message references. OAuth refresh tokens are encrypted at the application layer (AES-256-GCM) and held in storage that no signed-in user can read.

How it is processed. Email content is processed transiently by our AI subprocessor (Anthropic’s Claude API) to extract relationship signals. Anthropic does not train its models on this data, and we do not use any Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Sharing. We do not sell Google user data, do not use it for advertising, and do not transfer it to third parties except the subprocessors listed below acting on our instructions, or as required by law.

Revoking access. You can disconnect Gmail inside Trifecta at any time, or revoke Trifecta’s access from your Google Account permissions page. On disconnection we delete the stored token; you may also request deletion of derived data at the contact address above.

Limited Use. Trifecta’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small set of infrastructure providers to run the service: Vercel (hosting), Supabase (database), Anthropic (AI processing), Resend (email delivery), and Cloudflare (inbound mail routing and DNS). Each processes data only to provide its service to us. A chapter’s own CRM (for example HubSpot) is connected only at that chapter’s direction, using credentials the chapter controls.

Every chapter’s data is isolated with row-level security; secrets and OAuth tokens are encrypted at rest and readable only by server-side service processes; data is encrypted in transit; outbound email systems are gated behind explicit switches; and inbound email is authenticated (SPF/DKIM/DMARC) and rate-limited.

Chapter data is retained while the chapter uses Trifecta and deleted on the chapter’s request when it leaves. Individuals may request access to or deletion of their personal data at membership@gettrifecta.com; we respond within 30 days.

Trifecta uses only the session cookies required to keep you signed in. There are no advertising or cross-site tracking cookies.

If we change this policy we will update this page and the date above; material changes affecting Google user data will be communicated to connected users before they take effect.