Privacy Policy - Treli AI

This Privacy Policy explains how Treli Payments, Inc. ("Treli", "we", "us") collects, uses, discloses and protects personal information in connection with Treli AI, our accounts-receivable and collections platform for businesses in the United States.

Read Section 2 first. For most of the data that flows through Treli AI, we are not the decision-maker — the business that uses our software is. Section 2 explains which is which, because it determines whom you contact to exercise your rights.

1. WHO WE ARE

2. OUR TWO ROLES

2.1. What "service provider" means. For customer data, we act only on the Merchant's documented instructions. We do not decide who gets contacted, how often, or what the message says. We do not use that data for our own purposes. Our obligations are set out in Clause 17 of our Terms of Service, which constitutes the written contract required by the California Consumer Privacy Act and includes the service provider restrictions that law imposes.

2.2. If you received a collection email from a business using Treli. That business controls your information, not Treli. It decided to contact you and wrote the message. To access, correct or delete your information, to opt out, or to dispute the debt, contact that business directly — its name and contact details appear in the message you received. Every email also contains an unsubscribe link, which we honor automatically.

If you cannot identify or reach the business, write to privacy@treli.co. We will identify the controller for you and forward your request within two (2) business days. We cannot act on your request ourselves without that business's instruction.

2.3. Merchant responsibilities. This Policy does not cover what a Merchant does with its own customers' information outside our platform. Each Merchant maintains its own privacy policy and is responsible for the notices and consents its own activity requires.

3. INFORMATION WE PROCESS AS A SERVICE PROVIDER

When a Merchant uses Treli AI, the following categories of personal information about its customers flow through our platform.

Sources. Directly from the Merchant (file upload or API), from the Merchant's connected accounting system (see Section 4), and from the customer themselves when they reply to an email.

4. QUICKBOOKS ONLINE DATA

If a Merchant connects its Intuit QuickBooks Online company to Treli AI, we read accounting data from that company through Intuit's API and store it in our platform in order to run collections on the Merchant's behalf. This section describes that specifically.

4.1. What we read

We read this data on an ongoing basis while the connection is active, so that balances stay current.

4.2. Why we read it

Solely to build and maintain the accounts-receivable ledger that drives the Service: to determine who owes what, how much is outstanding, how overdue it is, when a payment has arrived, and therefore which collection step — if any — applies to each customer.

We do not use QuickBooks data to build advertising or marketing profiles, to assess creditworthiness, to create credit reports, or for any purpose unrelated to collecting the Merchant's receivables.

4.3. We store it

The data listed in 4.1 is copied into and stored within Treli AI for as long as the connection is active, and thereafter under Section 10. We store it rather than querying Intuit on demand because the platform must evaluate collection cadences, generate statements, reconcile customer replies against balances and maintain an audit trail — none of which can be done reliably from live queries. It is stored encrypted and logically segregated from other Merchants' data.

4.4. Who sees QuickBooks data

Beyond Treli, these processors may handle QuickBooks-derived data, each only as needed for its function:

Stripe, Inc. does not receive QuickBooks data — it processes only the Merchant's own subscription payment to Treli. Intuit Inc. is the source of the data, not a recipient; Intuit's handling of the QuickBooks company is governed by the Merchant's agreement with Intuit.

We do not sell or share QuickBooks data, do not disclose it to any third party for that party's own purposes, and do not use it to train or improve any third-party model.

4.5. Disconnecting

A Merchant may disconnect the integration at any time from Treli AI or from within QuickBooks. We stop reading new data immediately. Data already stored is retained and deleted under Section 10, or sooner on written request, subject to legal retention obligations.

5. INFORMATION WE PROCESS AS A BUSINESS

About Merchant representatives, Users, billing contacts, prospects and visitors:

We use it to: provide and support the Service; create and administer accounts; bill and collect; send operational notices; secure the platform and prevent fraud; produce internal usage metrics, preferably in aggregated or de-identified form; maintain, improve and develop the product; comply with legal, tax and accounting obligations; screen against sanctions lists; exercise and defend legal rights; and — only where permitted and with an opt-out — send communications about our products.

6. SENSITIVE INFORMATION, AND INFORMATION ABOUT MINORS

We do not request or require sensitive personal information, and Merchants are contractually prohibited from knowingly uploading it. If a customer spontaneously includes sensitive information in an email or attachment — for example, health details when explaining a missed payment — it is used only to handle that collection matter, with the safeguards in Section 9.

We do not use or disclose sensitive personal information for purposes that would trigger the right to limit under the CCPA, and we do not use it to infer characteristics about anyone.

Treli AI is not directed to individuals under 16, and we do not knowingly collect their information. We do not sell or share the personal information of individuals under 16. If we learn that a minor's information has been uploaded, we will delete it and notify the Merchant.

7. ARTIFICIAL INTELLIGENCE

7.1. What the models do. Treli AI uses large language models and other machine learning models, run through Amazon Bedrock, to classify the intent of customer replies, extract information from payment receipts and attachments, resolve dates and payment commitments expressed in plain language, draft replies, review template content, and produce prioritization scores.

7.2. Outputs are assistive. Results are probabilistic and may contain errors. Decisions with legal or similarly significant effect on a person — furnishing information to a credit bureau, referring an account for legal action, accepting or rejecting a payment or arrangement, issuing a release — rest with the Merchant and require human review. Our platform provides escalation to a human agent and the ability to pause automation.

7.3. Human review. Any individual may ask for a human to review an outcome produced by automated analysis, state their position and contest it. Direct that request to the Merchant, as described in Section 2.2.

7.4. No training of third-party models. The models run through managed cloud services contracted on terms that exclude the use of our customers' content to train or improve the provider's models. We do not supply that content to model providers for training. If we later add a provider that does not offer that commitment, we will give notice before enabling it. We may use aggregated, de-identified data — which cannot reasonably be used to identify any business or individual — to measure quality and improve the Service.

7.5. Logging. Each model invocation is logged (purpose, model, timestamp, identifiers and, where applicable, inputs and outputs) for audit, quality control, legal defense and responding to lawful requests, for the period in Section 10.

8. EMAIL, AND HOW WE DISCLOSE INFORMATION

8.1. Email is the only outbound channel. In the United States, Treli AI communicates with Merchants' customers by email only. We do not place calls or send SMS, MMS or WhatsApp messages.

Emails are sent through Amazon SES and delivered to the recipient's mail provider, which applies its own filtering and retention practices outside our control. Every collection email identifies the sending business and includes an unsubscribe link; opt-outs are added to a suppression list and honored automatically across all of that Merchant's campaigns.

8.2. Service providers. We disclose personal information to the processors listed in Section 4.4, plus Stripe, Inc. for subscription payment processing and Intuit Inc. where a Merchant enables the accounting integration. Each is bound by contract to use the information only to perform services for us. We maintain a current list of these providers, available on request, and give Merchants advance notice before adding or replacing one.

8.3. Other disclosures. We may disclose personal information: to comply with a law, subpoena, court order or lawful government request; to our legal advisors and auditors under confidentiality; in connection with a merger, acquisition, financing or sale of assets, with protections carried forward; to establish, exercise or defend legal claims; and to investigate fraud, security incidents or unlawful activity.

8.4. We do not sell or share. Treli does not sell personal information, and does not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months. We do not use Merchants' customer data for our own marketing.

8.5. Data location. All processing for US Merchants takes place in the United States.

9. SECURITY

We maintain an information security program appropriate to the risk, including:

• Encryption in transit (TLS 1.2 or higher) and at rest for databases, files and backups.
• Field-level encryption of identifying personal information, with keys segregated per Merchant, and keyed-hash (HMAC) search indexes so a lookup does not require decrypting the underlying value.
• Logical multi-tenant segregation, enforced at the authorization layer and on every query.
• Role-based access control with least privilege, individual authentication, multi-factor available, periodic access reviews and prompt revocation.
• Network isolation — databases and sensitive resources in a private network with no direct internet exposure.
• Secrets management in a dedicated service, with no credentials in source code.
• Audit logging with correlation identifiers and alerting on anomalous behavior.
• Secure development — version control, code review, dependency scanning and environment separation.
• Automated backups with periodic restoration testing.
• AI-specific controls — third-party content treated as untrusted, prompt-injection defenses, output validation and complete invocation logging.
• Personnel bound by confidentiality obligations that survive their engagement, with annual security and privacy training.

No system is impenetrable. We do not warrant absolute security, but we commit to a standard of care consistent with the sensitivity of the information we handle.

Incidents. Where we are a service provider, we notify the affected Merchant without undue delay and within forty-eight (48) hours of confirming an incident, and cooperate in its investigation and in any notifications it must make. Determining whether notice to individuals or regulators is required is the Merchant's responsibility as the controller. Where we are the business, we notify affected individuals and regulators as applicable state breach notification law requires.

10. HOW LONG WE KEEP INFORMATION

We may retain information longer where there is pending litigation, a legal hold, a request from a competent authority, or a mandatory legal obligation. After the applicable period, information is securely deleted or irreversibly de-identified; deletion from backups follows normal rotation and purge cycles.

11. YOUR PRIVACY RIGHTS

Depending on where you live, you may have the rights below under the California Consumer Privacy Act (as amended by the CPRA) and the comprehensive privacy laws of other states.

• Know and access — what personal information we hold about you, the categories, sources, purposes and the categories of recipients, and a copy in a portable format.
• Delete — subject to exceptions that permit us to keep information for legal compliance, security, fraud prevention or to complete a transaction.
• Correct — inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of; we provide no "Do Not Sell or Share My Personal Information" link for that reason.
• Limit the use of sensitive personal information — we do not use sensitive information for purposes that trigger this right.
• Non-discrimination — we will not deny service, charge a different price or provide a lesser quality of service because you exercised a right.
• Appeal — if we decline your request, you may appeal; see 12.5.

Important routing. If your information is in Treli AI because a business is collecting a debt from you, that business is the controller and you should direct your request to it (Section 2.2). We will forward requests we receive and tell you who the controller is, but we cannot grant them on our own.

12. HOW TO EXERCISE YOUR RIGHTS

12.1. How to submit. Email privacy@treli.co, or write to Treli Payments, Inc., 251 Little Falls Drive, Wilmington, New Castle, Delaware 19808, USA. Tell us what you are asking for and give us a way to reach you.

12.2. Verification. To protect your information, we verify requests before acting. We will ask for information sufficient to reasonably confirm you are the person the information relates to — typically matching the email address or account details we already hold. We may ask for more where the request concerns sensitive information or a large volume of data. We use verification information only for that purpose.

12.3. Authorized agents. You may use an authorized agent. We will ask for written permission signed by you, and we may ask you to verify your own identity directly with us.

12.4. Timing. We confirm receipt within ten (10) business days and respond within forty-five (45) days. Where reasonably necessary we may extend once by a further forty-five (45) days, and will tell you why before the first period ends.

12.5. Appeals. If we decline your request, our response will explain why and how to appeal. Submit an appeal to privacy@treli.co with "Privacy Appeal" in the subject line. We will respond within forty-five (45) days with our decision and our reasoning. If we deny the appeal, you may contact your state attorney general.

12.6. No charge. Exercising these rights is free. We may charge a reasonable fee, or decline, for requests that are manifestly unfounded or excessive, and will explain why.

13. COOKIES

Our website and platform use cookies and similar technologies that are strictly necessary — authentication, session management, security and fraud prevention — together with preference cookies that remember your settings and analytics cookies that measure usage, performance and errors.

We do not use advertising, behavioral targeting or remarketing cookies.

You can manage or delete cookies through your browser settings, which allow you to block them, be warned before they are set, or remove those already stored. Disabling strictly necessary cookies may prevent the Service from working.

Global Privacy Control. Because we do not sell or share personal information, there is no sale or sharing for an opt-out preference signal to apply to. We nonetheless honor browser-level signals where applicable law requires it.

14. CHANGES TO THIS POLICY

We may update this Policy. The current version is always published at treli.ai/privacy with its effective date. If we make a material change — in particular to the purposes for which we use personal information — we will give notice at least thirty (30) days in advance by email to Merchant administrators or by prominent notice in the Service, before the change takes effect.

15. CONTACT

Privacy: privacy@treli.co Legal: legal@treli.co Security: security@treli.co

Treli Payments, Inc. 251 Little Falls Drive, Wilmington, New Castle, Delaware 19808, USA

Related document: Terms of Service

Version 1.0 (US) — effective June 01, 2026.