Privacy Policy

TRES NETWORK, INC.

Version 2.5 | Last revised: September 14, 2026 | Website: www.tres.so

TRES Network, Inc. (the “Company”, “TRES”, “we”, “us”, or “our”) is committed to maintaining robust privacy protections for individuals who access or use our websites, products, and services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard information, including personal data (“Personal Data”), and describes the choices and rights available to you.

For purposes of this Privacy Policy, the “Site” refers to our website, which can be accessed at https://www.tres.so. Our Terms of Use are available at https://www.tres.so/termsofuse.

Unless otherwise stated, TRES Network, Inc. is the data controller for the processing described in this Privacy Policy.

By accessing or using the Site or the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Site or the Service.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at support@tres.so. Where applicable under EEA/UK law, details of any EU/UK representative will be provided in this Privacy Policy.

I. INFORMATION WE COLLECT

We collect information that you provide directly to us, information collected automatically when you use the Site or the Service, and, in some cases, information from third parties (for example, when a business customer provides us information in connection with its use of the Service).

Information you provide to us

• Account and profile information (for example, email address, username, password, phone number, and profile details you choose to provide).
• Questionnaire and onboarding information you submit through the registration process or within the Service.
• Communications you send to us (for example, support requests, feedback, or responses to surveys).

Information collected automatically

• Usage information about how you interact with the Site and Service (for example, pages viewed, features used, referring/exit pages, and the date/time of access).
• Device and log information (for example, browser type, device identifiers, IP address, operating system, and crash logs).
• Cookies and similar technologies. We use cookies to enable certain functionality, understand usage, and improve the Service. Some cookies are required for the Site to function; where we use non-essential cookies, we provide a mechanism to obtain consent where required by applicable law.

Information from third parties

We may receive information from third parties, such as service providers (for example, analytics or email delivery providers), or from business customers or partners that use the Service. We treat such information in accordance with this Privacy Policy and any contractual restrictions that apply.

II. HOW WE USE PERSONAL DATA

We use Personal Data for the following purposes:

• Provide and operate the Service (for example, create and manage accounts, authenticate users, provide core functionality, and process transactions).
• Communicate with you (for example, respond to inquiries, provide customer support, send administrative messages, and notify you of important updates).
• Improve and develop the Service (for example, debug, test, analyze usage, and develop new features).
• Promote the Service (for example, send marketing communications where permitted; you can opt out at any time using the unsubscribe link or by contacting us).
• Security and fraud prevention (for example, monitor, prevent, detect, and investigate suspicious activity).
• Legal and compliance (for example, comply with applicable laws, enforce our terms, and protect our rights and the rights of others).

Lawful bases (EEA/UK)

If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), we rely on one or more of the following lawful bases to process Personal Data, depending on the context: (a) to perform a contract with you (or to take steps at your request before entering into a contract); (b) our legitimate interests (for example, to secure and improve the Service and to communicate with business contacts), provided those interests are not overridden by your rights; (c) your consent (for example, where required for certain marketing communications or non-essential cookies); and (d) to comply with a legal obligation.

III. HOW WE SHARE PERSONAL DATA

We do not sell Personal Data. We may disclose Personal Data in the following circumstances:

• Service providers that perform services on our behalf (for example, cloud hosting, data storage, analytics, customer support tools, and email delivery). These providers are permitted to process Personal Data only for our purposes and under our instructions.
• Business customers. Where you use the Service in connection with an organization (for example, an EU client), that organization may have access to information associated with its account and use of the Service.
• Legal, safety, and enforcement if we believe disclosure is reasonably necessary to comply with law, respond to lawful requests, enforce our terms, or protect the rights, property, or safety of the Company, our users, or others.
• Business transfers in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets.
• Aggregated or de-identified information that cannot reasonably be used to identify you, which we may share for analytics or business purposes. We can provide additional information about the categories of service providers we use upon request.

IV. INTERNATIONAL DATA TRANSFERS

The Company is incorporated in the United States. Personal Data may be transferred to, stored in, or accessed from jurisdictions outside your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.

Where required under EEA/UK law, we implement appropriate safeguards for such transfers (for example, the European Commission’s Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum).

V. DATA RETENTION

We retain Personal Data for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

For example, we generally retain account information for as long as your account is active, and we may retain certain information after account closure to comply with legal obligations, resolve disputes, enforce agreements, and maintain security and audit logs.

You may request deletion of your Personal Data as described below.

VI. YOUR RIGHTS AND CHOICES

Marketing emails: You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us at support@tres.so. Even if you opt out of marketing emails, we may still send you non-promotional messages (for example, service-related or administrative emails).

Cookies: Most browsers let you remove or reject cookies. Doing so may affect the availability or functionality of the Site or the Service. Where we use non-essential cookies that require consent, you can manage your preferences using the cookie controls presented on the Site (where available).

EEA/UK privacy rights: If you are located in the EEA or the UK, you may have the right to (i) request access to and a copy of your Personal Data, (ii) request correction or deletion, (iii) request restriction of processing, (iv) object to processing (including where we rely on legitimate interests), (v) request data portability, and (vi) withdraw consent at any time where we rely on consent (this will not affect the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with your local supervisory authority.

If you have a TRES account, you can download a copy of your data or delete your account yourself at tres.so/account. For anything else, or if you no longer have access to your account, please contact us at support@tres.so. We may request information to verify your identity and will respond within the timeframes required by applicable law.

If we process your Personal Data on behalf of a business customer (acting as a processor), we may direct you to the relevant customer (the controller) to fulfill your request.

Automated decision-making: We do not use your Personal Data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Community data

TRES maintains a directory of communities, clubs and creator profiles built from publicly available sources — for example Instagram, community websites, LinkedIn, Facebook, Meetup and Luma — so that brands can find communities to partner with. If you run a community, your public profile may appear in it.

What we hold. The community's name and location, a description, links to its public profiles, publicly listed follower or member counts, and, where it is publicly listed, a contact email address. For some profiles we also store publicly posted content and engagement figures in order to estimate audience reach. We do not collect private messages, private account content, or contact details that are not publicly listed.

Where it came from. Public profile pages and websites, collected either by a member of our team or by automated collection from those public sources. When we contact you for the first time, we tell you in that message which public source your address came from.

Why. To operate a business-to-business marketplace that introduces brands to relevant communities. We rely on our legitimate interests in running that marketplace, balanced against your interests and rights.

How to object or be removed. Email us at support@tres.so, or reply "remove" to any outreach message you receive from us. We will remove your contact details and, if you ask, the profile itself, within 30 days. We also keep a suppression record of the request so that the same profile is not added again by a later collection run.

Your rights. The rights described in "Your rights and choices" above apply to this directory as well, including the right to object to processing based on legitimate interests.

Cookies

Essential cookies. Signing in and keeping you signed in requires cookies set by our authentication provider. These are necessary for the Service to work and are not optional.

Analytics cookies. We use product analytics to understand how the Service is used. These are not set unless you accept them. When you first visit, we ask; you can change your answer at any time using the "Cookie settings" link in the site footer, or in the account menu when you are signed in. Choosing "Reject" means no analytics cookies are set and no analytics requests are made.

Browser controls. Most browsers also let you remove or reject cookies. Doing so may affect the availability or functionality of the Site or the Service.

Retention

We keep personal data only for as long as it is needed for the purpose it was collected for. In practice that means two different things.

Data tied to an ongoing purpose is kept while that purpose lasts, not for a fixed number of days. Content and measurement figures gathered for a brand's campaign are kept for as long as that campaign, brand account or community profile exists, and are deleted when it is removed. Business and financial records — partnerships, payments, invoices — are kept as required for accounting and dispute resolution.

Data with no remaining purpose is deleted on a schedule, enforced automatically every night:

You can ask us to delete your data sooner at any time — see "Your rights and choices" above.

AI and automated decisions

We use AI models to summarise public community profiles, to rank search results, to draft outreach messages that a person then reviews and sends, and to identify products appearing in campaign content. The providers are Anthropic (Claude) and OpenAI (text embeddings for search).

Neither provider trains its models on data we send them. Both process it only to return a result to us, under their API terms.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. A person reviews and decides on applications, partnerships and outreach.

Call and email recording

When we hold a call with a brand or community, we may record and transcribe it so that our team has an accurate record of what was agreed. We tell participants at the start of the call. Emails exchanged with our team inbox are also stored and summarised for the same reason.

Transcripts and email bodies are kept for 24 months and then removed, leaving only the summary and the facts drawn from them. You can ask us to delete a recording or transcript sooner.

Sub-processors

We use the following providers to run the Service. Each processes personal data only on our instructions.

Transfers of personal data out of the EEA and the UK are covered by the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, except in the case of HikerAPI. HikerAPI is based in Kazakhstan, which is not the subject of an EU adequacy decision, and does not offer a data processing agreement or Standard Contractual Clauses. The only personal data we send to HikerAPI is a public Instagram username; what we receive back is content that is already publicly visible on that account, and HikerAPI has confirmed to us in writing that it does not store the data it collects. We keep this arrangement under review.

VII. HOW WE PROTECT INFORMATION

We implement technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include, for example, encryption in transit (such as TLS/SSL) and access controls.

However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

VIII. CHILDREN’S PRIVACY

The Site and the Service are not directed to children. We do not knowingly collect Personal Data from children under 13.

If you are located in the EEA/UK, we also do not knowingly collect Personal Data from children under the age at which parental consent is required for online services in your country (typically 16, but this may be lower depending on the country).

If you believe a child has provided us Personal Data, please contact us at support@tres.so and we will take appropriate steps to delete the information.

IX. LINKS TO OTHER WEBSITES

As part of the Service, we may provide links to or compatibility with other websites or applications. This Privacy Policy applies only to information collected by us through the Site and the Service.

We are not responsible for the privacy practices employed by third-party websites or applications, and we encourage you to review their privacy policies before providing them with information.

X. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by applicable law (for example, by posting a prominent notice on the Site or by contacting you).

The “Last Updated” date below indicates when this Privacy Policy was last revised.

XI. CONTACT US

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise your rights, please contact us at support@tres.so.