Privacy policy

1. Controller

The data controller is Trussfy [TO BE COMPLETED upon incorporation]. Contact: contact@trussfy.eu.

2. Data we process

Audit request: email address, and if you provide them, your name, agency name, list of domains and message. A non-reversible hash of your IP address is kept to limit abuse — never the IP address itself.

Account: email address, agency name, the domains you declare, the disclosure texts you generate, and the statements you record in the proof ledger.

We collect NO data about the visitors or end users of your clients' sites. The service sets no advertising trackers.

3. Purposes and legal bases

Answering your audit request — legal basis: pre-contractual steps taken at your request.

Providing the service — legal basis: performance of the contract.

Limiting abuse on public forms — legal basis: legitimate interest in protecting the service.

4. Retention

Audit requests: 24 months from the last exchange.

Account data and proof ledger: while the account is active, then deleted on request.

Abuse-limitation hashes: a few hours at most.

5. Recipients and processors

Supabase (database and authentication, Europe — Paris), Vercel (site hosting, functions executed in Europe — Paris), Resend (transactional email).

We do not sell or rent your data, and transfer nothing for advertising purposes.

6. Your rights

You have the right of access, rectification, erasure, objection, restriction and portability. Write to contact@trussfy.eu.

You can delete your account and all associated data from your settings.

You may lodge a complaint with your supervisory authority (in France, the CNIL — www.cnil.fr).

7. Fonts and analytics

Fonts are self-hosted: no request is sent to a third party when the site renders, so your IP address is not shared with Google.

No analytics tool that sets trackers is enabled without your prior consent.