Privacy policy
The short version: we collect what you type into our forms, we use it to decide whether there is a fit and to send you the emails you asked for, we store it in Notion and send mail through Brevo, and you can have all of it deleted by sending one email. There are no advertising cookies on this site and no tracking pixels. There is one behaviour tool, and it only runs if you say yes to it. The long version follows.
1. Who is responsible
- Data controller
- Steeve Vanden Heede, trading as Trusters Studio
- Tax number (NIF)
- Z0469621N
- Address
- Camion la Palma 52
38430 Icod de los Vinos
Santa Cruz de Tenerife
Spain - steeve@trusters.io
We have not appointed a data protection officer. Our processing does not meet the thresholds in Article 37 GDPR that would require one. Write to the address above with any data protection question and it reaches the person responsible.
2. What this policy covers
This policy covers the public website at trusters.io. It does not cover the Trusters product itself once you are a customer, which is governed by the agreement we sign with you, nor the other websites we link to.
3. What we collect, why, and on what basis
| When | What | Why | Legal basis |
|---|---|---|---|
| You join the waitlist | Name, work email | To put you on the list, confirm it, and send you the founding-member emails | Your consent, Article 6(1)(a) |
| You answer the qualifying questions | Role, field, revenue band, LinkedIn profile, current visibility, your main challenge, your timeline | To judge whether Trusters is a fit for you before we take it further | Your consent, Article 6(1)(a) |
| You apply for an authority score | First and last name, email, company, region, niche, what you are known for, your website, and the public profiles you choose to give us: LinkedIn personal and company, Instagram, Facebook, TikTok, YouTube, X, podcast, newsletter. Plus how often you post, comment, connect and send messages | To produce your authority score and the written read that goes with it | Your consent, Article 6(1)(a), given through the tick box on the form |
| You book a call | Name, email and the slot you pick | To hold the appointment and send you the invitation | Steps taken at your request before a contract, Article 6(1)(b) |
| You open any page | IP address, browser and device type, the page requested, the time, the referring page | To serve the site, keep it up, and defend it against attacks | Our legitimate interest in a working and secure website, Article 6(1)(f) |
| We send you a mail | Whether the mail was delivered, opened, and whether a link was clicked | To see whether the sequence works and to stop sending to addresses that bounce | Your consent, Article 6(1)(a) |
None of these fields are a legal requirement. You decide what to type. If you leave the optional ones blank we can still put you on the waitlist, though an authority score with no profiles to look at will not tell you much.
4. The emails we send
Joining the waitlist signs you up to a sequence of emails about the product and the thinking behind it. Under Article 21 of Spanish Law 34/2002 we may only send these because you asked for them, and we treat your signup as exactly that and nothing more.
Every email carries an unsubscribe link, and it works immediately. You can also simply reply and say stop, or write to steeve@trusters.io. Withdrawing does not affect anything we sent before you withdrew, and it does not remove you from the waitlist unless you ask for that too.
5. Who else handles your data
We are a small team and we use other companies to run the parts we do not run ourselves. Each of them processes data on our instructions under a data processing agreement, and none of them may use your data for their own purposes.
| Who | What they do for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the site, delivers it, and filters attacks. Sees the server log data in row five above | United States, with delivery from servers near you |
| Brevo (Sendinblue SAS) | Sends our email and records whether it arrived | France |
| Notion Labs, Inc. | Stores waitlist entries and score applications so we can work through them | United States |
| Google Ireland Ltd. and Google LLC | Serves the typefaces the site is set in, and the embedded video on the press page | Ireland and the United States |
| Microsoft Corporation (Clarity) | Records which parts of a page are read, how far people scroll, and where they get stuck, so we can fix the confusing parts. Only if you accept it. Typed input is masked and never recorded | United States |
We do not sell personal data, we do not share it with advertising networks, and we do not use it to train AI models.
6. Data leaving the European Economic Area
Cloudflare, Notion, Google and Microsoft are United States companies, so some of the processing above happens outside the EEA. Those transfers rest on the European Commission's adequacy decision for the United States of 10 July 2023, and on the standard contractual clauses approved by the Commission where the adequacy decision does not apply. You can ask us for a copy of the clauses that cover a particular provider.
7. Fonts and embedded video
The site loads its typefaces from Google Fonts. Your browser requests them directly from Google, which means Google receives your IP address when a page loads. We are working on serving the fonts from our own domain so that request stops happening.
The press page embeds a video through youtube-nocookie.com, YouTube's privacy-enhanced mode. It sets no tracking cookies before you press play. Your IP address still reaches Google when the player loads.
8. Cookies and browser storage
There are no advertising cookies here, no tracking pixels, and nothing that follows you to another website. What exists is one behaviour tool, and it is off until you turn it on.
Strictly necessary, no consent needed
When you fill in the waitlist form, your name and email are held in your browser's session storage so the second step and the confirmation page can show them back to you. That data never leaves your browser, we cannot read it, and it is gone when you close the tab. Spanish law treats storage that is strictly necessary to deliver a service you asked for as exempt from the consent requirement, which is the case here. The same applies to the small record of your cookie choice itself, which has to persist or we would have to ask you again on every page.
Only with your consent
Microsoft Clarity shows us where people get stuck on a page. If you accept it, cookies are set, some by us and some by Microsoft:
| Cookie | What it does | How long |
|---|---|---|
_clck | Set by us. Keeps one anonymous identifier for your browser, so repeat visits are not counted as new people | 1 year |
_clsk | Set by us. Ties the pages of a single visit together into one session | 1 day |
MUID | Set by Microsoft on their own domains. A Microsoft-wide user identifier, which Microsoft also uses for advertising and fraud detection, not only for our analytics | Up to 13 months |
MR, SRM_B, SM, ANONCHK | Set by Microsoft on their own domains, for synchronising that identifier and for abuse detection | From 1 day to 13 months |
We want to be precise about the last two rows, because it is the part that is easy to gloss over. The first two cookies are ours and we control them. The Microsoft ones are set on Microsoft's own domains, and MUID in particular is an identifier Microsoft also uses for advertising, not just for showing us a heatmap. Accepting Clarity means accepting that too. That is the real cost of a free tool, and you should know it before you press the button rather than after.
Nothing from Clarity loads before you accept. Not the script, not a preconnect to Microsoft. If you decline, the request is never made, and declining takes exactly as many clicks as accepting.
What it records, and what it does not. It records clicks, scrolling, mouse movement, the pages you visit, your approximate location from your IP address, and your device and browser. Masking is set to Strict, which means text content is hidden before anything is sent, so what you type into a form is never recorded. We cannot see your email address in a replay, and neither can Microsoft.
Changing your mind. There is a Cookie settings link in the footer of every page. Declining there stops the recording, deletes our two cookies, and reloads the page so nothing keeps running in the background on the page you are already on. From then on Clarity is never loaded again unless you change your mind back.
One honest limit: we can delete the cookies we set, but we cannot delete the ones Microsoft set on Microsoft's own domains. No website can delete another domain's cookies, that is how browsers work and it protects you more often than it hurts you. Those expire on their own, and your browser's settings will clear them immediately if you want them gone today.
9. How the authority score is produced
Part of the score is calculated automatically from the profiles and answers you give us. It is not a decision that produces legal effects for you, and it is not left to a machine: every application is read by a person before anything goes back to you. If you think the score got something wrong, reply to it and tell us, and a person will look again.
10. How long we keep things
- Waitlist entries and score applications: until you ask us to delete them, or twenty four months after our last contact with you, whichever comes first.
- Email delivery and engagement statistics: our mail provider keeps these for ninety days, after which they are no longer available even to us.
- Behaviour recordings, if you accepted them: Microsoft keeps session replays for 30 days, and up to 13 months for a session someone on our side has labelled. Heatmap data is kept for up to 13 months. After that Microsoft deletes it, including from backups, and it cannot be recovered by us or by them.
- Unsubscribe records: kept indefinitely, because the only reliable way to honour an unsubscribe is to remember it.
- Server logs: kept by our host for its own standard retention period and used only for operations and security.
- Anything we are required to keep under Spanish tax or commercial law is kept for as long as that law requires, and for nothing else.
11. Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you and give you a copy (Article 15)
- correct anything that is wrong (Article 16)
- delete it (Article 17)
- stop using it while a dispute is resolved (Article 18)
- hand it to you, or to someone else, in a machine-readable file (Article 20)
- stop processing it where we rely on legitimate interest (Article 21)
- withdraw a consent you gave, at any time, without giving a reason (Article 7(3))
Write to steeve@trusters.io. We will answer within one month, and we will not ask you to justify the request or make you fill in a form to make it. If we cannot identify you from what you send us, we may have to ask one question back.
12. Complaints
If you think we have handled your data badly, please tell us first, because it is usually something we can fix the same day. You also have the right to complain to a supervisory authority at any time, without going through us. Ours is:
- Authority
- Agencia Española de Protección de Datos (AEPD)
- Address
- C/ Jorge Juan 6, 28001 Madrid, Spain
- Website
- www.aepd.es
If you live in another EU country you may complain to the supervisory authority there instead.
13. Keeping your data safe
The site is served over HTTPS only. Access to the stored applications is limited to the people who need it to do the work. Our admin surfaces are password protected. No system is perfect, and we would rather say that than claim otherwise.
14. Changes to this policy
We will update this page when what we do changes, and the date at the top will tell you when that last happened. If a change materially affects you, for example a new tool that records how you use the site, we will not rely on you noticing a new date. We will ask.