In accordance with GDPR & TDDDG

Privacy Policy

1. Data Controller

Edem Devlet
Leopoldstraße 35, 10317 Berlin
Email: support@trustscope.app

2. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. Servers are located in the EU/EEA. When you visit the website, Vercel processes technically necessary connection data (IP address, timestamp, requested URL). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable operation). More information: vercel.com/legal/privacy-policy.

3. Vercel Web Analytics

We use Vercel Web Analytics for anonymised analysis of website usage. This tool sets no cookies, collects no personal data, and creates no individual user profiles. Only aggregated, non-traceable usage statistics are recorded (e.g. pages visited, country of origin). Consent under Art. 6(1)(a) GDPR is therefore not required. More information: vercel.com/docs/analytics/privacy-policy.

4. Firebase Analytics (Google)

If you have given consent via our consent banner, we use Google Analytics for Firebase, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to analyse how this website is used (e.g. views opened, cities selected). Identifiers are stored on your device, and device and usage data (including a truncated IP address, approximate location, browser information, and event data) are transmitted to Google.

• →Purpose: Measuring reach and improving this website.
• →Legal basis: Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without consent, the service is not loaded and no data is collected.
• →Third-country transfer: Data may be transferred to Google LLC servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR); standard contractual clauses (Art. 46(2)(c) GDPR) apply in addition.
• →Retention: Event data is deleted by Google in accordance with the retention period we have configured, at the latest after 14 months. When you withdraw your consent, the analytics identifiers stored on your device are removed and no further data is collected.
• →Withdrawal: You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of this website (Art. 7(3) GDPR).

Google processes this data as a data processor under Art. 28 GDPR. More information: policies.google.com/privacy and firebase.google.com/support/privacy.

5. Venue Map (Google Maps)

On a venue's page we can show its location on a map embedded via the Google Maps Embed API, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The map is loaded only if you have enabled "Venue map (Google Maps)" in our consent banner. Until then the card shows the venue's address and a link you can follow yourself, and no connection to Google is made. Once the map is loaded, your browser connects directly to Google and transmits your IP address, browser information (user agent) and the address of the page you are on; Google may store and read identifiers (cookies or local-storage entries) on your device.

• →Purpose: Showing where a venue is located.
• →Legal basis: Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. The map is not required in order to use this website, so it rests on your consent alone.
• →Recipient and role: Google receives this data as an independent controller and processes it for its own purposes. We have neither influence over nor access to that processing.
• →Third-country transfer: Data may be transferred to Google LLC servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR); standard contractual clauses (Art. 46(2)(c) GDPR) apply in addition.
• →Withdrawal: You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer (Art. 7(3) GDPR). The map is removed immediately and no further connection to Google is made. Identifiers Google has already stored under its own domain are outside our reach; you can remove them through your browser settings or Google’s own controls.

More information: policies.google.com/privacy and google.com/help/terms_maps.

6. Map View (OpenFreeMap)

For the interactive map view, map tiles from OpenFreeMap (openfreemap.org) are loaded. Your browser establishes a direct connection to OpenFreeMap's servers, transmitting technically necessary connection data (including your IP address). OpenFreeMap is an open-source project; map data is based on OpenStreetMap contributions (© OpenStreetMap contributors, ODbL). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the map function). No user profiles are created and no cookies are set.

7. Location (Geolocation)

On the map, you can optionally have your location determined to center the map on your area. The request is made exclusively at your own initiative (clicking/tapping the locate button, or the first activation of the map on mobile devices) via your browser's Geolocation API. The legal basis is your consent under Art. 6(1)(a) GDPR, given through your browser's permission prompt. Your position is used only locally in your browser to center the map. Only the coordinates of the visible map area (bounding box) are sent to our API to load the venues in that area. Your exact location coordinates are never stored or shared by us, and no movement profile is created. You can revoke the permission at any time in your browser settings.

Country detection. Independently of the above, the site opens on the country you are in, so that the rankings and search results shown are the ones that concern you. This does not use the Geolocation API and asks you for nothing: the country is derived from the IP address that our hosting provider (Vercel) already receives with your request, and nothing finer than the country is read — no city, no coordinates. The IP address is not logged by us, is not passed to any third-party geolocation service, and leaves no record. Nothing is written to your device in the process. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing you the relevant part of the site); § 25 TDDDG does not apply, because the IP address is transmitted with your request rather than read from your device. You can override the detected country at any time using the country selector in the footer. Only a country you select yourself is stored on your device (local storage, until you change or clear it) — a merely detected country never is.

8. Email Subscription (Brevo)

This website offers the possibility to subscribe to personal updates about this project and other projects by Edem Devlet. We collect exclusively your email address. Signing up requires active consent by ticking the consent checkbox in the form.

• →Purpose: Sending personal updates about this project and related projects by the data controller.
• →Legal basis: Art. 6(1)(a) GDPR - consent given by actively ticking the consent checkbox and submitting the form.
• →Retention: Until withdrawal of consent, but no longer than 24 months after registration.
• →Withdrawal: Consent can be withdrawn at any time without giving reasons by emailing support@trustscope.app.

Your email address is transmitted to Brevo (Sendinblue SA), 106 boulevard Haussmann, 75008 Paris, France, acting as a data processor under Art. 28 GDPR. As Brevo is based in the EU, no transfer to a third country is required. More information: brevo.com/legal/privacypolicy.

9. Support the Project (Buy Me a Coffee)

This website contains a button linking to buymeacoffee.com. When you click the button, you are redirected to the external platform. Their privacy policy can be found at buymeacoffee.com/privacy-policy. We do not receive any personal data from this redirect.

10. Cookies and Local Storage

The browser's local storage (localStorage / sessionStorage) is used for technical functions (e.g. language selection, UI element display state, and storing your consent decision). Consent under § 25(2) TDDDG is not required for these technically necessary storage operations. Only if you have given consent via the consent banner does Firebase Analytics additionally store identifiers (cookies or local-storage entries) to recognise your browser (see section 4), and the embedded Google map stores and reads identifiers under Google's own domain once you enable it (see section 5). You can change your decision at any time via “Cookie settings” in the footer.

11. Review Analysis - Data from Google Maps (Art. 14 GDPR)

For the review analysis behind our trust scores, we process reviews published publicly on Google Maps. Because that data reaches us from Google rather than from the people who wrote the reviews, Art. 14 GDPR applies and this section is the notice it requires.

What is processed: a review's rating, timestamp, text, number of attached photos, the author's public review and photo totals, and whether the author uses an uploaded profile picture rather than the default avatar. Source: the publicly visible reviews Google Maps serves for a venue - never a private or purchased source. Scope: at most the 500 most recent reviews per venue, and only for venues with at least 50 reviews.

Retention: review text and author records are deleted once the analysis has been computed. What remains is Google's own review identifiers plus aggregate numbers - no review text, no names, no profile pictures. Those identifiers are pseudonymous rather than anonymous, since they can be resolved against the live Google Maps page, so we treat them as personal data.

Two limits on that deletion, stated plainly: reviews collected for a venue that is never analysed - for instance because it stays below the 50-review threshold - are not covered by it, and an author record is removed only once no collected review refers to it. Such records are retained until the venue is analysed or the data is deleted on request.

Legal basis: Art. 6(1)(f) GDPR - our legitimate interest, and that of consumers and of honest businesses, in making review manipulation visible. A documented balancing test underlies this; see also section 12. The data is not sold or passed to third parties.

We hold no contact channel for review authors, deliberately: retaining their names or profile links would mean storing more personal data than the analysis needs. Notifying each author individually is therefore impossible, and we rely on the exemption in Art. 14(5)(b) GDPR, with this publicly accessible notice as the alternative measure that provision requires. The full method is described on our methodology page.

12. Venue Trust Scores (Profiling)

A trust score is computed for a venue. Where that venue is a company, no personal data is involved. Where the venue is a natural person - a sole trader, or an individual professional such as a doctor or a lawyer - the score constitutes profiling within the meaning of Art. 4(4) GDPR, and we treat it accordingly.

Legal basis: Art. 6(1)(f) GDPR. The balance is supported by the fact that the score summarises the venue's own publicly visible reviews and introduces no new fact about anyone; that the method is published in full, so the number can be checked rather than merely believed; and that every metric can be opened to show the reviews behind it.

No automated decision within the meaning of Art. 22 GDPR is made. Nothing is granted, refused or decided on the basis of a score - it is information shown to a reader who draws their own conclusion. The metric labelled “unusual patterns” reports a statistical property of a set of reviews; it is not a finding that any particular review is fake, nor a statement about its author.

Venue owners have an unconditional route to object - see section 14 and our contacts page.

13. Where the Analysis Service Runs, and for How Long

Sections 11 and 12 describe the review analysis. It is not produced by this website: it runs on our own service at api.trustscope.app, on servers rented from Hetzner Online GmbH in Nuremberg, Germany. Everything that service stores is stored there. No data is transferred outside the EU/EEA, so none of the transfer mechanisms in Chapter V of the GDPR are needed. (The website itself is hosted separately, on Vercel - see section 2.)

Hetzner acts as a processor on our behalf, and a data processing agreement under Art. 28 GDPR is in place with them. They host the data; they do not use it for their own purposes. No further processor is involved in the analysis.

That service is configured without web-server access logging, and no CDN or reverse proxy sits in front of it. The IP address and the browser user agent of requests to it are therefore not written to any log and not retained. This applies toapi.trustscope.app only - the connection data processed for this website is described in section 2.

Retention of a venue analysis: a stored analysis is kept for as long as the venue is publicly listed on Google Maps and no objection or erasure request has been made - that is the retention criterion under Art. 5(1)(e) GDPR. An analysis older than 21 days is regenerated from fresh data the next time someone requests it, and the previous one is replaced. What the analysis retains of the underlying reviews is set out in section 11.

14. Your Rights

Under the GDPR, you have the following rights:

• →Right of access to stored data (Art. 15 GDPR)
• →Right to rectification of inaccurate data (Art. 16 GDPR)
• →Right to erasure (Art. 17 GDPR)
• →Right to restriction of processing (Art. 18 GDPR)
• →Right to object to processing (Art. 21 GDPR)
• →Right to data portability (Art. 20 GDPR)
• →Right to withdraw a given consent (Art. 7(3) GDPR)
• →Right to lodge a complaint with the supervisory authority (Art. 77 GDPR) - in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin

Please send requests to: support@trustscope.app

Objection by venue owners (Art. 21 GDPR)

If you own a venue and object to its analysis, write to the address above using the subject line:

GDPR: Objection (Art. 21) - <venue name>, <Google Maps URL>

Please include the venue's Google Maps link and your relationship to it. We answer within one month (Art. 12(3) GDPR). Where an objection is upheld, the stored analysis is deleted and the venue is excluded from any future analysis - the exclusion is enforced in our database, so a later re-scrape cannot undo it, and we also stop collecting that venue's reviews. Full instructions, including the subject lines for corrections and access requests, are on our contacts page.