In accordance with GDPR & TDDDG

Privacy Policy

1. Data Controller

Edem Devlet
Leopoldstraße 35, 10317 Berlin
Email: support@trustscope.app

2. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. Servers are located in the EU/EEA. When you visit the website, Vercel processes technically necessary connection data (IP address, timestamp, requested URL). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable operation). More information: vercel.com/legal/privacy-policy.

3. Vercel Web Analytics

We use Vercel Web Analytics for anonymised analysis of website usage. This tool sets no cookies, collects no personal data, and creates no individual user profiles. Only aggregated, non-traceable usage statistics are recorded (e.g. pages visited, country of origin). Consent under Art. 6(1)(a) GDPR is therefore not required. More information: vercel.com/docs/analytics/privacy-policy.

4. Firebase Analytics (Google)

If you have given consent via our consent banner, we use Google Analytics for Firebase, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to analyse how this website is used (e.g. views opened, cities selected). Identifiers are stored on your device, and device and usage data (including a truncated IP address, approximate location, browser information, and event data) are transmitted to Google.

• →Purpose: Measuring reach and improving this website.
• →Legal basis: Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without consent, the service is not loaded and no data is collected.
• →Third-country transfer: Data may be transferred to Google LLC servers in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR); standard contractual clauses (Art. 46(2)(c) GDPR) apply in addition.
• →Retention: Event data is deleted by Google in accordance with the retention period we have configured, at the latest after 14 months. When you withdraw your consent, the analytics identifiers stored on your device are removed and no further data is collected.
• →Withdrawal: You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of this website (Art. 7(3) GDPR).

Google processes this data as a data processor under Art. 28 GDPR. More information: policies.google.com/privacy and firebase.google.com/support/privacy.

5. Map View (OpenFreeMap)

For the interactive map view, map tiles from OpenFreeMap (openfreemap.org) are loaded. Your browser establishes a direct connection to OpenFreeMap's servers, transmitting technically necessary connection data (including your IP address). OpenFreeMap is an open-source project; map data is based on OpenStreetMap contributions (© OpenStreetMap contributors, ODbL). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the map function). No user profiles are created and no cookies are set.

6. Location (Geolocation)

On the map, you can optionally have your location determined to center the map on your area. The request is made exclusively at your own initiative (clicking/tapping the locate button, or the first activation of the map on mobile devices) via your browser's Geolocation API. The legal basis is your consent under Art. 6(1)(a) GDPR, given through your browser's permission prompt. Your position is used only locally in your browser to center the map. Only the coordinates of the visible map area (bounding box) are sent to our API to load the venues in that area. Your exact location coordinates are never stored or shared by us, and no movement profile is created. You can revoke the permission at any time in your browser settings.

7. Email Subscription (Brevo)

This website offers the possibility to subscribe to personal updates about this project and other projects by Edem Devlet. We collect exclusively your email address. Signing up requires active consent by ticking the consent checkbox in the form.

• →Purpose: Sending personal updates about this project and related projects by the data controller.
• →Legal basis: Art. 6(1)(a) GDPR — consent given by actively ticking the consent checkbox and submitting the form.
• →Retention: Until withdrawal of consent, but no longer than 24 months after registration.
• →Withdrawal: Consent can be withdrawn at any time without giving reasons by emailing support@trustscope.app.

Your email address is transmitted to Brevo (Sendinblue SA), 106 boulevard Haussmann, 75008 Paris, France, acting as a data processor under Art. 28 GDPR. As Brevo is based in the EU, no transfer to a third country is required. More information: brevo.com/legal/privacypolicy.

8. Support the Project (Buy Me a Coffee)

This website contains a button linking to buymeacoffee.com. When you click the button, you are redirected to the external platform. Their privacy policy can be found at buymeacoffee.com/privacy-policy. We do not receive any personal data from this redirect.

9. Cookies and Local Storage

The browser's local storage (localStorage / sessionStorage) is used for technical functions (e.g. language selection, UI element display state, storing your consent decision). Consent under § 25(2) TDDDG is not required for these technically necessary storage operations. Only if you have given consent via the consent banner does Firebase Analytics additionally store identifiers (cookies or local-storage entries) to recognise your browser (see section 4). You can change your decision at any time via “Cookie settings” in the footer.

10. Review Analysis — Data from Google Maps (Art. 14 GDPR)

For the review analysis behind our trust scores, we process reviews published publicly on Google Maps. Because that data reaches us from Google rather than from the people who wrote the reviews, Art. 14 GDPR applies and this section is the notice it requires.

What is processed: a review's rating, timestamp, text, number of attached photos, the author's public review and photo totals, and whether the author uses an uploaded profile picture rather than the default avatar. Source: the publicly visible reviews Google Maps serves for a venue — never a private or purchased source. Scope: at most the 500 most recent reviews per venue, and only for venues with at least 50 reviews.

Retention: review text and author records are deleted once the analysis has been computed. What remains is Google's own review identifiers plus aggregate numbers — no review text, no names, no profile pictures. Those identifiers are pseudonymous rather than anonymous, since they can be resolved against the live Google Maps page, so we treat them as personal data.

Two limits on that deletion, stated plainly: reviews collected for a venue that is never analysed — for instance because it stays below the 50-review threshold — are not covered by it, and an author record is removed only once no collected review refers to it. Such records are retained until the venue is analysed or the data is deleted on request.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest, and that of consumers and of honest businesses, in making review manipulation visible. A documented balancing test underlies this; see also section 11. The data is not sold or passed to third parties.

We hold no contact channel for review authors, deliberately: retaining their names or profile links would mean storing more personal data than the analysis needs. Notifying each author individually is therefore impossible, and we rely on the exemption in Art. 14(5)(b) GDPR, with this publicly accessible notice as the alternative measure that provision requires. The full method is described on our methodology page.

11. Venue Trust Scores (Profiling)

A trust score is computed for a venue. Where that venue is a company, no personal data is involved. Where the venue is a natural person — a sole trader, or an individual professional such as a doctor or a lawyer — the score constitutes profiling within the meaning of Art. 4(4) GDPR, and we treat it accordingly.

Legal basis: Art. 6(1)(f) GDPR. The balance is supported by the fact that the score summarises the venue's own publicly visible reviews and introduces no new fact about anyone; that the method is published in full, so the number can be checked rather than merely believed; and that every metric can be opened to show the reviews behind it.

No automated decision within the meaning of Art. 22 GDPR is made. Nothing is granted, refused or decided on the basis of a score — it is information shown to a reader who draws their own conclusion. The metric labelled “unusual patterns” reports a statistical property of a set of reviews; it is not a finding that any particular review is fake, nor a statement about its author.

Venue owners have an unconditional route to object — see section 13 and our contacts page.

12. Where the Analysis Service Runs, and for How Long

Sections 10 and 11 describe the review analysis. It is not produced by this website: it runs on our own service at api.trustscope.app, on servers rented from Hetzner Online GmbH in Nuremberg, Germany. Everything that service stores is stored there. No data is transferred outside the EU/EEA, so none of the transfer mechanisms in Chapter V of the GDPR are needed. (The website itself is hosted separately, on Vercel — see section 2.)

Hetzner acts as a processor on our behalf, and a data processing agreement under Art. 28 GDPR is in place with them. They host the data; they do not use it for their own purposes. No further processor is involved in the analysis.

That service is configured without web-server access logging, and no CDN or reverse proxy sits in front of it. The IP address and the browser user agent of requests to it are therefore not written to any log and not retained. This applies toapi.trustscope.app only — the connection data processed for this website is described in section 2.

Retention of a venue analysis: a stored analysis is kept for as long as the venue is publicly listed on Google Maps and no objection or erasure request has been made — that is the retention criterion under Art. 5(1)(e) GDPR. An analysis older than 21 days is regenerated from fresh data the next time someone requests it, and the previous one is replaced. What the analysis retains of the underlying reviews is set out in section 10.

13. Your Rights

Under the GDPR, you have the following rights:

• →Right of access to stored data (Art. 15 GDPR)
• →Right to rectification of inaccurate data (Art. 16 GDPR)
• →Right to erasure (Art. 17 GDPR)
• →Right to restriction of processing (Art. 18 GDPR)
• →Right to object to processing (Art. 21 GDPR)
• →Right to data portability (Art. 20 GDPR)
• →Right to withdraw a given consent (Art. 7(3) GDPR)
• →Right to lodge a complaint with the supervisory authority (Art. 77 GDPR) — in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin

Please send requests to: support@trustscope.app

Objection by venue owners (Art. 21 GDPR)

If you own a venue and object to its analysis, write to the address above using the subject line:

GDPR: Objection (Art. 21) — <venue name>, <Google Maps URL>

Please include the venue's Google Maps link and your relationship to it. We answer within one month (Art. 12(3) GDPR). Where an objection is upheld, the stored analysis is deleted and the venue is excluded from any future analysis — the exclusion is enforced in our database, so a later re-scrape cannot undo it, and we also stop collecting that venue's reviews. Full instructions, including the subject lines for corrections and access requests, are on our contacts page.