Privacy
What we keep, why, who sees it, and for how long. Last updated 14 October 2026.
Who we are
TrustHunt (trusthunt.co.uk) is run by Tejveer Singh, a sole trader trading as TrustHunt, in the United Kingdom. We decide how your personal data is used, so we’re the “controller” under UK data protection law. Questions or requests: [email protected].
What we keep, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address | To sign you in with an emailed link and send emails you ask for | Providing the service you signed up for (contract) |
| Account details you choose to add: name, role, sector, organisation size, company name | To show your role on questions, count votes by role, put your company on templates | Contract |
| Votes, shortlists, watches, questions, exports and pages you view | Rankings, change alerts, your shortlist, and anonymous counts for makers | Our legitimate interest in running a fair, useful launch board |
| Weekly email sign-up (email address) | To send “5 tools, checked” | Your consent, which you confirm by email and can withdraw any time |
| Reports that a card is out of date, with your email if you give it | To fix the card and reply to you | Legitimate interest |
| Makers’ tool details and evidence links | To publish and check trust cards | Contract |
| A one-way hash of your IP address | To stop sign-in, sign-up and report forms being abused (rate limits) | Legitimate interest in keeping the service secure |
We don’t sell your data, use it for advertising, or build profiles about you.
Who can see it
- Makers see counts (views, shortlists, watches, exports). They see your role, sector and organisation size when you shortlist or watch their tool, unless you turn that off in your account. They see your name and email only if you tick “open to contact”.
- Everyone can see questions you ask on a tool page, labelled with your role, never your name or email.
- Our suppliers, who handle data for us under contract: Cloudflare (hosting, database and security; its network is global, including the US) and Resend (sending email). Where data leaves the UK, these providers use the standard UK data transfer safeguards (the UK Addendum to the EU Standard Contractual Clauses or equivalent).
- Google Fonts: pages load their typeface from Google, which receives your IP address when it does.
How long we keep it
- Sign-in links: 20 minutes, and they work once. Signed-in sessions: 30 days.
- Your account, votes, shortlists, watches and questions: until you ask us to delete your account.
- Weekly email: until you unsubscribe (one click, at the bottom of every email).
- Out-of-date reports: until the card is fixed, then up to 12 months.
- Rate-limit counters: hashed, reset after an hour or a day.
Cookies and browser storage
We set one cookie, only when you sign in, to keep you signed in. It’s essential, so we don’t ask for consent. There are no analytics, tracking or advertising cookies. Notes you type on the Compare page are saved only in your own browser.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email [email protected]; we reply within one month. You can change your role, sector and what makers see in your account at any time, and unsubscribe from any email in one click.
If you’re unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.
Changes
If we change this notice in a way that matters, we’ll say so on this page and, for big changes, email account holders.