Privacy notice (draft)

Draft until the operator has sighted it; placeholders in brackets are filled by the operator, never invented.

Controller

Björn Bösenberg, Finowstraße 17, 10247 Berlin, Germany. contact@trustillery.com.

What the hub stores about an account

Your e-mail address, the pseudonym you chose, timestamps, your passkeys (a public key and its credential id, never a biometric), and your sessions (an opaque token, the client's IP address and user agent). Nothing else is asked at sign-up. Sign-ups, sign-ins, passkey changes, session revocations and failed sign-in attempts are recorded in an append-only audit log with a timestamp and the acting account.

If a notice is received on a stock you released, the hub asks you once to confirm the stock's legal notice. The confirmation is stored as a row with the date, the confirmed name and address and your account, for as long as the stock is on the hub, because it answers who is responsible for the stock; no identity document is asked for or stored.

Legal basis and retention

Art. 6(1)(b) GDPR for the account itself; Art. 6(1)(f) GDPR for the audit log, which protects accounts and the published stocks against abuse. An account is deleted on request; audit rows are kept [retention] and then deleted.

Subprocessors

• Railway Corporation, hosting and the database, region EU West (Amsterdam); data processing addendum with standard contractual clauses.
• INWX GmbH & Co. KG, Berlin, Germany: delivery of the sign-in link to your e-mail address through the operator's mailbox relay (no-reply@trustillery.com); servers in Berlin. The successor named in advance is Scaleway Transactional Email (Paris, France); a switch is recorded as a decision and shown here before it takes effect.

Your rights

Access, rectification, erasure, restriction, portability and objection under Art. 15 to 21 GDPR, and a complaint to a supervisory authority. Write to the address above.