TrustMint

1. Who We Are

TrustMint is a review collection platform operated by KADIVEL EOOD (UIC 208282493), a company registered in Bulgaria with its registered office at 9 Boris Rumenov Str, Sofia, Bulgaria, represented by Dimitar Valchanov ("we", "us", "our"). All data is hosted on EU servers. We act as a data processor on behalf of our business customers (the data controllers) when handling end-customer personal data.

2. Data We Collect

We collect only the minimum data necessary to provide our service:

Business users: email address, password (hashed), business name, logo, review platform URLs, billing information (processed by Stripe).
Google Business Profile (optional): when you connect a profile you manage, we access and store the location, reviews and replies, profile content, and available performance data needed for the features you choose, including the owner-authorized audit.
End customers: name, email address, phone number (optional), review feedback, consent timestamp.
Automatically collected: email open/click events, review page visits, and first-party acquisition data submitted with account creation, such as landing page, referring domain, UTM campaign parameters, and advertising click identifiers.
Google Contacts (optional): if you choose to import contacts via Google, we access your contact names, email addresses, and phone numbers through the Google People API.

3. How We Use Your Data

To send review request emails on behalf of businesses.
To display review landing pages.
To provide analytics and reporting to business users.
To process payments via Stripe.
To send transactional emails (account confirmation, password reset).
To prepare the owner-authorized Google Business Profile audit and provide the connected product features you choose.
To measure which TrustMint pages and advertising campaigns lead to account setup, product activation, and paid subscriptions.
To import customer contacts from Google when you explicitly initiate the import.

4. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Art. 6):

Contract performance: to provide the TrustMint service to business users.
Legitimate interest: to send review requests on behalf of businesses to their existing customers.
Consent: where required, consent is recorded with a timestamp in our consent log.

5. Data Retention

Business account data is retained for the duration of the account plus 30 days after deletion.
End-customer data is retained until the business user deletes it or the account is closed.
Billing records are retained as required by EU tax law (typically 7 years).
Email tracking data (opens, clicks) is retained for 12 months.
Connected Google Business Profile data and acquisition data are retained with the business account and follow the account deletion period above.

6. Data Sharing

We do not sell personal data. We share data only with:

Brevo (Sendinblue): email delivery (EU servers).
Stripe: payment processing (certified EU-US Data Privacy Framework).
Heroku / Salesforce: hosting infrastructure (EU region).
Google: optional business lookup during setup, Google Business Profile connection and audit, and Google Contacts import when initiated by you.

7. Google API Services

TrustMint's optional business finder uses Google Maps Platform during setup. A business search query and selected place identifier are processed through the Places API to help you identify your own location. The owner-authorized audit does not use Places data or automated nearby-business comparisons. Google's processing is governed by the Google Privacy Policy.

The optional Google Business Profile connection uses the business.manage scope. Google provides this broad management permission rather than a separate audit-only permission. We use it to read the profile data required for the audit and connected features, and to perform a profile action only when you explicitly initiate that action.

Business Profile data: locations, reviews and replies, owner-maintained profile fields, services, attributes, posts and media, plus available performance signals.
How it is used: to monitor the selected profile, build its audit, show analytics, and complete actions you explicitly request, such as posting a review reply.
Storage and control: OAuth tokens and connected profile data are stored securely with your account. You can disconnect Google in Settings, which removes the stored tokens.
Deletion: connected Google data is deleted under the account deletion process described above.

TrustMint also offers an optional Google Contacts import using the Google People API and the read-only contacts.readonly scope. We access contact names, email addresses, and phone numbers only when you initiate an import. Imported contacts become customer records in your account and can be deleted at any time.

Google user data is not sold or used for advertising, and is not shared with third parties except as required to deliver the TrustMint feature you requested.

TrustMint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Your Rights (GDPR)

As a data subject in the EU, you have the right to:

Access your personal data.
Rectify inaccurate data.
Erase your data ("right to be forgotten").
Restrict processing of your data.
Data portability - receive your data in a machine-readable format.
Object to processing based on legitimate interest.
Withdraw consent at any time.

End customers can unsubscribe from review requests using the link in every email. Business users can export or delete their data from the Settings page.

9. Cookies

We use essential cookies required for session management, security, authentication, and preserving an audit or signup handoff. The audit-intent handoff expires after 2 days and the signed first-touch attribution handoff expires after 30 days. TrustMint records campaign parameters server-side when you create an account. We do not currently load third-party advertising or analytics tags, and we do not use this information to track your browsing across other websites.

10. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Passwords are hashed using bcrypt. We conduct regular security reviews and follow OWASP best practices.

11. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. The competent authority for KADIVEL EOOD is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria - www.cpdp.bg.

12. Contact

For privacy-related inquiries or to exercise your rights, contact us at support@trustmint.co.