1. Data Controller
Trustbeat s.r.o. is the data controller for personal data processed through the TrustBeat platform, operating under the laws of the Czech Republic and the EU General Data Protection Regulation (GDPR).
Contact: hello@trustbeat.eu
2. Data We Collect
We collect the following personal data:
- Account data — email address, company name, billing name, VAT number, billing address
- Authentication data — hashed password (bcrypt), API key hash (we never store your key in plaintext)
- Usage data — API request counts, timestamps of requests, tracking IDs
- Billing data — subscription plan, payment history (processed by Stripe — we do not store card details)
- Technical data — IP addresses (for rate limiting), request logs retained for 90 days
We never store the content of your files. Only cryptographic hashes (SHA-256) are accepted and stored.
3. How We Use Your Data
- To provide and operate the TrustBeat API service
- To process payments and manage your subscription via Stripe
- To send transactional emails (account confirmation, invoices, usage alerts)
- To comply with legal obligations, including eIDAS and tax regulations
- To detect and prevent fraud and abuse
4. Legal Basis for Processing
- Contract — processing necessary to deliver the service you signed up for
- Legal obligation — tax records, eIDAS audit trails
- Legitimate interests — security monitoring, fraud prevention, service improvement
5. Data Retention
- Account and billing data — retained for the duration of your account plus 7 years (Czech tax law)
- Qualified timestamp tokens — retained permanently (required for long-term validation under eIDAS)
- Request logs — 90 days
- After account deletion, personal data is anonymised within 30 days except where retention is legally required
6. Third-Party Processors
- Stripe — payment processing (EU data residency)
- SendGrid (Twilio) — transactional email delivery
- Hetzner — infrastructure hosting (Germany, EU)
- SK ID Solutions — qualified TSA provider (Estonia, EU)
- Grafana Cloud — log and metrics aggregation
All processors are either established in the EU or operate under Standard Contractual Clauses.
7. Your Rights (GDPR)
Under GDPR you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data (subject to legal retention obligations)
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Restriction — request restriction of processing in certain circumstances
To exercise any of these rights, contact us at hello@trustbeat.eu. We will respond within 30 days.
You also have the right to lodge a complaint with the Czech Data Protection Authority (ÚOOÚ) at uoou.cz.
8. Cookies
The TrustBeat portal uses only functional session tokens (JWT stored in localStorage) necessary for authentication. We do not use tracking or advertising cookies.
9. Changes to This Policy
We will notify registered users by email of any material changes to this policy at least 14 days before they take effect.