Privacy Policy

1. Data we collect

• Account data such as email address, display name, profile image, country and biography.
• Reviews, ratings, images, reports, replies and other information you submit.
• Verification documents such as contracts or an escritura. Only authorised moderators can view them, and they are never published.
• Technical data such as a hashed IP address, browser, device, language, timestamps and security logs.
• Sign-in details received from Google if you choose that method.

2. Why we use data

• To provide accounts, publish reviews and manage your profile — performance of our contract with you.
• To verify reviews, prevent fraud, moderate content and protect the service — our legitimate interest in a safe and trustworthy platform.
• To send account confirmations and security notices and answer questions — contract and legitimate interests.
• To comply with legal duties and handle legal claims.
• Where processing relies on consent, you may withdraw it at any time.

3. Published content

Approved reviews and your chosen display name may be public and indexed by search engines. Email addresses, verification documents and private account information are not published. Avoid including unnecessary personal data in a review.

4. AI, translation and fraud screening

Review text may be processed automatically for translation, summarisation, language detection and suspicious-behaviour screening. Automated signals assist moderators but are not used alone for decisions producing legal or similarly significant effects on you.

5. Who receives data

We share data only where needed with providers of hosting, authentication, email, security and AI processing acting for us. Data may also be disclosed when required by law, to protect rights and safety or as part of a business transfer. We do not sell personal data.

6. Transfers outside the EU/EEA

Some providers may process data outside the EU/EEA. We then use a legally recognised safeguard, such as the European Commission's Standard Contractual Clauses and supplementary security measures where needed.

7. Retention

• Account data is kept while your account is active and normally for up to 30 days after deletion, except in backups.
• Published reviews are kept while relevant to the platform's purpose and may be anonymised when an account is deleted.
• Verification documents are deleted when verification no longer needs to be substantiated, normally no later than 24 months after review closes, unless law or a dispute requires longer retention.
• Security and abuse logs are normally kept for no more than 12 months.
• Data required for legal claims is retained for the applicable limitation period.

8. Cookies and local storage

TrustCosta uses necessary local storage and similar technology for sign-in, security and language preferences. These are required for the service to work. If optional analytics or marketing is introduced, we will request consent before activation.

9. Your rights

• Request access to, correction or deletion of your data.
• Request restriction or object to processing based on legitimate interests.
• Receive data you provided in a structured format where portability applies.
• Withdraw consent without affecting earlier lawful processing.
• Complain to the Spanish Data Protection Agency (AEPD) or the data protection authority where you live.

10. Security and children

We use technical and organisational safeguards and restrict access to personal data. No online service can guarantee complete security. The service is not intended for anyone under 18, and we do not knowingly collect children's data.

11. Contact and changes

To ask questions or exercise your rights, contact info@trustcosta.com. We may update this policy and will show the new date here. Material changes will be communicated appropriately.