TrustNet
Print / Save PDF
Legal · Draft

Privacy Policy

What TrustNet processes, why, who receives it, how long we keep it, and how to exercise your data-protection rights.

Document: TrustNet-Privacy-v0.2 Version: 0.2 Updated: 2026-10-21 Status: Draft — counsel review pending Audience: All users
Print / Save PDF Back to homepage

1Who we are

TrustNet is operated by SMILE SERVICES SRL, Bdul. Decebal 84, Piatra Neamț, Neamț, Romania (CUI 26286942; VAT RO26286942). We are the controller for the processing described here.

2Scope

This policy covers trustnet.app, me.trustnet.app and the TrustNet documentation. It does not cover a relying party (“RP”) website. An RP decides what it does with the claims you approve and is responsible for its own privacy notice.

3Data we process

CategoryExamplesSourceWhy / legal basis
Account and authentication Login email, password hash, passkeys, MFA factors, recovery and verification state, session metadata You Contract (Art. 6(1)(b)); security (legitimate interest, Art. 6(1)(f))
Contacts Extra email addresses and phone numbers, verification state, hashed one-time codes You Contract; consent for optional contacts
Personas and attributes Persona labels and descriptions; name, address, birthdate, contact details, pictures, files You Contract; consent when a persona discloses a claim to an RP
Consent and audit Claim names (never claim values in the audit log), consent decisions, timestamps, RP identifiers, hashed payloads; correlation metadata (account/persona references, IP, user agent) in a separately erasable store Your use of the service; the RP's request Legal obligation (Art. 6(1)(c)); legitimate interest in security and accountability (Art. 6(1)(f)); consent for the disclosure itself
Technical and security data IP address, user agent, error and security events Automatically Legitimate interest in operating and securing the service (Art. 6(1)(f))
RP operator data Business contact, tenant and RP metadata, domain-verification data, uploaded logo, webhook configuration RP operator Contract

Logging. We do not put claim values, tokens, cookies or authorization codes in logs. The audit log stores claim names and hashed payloads, not the disclosed values.

4Why we process it

  • Create and secure your account, sign you in, and manage recovery and MFA.
  • Store the identity attributes and personas you choose to create.
  • Show you what an RP asks for and disclose only the claims you approve.
  • Keep the consent and audit record that lets you and an RP verify a disclosure.
  • Operate, secure, debug and improve the service.
  • Comply with legal obligations and respond to lawful requests.

We do not sell personal data. We do not use the service to build advertising profiles, and the public site carries no analytics or marketing tags.

5Who receives data

  • The RP you are signing in to receives the pairwise subject identifier and only the claims you approve. It never receives your account id or persona id.
  • Processors that host or operate the service: DigitalOcean (cloud hosting and object storage), SMSLink / ASTINVEST COM SRL (Romania, SMS delivery for extra phone contacts) and Postale.io SAS (email delivery, France). Each processor acts under a data processing agreement, entered into before it handles personal data.
  • Ory Hydra/Kratos, Vault, PostgreSQL, RabbitMQ and Redis are self-hosted components, not third-party processors.
  • Professional advisers, auditors and authorities where required by law.

A current list of processors, their locations and the transfer position is on the Subprocessors page. Where a DPA is required, we provide it before processing begins; the DPA describes the Art. 28 terms and the TOM annex.

6International transfers

The service is hosted in the EU. Postale.io SAS is based in France (EU) and SMSLink / ASTINVEST COM SRL is based in Romania, so email and SMS delivery stay in the EEA. No third-country transfer is required for the service as currently deployed.

7How long we keep it

  • Account and persona data — while your account exists; on an erasure request the live records are deleted and the account encryption key is destroyed.
  • Contacts — while the contact is attached to your account.
  • Files and pictures — until you delete them or your account is erased.
  • Consent/audit records — the consent skeleton for the life of the account and, where an RP has a legal retention obligation, up to seven years. Authentication correlation rows (IP, user agent) are kept for 30–90 days and then deleted.
  • RP registry records — as a tombstone for audit and retention, then purged.

On an erasure request we delete or irreversibly anonymise the personal data we can. Where a persona has been used with a relying party, we also send that relying party a signed erasure notification asking it to purge its copy; we cannot delete data the relying party holds independently. We may retain the consent/audit skeleton and records needed for legal obligations, security and legal claims, for the periods above. The skeleton contains no personal data — only claim names, pairwise subject identifiers and hashes. Contact privacy@trustnet.app to start a request.

8Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate data;
  • erase data (Art. 17), subject to legal retention obligations;
  • restrict or object to processing;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting prior processing;
  • lodge a complaint with ANSPDCP.

To exercise a right, contact privacy@trustnet.app. We answer within one month; complex requests may take up to three months with notice.

Withdrawing a consent does not erase the record that consent was given; it stops future disclosures. You can also revoke an RP connection in the dashboard.

9Cookies and local storage

We use only strictly necessary session/CSRF cookies and functional browser storage. There is no analytics or advertising tracker. See the Cookie & Storage Policy for the inventory and how to clear it.

10Security

We use transport encryption, envelope encryption for stored attributes, segregated databases, least-privilege access, and an append-only, tamper-evident audit trail. No system is perfectly secure; if you believe an account is compromised, contact us immediately.

11Automated decisions

We do not make decisions with legal or similarly significant effects about you by automated means (Art. 22). Values such as over_18, email_verified and phone_number_verified are derived from data you supplied or verified; they are not automated decisions about your rights.

12Children

The service is not intended for children under 16. If you are under 16, do not create an account. If you believe a child under 16 created an account, contact us so we can remove it.

13Changes to this policy

We will publish a new version with a date and version number and, for material changes, notify you. The Terms of Service have a separate version and re-acceptance process; a privacy notice update is information, not a new contract acceptance.

14Contact

SMILE SERVICES SRL, Bdul. Decebal 84, Piatra Neamț, Neamț, Romania.
Privacy: privacy@trustnet.app
Data protection officer: Vladimir Gorea (temporary), privacy@trustnet.app