Privacy notice

Die verbindliche deutsche Fassung findest du hier.

1. Controller

Root Alpha UG (haftungsbeschränkt), Kervenheimer Weg 70, 47665 Sonsbeck, Deutschland
E-mail: hello@thrustify.de

2. Principle: as little as possible

• Public profile and product pages set no cookies and embed no tracking and no ad networks. Fonts are served from our own servers on every surface — including the merchant dashboard — so no visit loads anything from Google or other font services. Which is why you see no cookie banner here.
• We store no order amounts. The database has no columns for shoppers' money.
• Reviewer e-mail addresses are never stored in plain text, only as an irreversible HMAC index used solely for duplicate detection.

3. Visiting the site

Our hosting provider processes technically necessary server logs (IP address, timestamp, URL, user agent) under Art. 6 (1) (f) GDPR for secure operation. Logs are deleted shortly after.

4. Applying for the beta

Through the application form we process your e-mail address, the shop URL you enter together with the detected shop system, your language, and the analysis of your shop's start page exactly as it was shown to you. Your e-mail address is stored encrypted only (AES-GCM) with an additional HMAC index for duplicate detection — never in plain text. Your IP address is not stored; it serves abuse protection (rate limiting) for a few minutes only. Legal basis: Art. 6 (1) (b) GDPR. Declined applications are deleted in full no later than 6 months after the decision, waitlist entries after 12 months — automatically, not on request.

5. Writing a review

We process your rating and text, a display name in the form "First N." — never your full name — and your e-mail address as an HMAC index together with a reference to the invitation you used (proof that a real order existed). Legal basis: Art. 6 (1) (b) and (f) GDPR. Published reviews receive a checksum so later edits are provable.

6. Receiving an invitation

Shops using Thrustify pass us an e-mail address after an order so we can invite you once. We act as their processor under Art. 28 GDPR; the shop is the controller for that transfer. We send no reminders and use the address for nothing else.

7. Merchant accounts

For the dashboard we process your e-mail address, name, shop data and sign-in logs. Sign-in uses a one-time link instead of a password. Legal basis: Art. 6 (1) (b) GDPR.

8. Cookies

We set only strictly necessary or user-initiated first-party cookies — none of them serves tracking or advertising, and none requires consent (§ 25 (2) TDDDG):

• ta_session — your merchant-dashboard sign-in (HttpOnly; session lifetime).
• ta_admin — operator-area sign-in (HttpOnly; session lifetime).
• ta_locale — the language you chose (12 months).
• ta_active_shop — your last selected shop in the dashboard.
• sidebar_state — whether the sidebar is expanded (7 days).

Public pages and the widget embedded in shops set no cookies at all.

9. Recipients

The application runs at Hostinger International Ltd. in Deutschland (EU). E-mail is sent from our own mail server on the same domain. No transfer to third countries takes place. If you take out a paid plan as a merchant in the future, the payment provider Stripe (Stripe Payments Europe Ltd., Ireland; parent company in the USA, certified under the EU-US Data Privacy Framework) handles the payment on its own pages — we embed nothing and never see your payment details.

10. Retention

Published reviews stay visible while the shop maintains its profile — public information is their purpose. We remove your review on request. Account data is deleted after the contract ends, subject to statutory retention periods.

11. Your rights

You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR). Contact hello@thrustify.de. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).