Privacy Policy

1. Controller

The controller responsible for the processing of personal data is:

Email: brian@thetrustengine.co

No data protection officer has been appointed because there is currently no legal obligation to appoint one.

2. Legal bases for processing

Depending on the circumstances, personal data is processed on one or more of the following legal bases:

• Article 6(1)(a) GDPR: you have given consent.
• Article 6(1)(b) GDPR: processing is necessary to respond to a request, arrange a call, or take steps before entering into a contract.
• Article 6(1)(c) GDPR: processing is necessary to comply with a legal obligation.
• Article 6(1)(f) GDPR: processing is necessary for a legitimate interest, such as securely operating the website, preventing misuse, and responding to business inquiries.

Where processing is based on legitimate interests, those interests are described in the relevant section below.

3. Website hosting

The main Trust Engine website is hosted by Vercel.

When you visit the website, Vercel may process technical information required to deliver and protect the site. This may include:

• IP address;
• date and time of the request;
• requested page or file;
• browser and device information;
• referring page; and
• technical log and security information.

This processing is necessary to provide the website, maintain its security, diagnose errors, and prevent misuse. The legal basis is Article 6(1)(f) GDPR.

Technical log data is retained only for as long as it is needed for website delivery, security, troubleshooting, and any applicable legal obligations.

Read the Vercel Privacy Notice ↗

4. Cookies and analytics on the main website

The main Trust Engine website does not currently use advertising trackers, marketing cookies, or audience analytics. It does not set non-essential cookies through its own website code.

This statement may be updated if analytics, advertising, embedded media, or additional tracking technologies are introduced later.

5. Story Gap Scorecard

The Story Gap Scorecard is available at scorecard.thetrustengine.co.

Score calculation

Your answers are processed to calculate and display your scorecard result. You can view the result without providing an email address.

The answers and calculated result may include:

• answers to the scorecard statements;
• total score and percentage;
• scores for individual sections;
• identified Story Gap or result category; and
• a result identifier used to retrieve or associate the result.

The purpose of this processing is to provide the scorecard and its personalized result. The legal basis is Article 6(1)(b) GDPR, because the processing is necessary to provide the assessment you requested.

The scorecard is informational. It does not make decisions that produce legal or similarly significant effects.

Email follow-up and Personal Innovation newsletter

After viewing your score, you may choose to receive a five-part email follow-up based on your result and subscribe to Brian Tomlinson's Personal Innovation newsletter.

If you subscribe, the following information may be collected:

• first name;
• work email address;
• score and result category;
• optional company website;
• optional role;
• optional company size;
• optional information about how you heard about Trust Engine; and
• email delivery and engagement information.

This information is used to deliver the five-part Story Gap follow-up sequence, tailor the follow-up to your scorecard result, send the Personal Innovation newsletter after the sequence, and administer the subscription, including unsubscribe requests.

The legal basis is your consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time by using the unsubscribe link included in each email or by contacting brian@thetrustengine.co. Withdrawal does not affect processing that took place before consent was withdrawn.

Email communications are delivered using Kit. Kit processes subscriber information on behalf of Trust Engine.

Read the Kit Privacy Policy ↗

Subscriber and result data is retained until you unsubscribe, request deletion, or the Personal Innovation newsletter is discontinued. A limited suppression record may be retained after you unsubscribe to ensure that your request continues to be respected and to demonstrate compliance with applicable law.

Scorecard hosting and security

The scorecard is built and hosted using Lovable and supporting infrastructure. Lovable may process technical usage, event, and log data required to operate, secure, and maintain the scorecard.

Read the Lovable Privacy Policy ↗

Cloudflare is used to deliver and protect the scorecard. Cloudflare may process IP addresses and technical request information to detect malicious traffic and protect the service.

Cloudflare may set a strictly necessary security cookie, currently named __cf_bm. This cookie supports bot detection and ordinarily expires after approximately 30 minutes of inactivity. It is not used by Trust Engine for advertising.

Read Cloudflare's cookie documentation ↗

External fonts

The scorecard currently obtains certain font files from Google Fonts. When the scorecard loads, the visitor's browser connects to Google's servers. The visitor's IP address, browser information, and details required to provide the font file may therefore be transmitted to Google.

Google may process this information under its own privacy terms.

Read about the Google Fonts API ↗

6. Contacting Trust Engine

If you contact me by email, I process the information you provide. This will normally include your name, email address, company or role if provided, the contents of your message, and any documents or information you choose to include.

The information is used to answer your inquiry and, where relevant, discuss a possible working relationship.

The legal basis is Article 6(1)(b) GDPR when the message concerns services or a possible contract. For other inquiries, the legal basis is Article 6(1)(f) GDPR, based on the legitimate interest in responding to messages addressed to the business.

Messages are retained for as long as necessary to handle the inquiry. If the correspondence results in a client relationship, relevant records may be retained for the applicable statutory commercial and tax retention periods.

7. Email hosting through Google Workspace

Trust Engine uses Google Workspace to manage business email.

When you send an email to a Trust Engine address, Google may process the message, associated contact information, delivery information, and technical metadata required to provide, secure, and maintain the email service.

The legal basis depends on the purpose of the correspondence, as described above. Technical processing necessary to maintain a secure and reliable email service is based on Article 6(1)(f) GDPR.

Google may process data outside the European Economic Area. Where required, transfers are protected through applicable adequacy decisions, the EU–US Data Privacy Framework, Standard Contractual Clauses, or other recognized safeguards.

Read Google's Privacy Policy ↗

8. Story Teardown form

The Story Teardown form on the website prepares an email in your own email application. The website itself does not directly submit or store the contents of that form.

If you send the prepared email, its contents are processed in the same way as other direct email enquiries described above.

9. Booking a call with Cal.com

The website links to Cal.com for appointment scheduling.

If you open the booking page or arrange a call, Cal.com may process your name, email address, selected date and time, answers to booking questions, time zone, IP address, and browser information.

The information is used to schedule and administer the requested call. The legal basis is Article 6(1)(b) GDPR.

Cal.com processes booking information as a service provider. Cal.com may also process certain technical information for its own security and service-administration purposes.

Read the Cal.com Privacy Policy ↗

10. External links

The website may contain links to third-party websites, including LinkedIn.

When you follow an external link, the operator of that website is responsible for the processing that occurs there. This Privacy Policy does not govern independent third-party websites.

11. Service providers and recipients

Personal data may be processed by service providers used to operate the website and respond to requests. Depending on which features you use, these may include:

• Vercel, for hosting the main website;
• Lovable, for operating the scorecard;
• Cloudflare, for scorecard delivery and security;
• Kit, for the scorecard follow-up and Personal Innovation newsletter;
• Cal.com, for appointment scheduling;
• Google Workspace, for business email; and
• Google, while externally hosted fonts remain active on the scorecard.

These providers receive only the information needed to perform their respective services.

Data may also be disclosed where required by law, necessary to establish or defend legal claims, or needed to protect the website and its users from misuse.

12. International data transfers

Some service providers operate in, or may allow access to data from, countries outside the European Economic Area, including the United States.

Where required, these transfers are protected through an adequacy decision, participation in the EU–US Data Privacy Framework, European Commission Standard Contractual Clauses, or another legally recognized safeguard.

Information about the safeguards used by an individual provider is available in that provider's privacy notice.

13. Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected.

The applicable retention period depends on the type of information:

• technical logs are retained according to operational and security requirements;
• inquiries are retained until they have been answered and are no longer needed;
• appointment information is retained for as long as necessary to administer and document the business contact;
• scorecard and newsletter data is retained until consent is withdrawn, deletion is requested, or the newsletter is discontinued;
• records connected with a client relationship may be retained for applicable statutory commercial and tax periods; and
• unsubscribe or objection records may be retained to ensure that the request continues to be respected.

Information may be retained for longer where this is required by law or necessary for the establishment, exercise, or defense of legal claims.

14. Your rights

Subject to the conditions of the GDPR, you have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• request restriction of processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time; and
• lodge a complaint with a data protection supervisory authority.

If you object to the use of your personal data for direct marketing, that objection will be respected without requiring you to provide a reason.

To exercise your rights, contact brian@thetrustengine.co. I may need to request information necessary to confirm your identity before fulfilling a request.

15. Supervisory authority

You have the right to lodge a complaint with a data protection authority. The authority responsible for a controller established in Hamburg is generally:

Website: datenschutz-hamburg.de ↗
Email: mailbox@datenschutz.hamburg.de

You may also contact another supervisory authority where the GDPR permits.

16. Security

The website uses encrypted HTTPS connections.

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, loss, misuse, or alteration. No internet transmission or storage system can, however, be guaranteed to be completely secure.

17. Changes to this Privacy Policy

This Privacy Policy may be updated when the website, scorecard, service providers, or legal requirements change.

The current version will always be published on this page with its latest revision date.