Privacy policy
Last updated 13 October 2026.
Who we are
TRSThub is a trading name of MCS Protect Limited, which is the controller of the personal data described here. MCS Protect Limited is incorporated in England and Wales as company number 17335100. Its registered office is at 71–75 Shelton Street, London, WC2H 9JQ.
In agreeing to your data being used in accordance with this policy, you also agree to it being so used by any other company that is a member of the same group of companies as MCS Protect Limited (currently there aren't any, but we ask this so that we can reorganise our structure in future).
What data we control, why, and for how long
| Data | Lawful basis | Purpose | Processed by | Retention |
|---|---|---|---|---|
| DataEmail addresses that you ask to be signed up to our mailing list. | Lawful basisThe legitimate interests of each mailbox's recipient. | PurposePreventing addresses from being subscribed to our mailing list without the recipient's consent, by sending to each a confirmation email. | Processed byVercel (runs the request); AWS (sends the confirmation email, briefly handling the address and its content). | RetentionNot stored by us; AWS does not publish a specific retention period for the email it sends. |
| DataAn irreversible cryptographic "hash" of each such address, from which the address cannot be recovered. | Lawful basisThe legitimate interests of each mailbox's recipient. | PurposeLimiting how many confirmation emails we send to one address, so our sign-up form can't be used to flood someone else's inbox. | Processed byVercel (runs the request); Neon (stores the hash). | RetentionAt least a day — could be longer, depending on how much sign-up activity there's been since. It may remain recoverable from our database backups for up to 30 days after. |
| DataYour email address, together with the versions of the sign-up wording and of this privacy policy to which you agreed, if you've accepted by clicking the relevant link in the confirmation email. | Lawful basisYour explicit consent. | PurposeKeeping you informed of TRSThub's progress and pricing. | Processed byVercel (runs each request that touches it); Neon (stores it); AWS (sends the confirmation email, briefly handling the address and content); Mailchimp (sends our progress and pricing mail-outs, holding the address for as long as you're subscribed). | RetentionFor as long as you remain subscribed; deleted when you unsubscribe, which you can do at any time using the link at the foot of our emails. It may remain recoverable from our database backups for up to 30 days after. |
| DataAn irreversible cryptographic "hash" of your email address, from which the address cannot be recovered, if you've objected by clicking the relevant link in the confirmation email. | Lawful basisA legal obligation. | PurposeAvoiding sending unsolicited emails to you. | Processed byVercel (runs the request); Neon (stores the hash). | RetentionIndefinitely, until we clear it. If you later decide you do want to subscribe, signing up again from our website won't work, so contact us directly. |
| DataYour survey answers, together with the versions of the consent statement and of this privacy policy to which you agreed. We do our best to ensure that your answers are truly anonymous, but this anonymity may be compromised if you provide directly identifying details in free text responses or if your responses are particularly unusual and/or if your responses were combined with other data sources (something that we do not do). | Lawful basisYour explicit consent, including to any special category data in your answers, such as about your sex life. | PurposeShaping our service. We don't analyse or report any breakdown of answers covering fewer than 5 people, to reduce the risk that an unusual combination of answers could be enough to work out who gave them. | Processed byVercel (runs the request); Neon (stores it); Google Workspace (for our own review of the answers). | RetentionRaw answers are deleted from our live database after 6 months, but may remain recoverable from our database backups for up to 30 days after that. Aggregate reports are anonymised separately and kept for up to 2 years. |
| DataYour web requests — the date and time, the page requested (including a confirm or stop link's one-time token, which is your email address encrypted so that only we can read it), your browser, and the result. Our host also holds your IP address internally. | Lawful basisOur legitimate commercial interest. | PurposeResponding to the request your browser makes, and keeping our website running correctly; the IP address specifically helps us find our own test requests among the logs. | Processed byVercel (runs the request, and itself keeps the log). | RetentionLogs of your requests (which never include anything you type into a form, such as your email address or survey responses) are kept for up to 30 days — a fixed limit of our hosting plan, not one we can shorten without losing other features that depend on it. |
| DataYour IP address, TLS fingerprint, and user-agent, together with our Turnstile key (which identifies this website). | Lawful basisOur legitimate interest in preventing abuse of our systems. | PurposePreventing bots from abusing our sign-up form and survey. | Processed byCloudflare (your browser connects to it directly to run the check; as our processor, and separately as an independent controller — see below); Vercel (our server also contacts Cloudflare directly afterwards to confirm the result, sending it your IP address again). | RetentionCloudflare's Turnstile Analytics dashboard provides a lookback of up to 7 days on the Free plan or 30 days on Enterprise; its processor-side and independent-controller retention outside that dashboard follows Cloudflare's published policies, which do not state a fixed period. |
| DataAnonymous page-visit analytics — the page visited, the page that referred you, your approximate location (city and country, not precise), and your device and browser type, tied to a hash that resets every 24 hours rather than to you individually (so visits from you on different days are not correlated). A confirm or stop link's one-time token is removed before this is recorded, so it never reaches our analytics provider. | Lawful basisOur legitimate commercial interest | PurposeUnderstanding how people use our website, and improving it | Processed byVercel (runs the request, and is itself the analytics provider) | RetentionAggregate analytics are retained for at least 12 months. |
Who processes it for us
- Vercel Inc, which hosts this website on its Pro plan with Observability Plus, primarily in the United States. It processes this as our processor under its Data Processing Addendum, which relies on Standard Contractual Clauses and the UK Addendum.
- Databricks, Inc, whose Neon product hosts our database in AWS's eu-west-2 London region. It processes this under the Databricks Data Processing Addendum, incorporated into the Master Cloud Services Agreement that governs our use of Neon.
- Amazon Web Services EMEA SARL, whose Simple Email Service sends our confirmation, welcome and stop-link emails from its eu-west-2 London region. It processes this under the AWS GDPR Data Processing Addendum, which incorporates Standard Contractual Clauses and applies automatically wherever GDPR applies.
- The Rocket Science Group LLC, whose Mailchimp product sends our progress and pricing mail-outs once you've confirmed your subscription. It processes this as our processor under its Data Processing Addendum, which relies on Standard Contractual Clauses.
- Google Cloud EMEA Limited, whose Google Workspace we use to review survey answers ourselves. It processes this as our processor under its Data Processing Addendum, which relies on Standard Contractual Clauses.
- Cloudflare, Inc, whose Turnstile check protects the sign-up form and the survey from bots. Your browser loads the check directly from Cloudflare, which receives your IP address, TLS fingerprint, user-agent, and this site's Turnstile key. It processes this as our processor under its Data Processing Addendum — but, under its Turnstile Privacy Addendum, it also separately acts as an independent controller of those same signals, using them under its own legitimate interest to improve Turnstile's bot-detection capabilities; that use is governed by Cloudflare's own privacy policy, not our instructions. We also use Cloudflare's Turnstile Analytics, which shows us aggregate statistics about checks run on our site, drawn from this same data.
Your rights
You can ask us for a copy of your personal data, ask us to correct or delete it, and withdraw your consent at any time. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
This also covers your survey answers where they are personal data. You can ask us to access, correct, delete or restrict them, or object to their processing, where those rights apply. Tell us the approximate date, relevant answers, or other information that may help us locate your response. If we cannot reasonably identify it from what you provide, we will explain that limitation.
To contact us about your data, email dpo@trsthub.com.
Cookies and storage
We set no cookies. Your browser stores these things only for the features you use, and each is strictly necessary for its feature:
trsthub:signed-up, which shows our thank-you message instead of the sign-up form once you've signed up.trsthub:survey-resume, the code that lets you resume the survey where you left off. We remove it when you submit your answers.trsthub:survey-completed, which notes that you've submitted the survey, so we thank you instead of starting it again. It doesn't say which answers are yours.
Cloudflare Turnstile may process signals from your device to tell people from bots.