Privacy policy

We collect as little personal data as we can. You can use Trova without giving us your name or email, and we don't use advertising or tracking cookies.

Last updated: [EFFECTIVE DATE]

Who we are

Trova (trova.run) is run by [LEGAL ENTITY NAME], a company registered in Malta under number [COMPANY NUMBER], with its registered address at [REGISTERED ADDRESS]. We are the controller of the personal data described here, for the purposes of the EU General Data Protection Regulation (GDPR), Malta's Data Protection Act (Cap. 586) and, for people in the UK, the UK GDPR and Data Protection Act 2018.

Contact for anything about your data: [PRIVACY CONTACT EMAIL].

The short version

If you sign up for email alerts, we keep your email address and what you asked to be alerted about. You can unsubscribe at any time.
Our analytics are cookieless and count visits in aggregate. They do not identify you or follow you across sites.
Our host, Cloudflare, processes technical data such as IP addresses to deliver and protect the site.
When you click through to a retailer, the retailer or its affiliate network may set its own cookies. Their privacy policies apply from that point.
We do not sell your personal data or use it for advertising.

What we collect and why

Email alerts

If you ask us to tell you when a shoe drops in price or a successor launches, we collect:

your email address;
the products, sizes and alert types you chose;
when and how you signed up and confirmed, so we can show you agreed.

Why: to send the alerts you asked for. Lawful basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time using the unsubscribe link in every email or by emailing us. Withdrawing doesn't affect alerts already sent.

We send email through Resend. [CONFIRM: We have turned off open and click tracking in our emails.]

Analytics

We use [Plausible Analytics / Cloudflare Web Analytics] to count page views, referring sites, approximate country, and device and browser type. It does not use cookies or store anything on your device, and it does not build a profile of you. [IF PLAUSIBLE: Your IP address is used only to generate a daily-changing anonymous identifier and is not stored.]

Why: to see which pages and tools are useful and to fix what isn't. Lawful basis: our legitimate interests (Art. 6(1)(f)) in running and improving the site, which we have balanced against your privacy by using aggregated, cookieless analytics.

Hosting and security

The site is hosted and delivered by Cloudflare. Like any web server, it receives your IP address, browser details, the page you asked for and the time, and may use them to block attacks and abuse.

Lawful basis: our legitimate interests in delivering a secure, working website (Art. 6(1)(f)).

Tools and quizzes

Searches and quiz answers (for example, the shoe you loved or your bra size) are used to show your results. [CONFIRM: They are processed in your browser and are not stored by us unless you save them to an email alert.]

When you email us

If you write to us, we keep your message, your email address and our reply so we can deal with your request. Lawful basis: our legitimate interests in answering you, or where you are exercising a data protection right, our legal obligation (Art. 6(1)(c)).

What we don't do

We don't use advertising cookies, sell or rent personal data, or make decisions about you by automated means that have legal or similarly significant effects. Match results are calculated from product specs, not from a profile of you.

Affiliate links and retailer cookies

Links to shops are usually affiliate links (see our affiliate disclosure). When you click one, you leave Trova. The affiliate network and the retailer may then set cookies or use similar technology on their own sites to record that you came from us, so we can be paid if you buy. They act as separate controllers under their own privacy policies.

We receive reports of clicks and sales as totals or with an order reference. We do not receive your name, address or payment details, and we do not put personal data into the links we send you through.

Who we share it with

We use these service providers to run the site. They process data on our behalf under contracts that require them to protect it:

Provider	What for	Data
Cloudflare, Inc.	Hosting, content delivery, security	IP address, request data
Resend	Sending email alerts	Email address, alert content
[Plausible Insights OÜ / Cloudflare]	Cookieless analytics	Aggregated visit data
[EMAIL INBOX PROVIDER]	Receiving and answering email	Your messages
[DATABASE HOST, if alerts are stored outside Resend]	Storing alert subscriptions	Email address, alert choices

We may also disclose data if the law requires it, or to protect our rights, or to a buyer if the business is sold, in which case this policy would continue to apply.

International transfers

Some providers, including Cloudflare and Resend, are based in the United States or process data there. Where personal data leaves the EU/EEA or the UK, we rely on an adequacy decision (such as the EU-US Data Privacy Framework and the UK extension, for certified providers) or on the European Commission's Standard Contractual Clauses and the UK Addendum. You can ask us for details.

How long we keep it

Email alerts: while your alert is active. After you unsubscribe we delete your details within [30] days, except for a minimal suppression record so we never email you again by mistake.
Unconfirmed sign-ups: deleted after [7] days.
Emails you send us: up to [24] months after the conversation ends, unless we need them longer for a legal claim.
Server and security logs: kept by Cloudflare for its standard short periods.
Analytics: aggregated only, with no personal data to delete.

Your rights

Under the GDPR and UK GDPR you can ask us to:

give you a copy of your personal data (access);
correct it (rectification);
delete it (erasure);
limit how we use it (restriction);
send it to you or another provider in a portable format (portability);
stop using it where we rely on legitimate interests (objection);
withdraw consent at any time, where we rely on consent.

Email [PRIVACY CONTACT EMAIL]. We will reply within one month, free of charge. We may ask you to confirm your identity, usually by replying from the email address concerned.

If you live in a US state with its own privacy law, you can make the same requests and we will honour them. We do not sell or share personal data for cross-context behavioural advertising.

Complaints

Please contact us first so we can try to put things right. You also have the right to complain to a data protection authority:

Malta (our lead authority): Information and Data Protection Commissioner (IDPC), idpc.org.mt
United Kingdom: Information Commissioner's Office (ICO), ico.org.uk
Elsewhere in the EU/EEA: The data protection authority where you live or work.

[IF APPOINTED: Our UK representative under Article 27 UK GDPR is [NAME, ADDRESS, EMAIL].]

Children, security and changes

Children. Trova is not aimed at children, and email alerts are only for people aged [16] or over. If you think a child has signed up, tell us and we will delete the data.

Security. The site is served over HTTPS only. Access to subscriber data is limited to the people who need it, and our providers use encryption in transit and at rest.

Cookies. See our cookie policy.

Changes. If we change this policy we will update the date at the top. If a change materially affects how we use your email address, we will tell subscribers by email before it applies.