Privacy Policy
Effective 24 July 2026. This policy covers the TrueTotal website and API — the honest true-cost comparison engine, at truetotalcalculator.com.
This is a starting draft prepared for the operators of TrueTotal, describing how the software processes data today. It is not legal advice and is not a substitute for review by a qualified data-protection lawyer. Before publishing, have counsel review it, and replace every [bracketed placeholder] — including the legal entity, registered address, and any Data Protection Officer or EU representative details — with your real, verified information. Do not rely on this document as-is.
1. Who we are
TrueTotal is operated by [REGISTERED COMPANY NAME AND ADDRESS — TO BE COMPLETED] (the “operator”, “we”, “us”). We are the data controller for the processing described here. For any privacy question or to exercise your rights, contact privacy@truetotalcalculator.com. If a Data Protection Officer or an EU/UK representative is appointed, their contact details will be listed here before publication.
2. What we process, and why
We keep our data collection deliberately narrow. We do not run advertising, analytics, or cross-site tracking, we do not build behavioural profiles of visitors, and we do not sell personal data — that last point is a product principle, not just a promise. The table below lists everything we actually record.
| WHAT | WHEN / SOURCE | WHY | LAWFUL BASIS |
|---|---|---|---|
| Click event — timestamp, listing, partner, SubID, destination path, plus coarse referer and user-agent header | Following a labelled affiliate link (the /go redirector) | Attribute a later sale to the click that led to it; detect click fraud and abuse; keep the outbound redirector safe | Legitimate interest |
| Conversion postback — order id, sale value, our commission, status (pending/approved/rejected/reversed), currency, and the partner’s raw parameters (secret stripped) | Server-to-server callback from the affiliate network, authenticated with a shared token | Reconcile the commission the network reports against the click that earned it; audit disputes | Legitimate interest; legal obligation (accounting) |
| Cookie preferences — your language choice and your consent record (policy version + timestamp) | Your browser (first-party cookies tt_locale, tt_consent) | Remember your language and honour your choice on the cookie notice | Legitimate interest (functional); consent (any future non-essential cookie) |
| Server logs — structured request lines carrying an x-request-id; values that look like secrets are automatically redacted | Our infrastructure, on every request | Operate, secure, and debug the service; short retention | Legitimate interest |
A note on identifiers: the SubID is a per-click reference we generate and pass to the partner. It is the join key that later lets a conversion postback be matched back to the click that earned it. On its own it is a pseudonymous token, but combined with the click’s timestamp, coarse user-agent and referer it may constitute personal data under GDPR, so we treat it as such. We do not knowingly collect special-category data, and we ask partners not to send it in postbacks.
3. Advertising and analytics: where we stand
We want to be unambiguous, because it drives everything above: TrueTotal loads no third-party advertising pixels and no cross-site trackers, and the only cookies we set are a functional language cookie, your consent record, and — for internal operators only — a login cookie. See the Cookie Policy for the full, itemised list.
We currently run no analytics of any kind — not even privacy-preserving counters. If that ever changes, this section will describe the exact tool before it is switched on, not after.
4. Lawful bases (GDPR Article 6)
Where GDPR applies, we rely on the following legal bases:
- Legitimate interests (Art. 6(1)(f)) — for attribution of sales to clicks, fraud and abuse prevention, securing the outbound redirector, and operating and debugging the service. We have weighed these interests against your rights; the processing is limited to what reconciliation and security actually require.
- Consent (Art. 6(1)(a)) — for any future non-essential cookie or measurement. None runs today; the consent record simply gates anything we might add later. You can withdraw consent at any time.
- Contract and legal obligation (Art. 6(1)(b) / (c)) — where relevant, e.g. keeping commission and transaction records for accounting, tax, and audit purposes.
5. Who we share data with
Affiliate partners. When you follow a labelled affiliate link, we redirect you to the partner and pass along the click and its SubID only. We do not send partners a personal profile, your identity, or your browsing history. Once you are on the partner’s site you are subject to their privacy and cookie policies, which we do not control.
Infrastructure and subprocessors. We rely on a small number of service providers to run TrueTotal — for example application hosting, an optional managed Postgres database for the click and conversion history, and optional error-monitoring. These providers process data on our instructions under written terms. (We name no specific vendors in this draft; the operators must maintain an accurate, current subprocessor list and complete it before publication.)
We may also disclose data where required by law, to establish or defend legal claims, or to protect the service and its users against fraud and abuse.
6. Retention and the append-only record
The click and conversion history is append-only: each click is written once, and each conversion postback is stored as its own immutable event, with the current state of an order being the latest event for that order id. This design is what makes reconciliation trustworthy — status transitions (pending → approved → reversed) are captured without ever rewriting history. We retain this record for as long as needed to reconcile commissions and meet accounting and audit obligations, then review it for minimisation.
We should be honest about the tension this creates with the right to erasure. Because the log is append-only, we do not satisfy an erasure request by silently rewriting past events. Instead, an erasure or objection request is honoured by an operational process that removes or irreversibly pseudonymises the linkable identifier — principally the SubID and the coarse user-agent/referer — so the remaining financial record (order id, sale, commission) can no longer be tied back to an individual, while the aggregate accounting figures that we are legally required to keep survive. Server logs, which carry only a request id and have secrets redacted at write time, age out on a short retention schedule. The exact mechanism, retention periods, and how they interact with statutory bookkeeping duties are decisions the operators must finalise with counsel.
7. International transfers
TrueTotal is operated from Ireland/the EU, but some subprocessors may process data outside the EEA. Where that happens, we rely on an appropriate transfer mechanism — an adequacy decision where one exists, or the European Commission’s Standard Contractual Clauses together with any additional safeguards the transfer requires. Details will be listed alongside the subprocessor list.
8. Children
TrueTotal is a general-audience comparison tool and is not directed to children. We do not knowingly collect personal data from anyone under the age of 16 (or under 13 where a lower age applies). If you believe a child has provided us data, contact us and we will delete it.
9. Security
Security measures reflected in the software today include:
- Traffic served over TLS.
- Structured server logs that redact secret-looking values (tokens, keys, cookies, authorization headers) before they are ever written.
- Internal operator consoles are gated behind login and excluded from search indexing.
- Conversion postbacks are authenticated with a shared secret using a constant-time comparison, and the secret is stripped from any stored audit copy of the request.
- The outbound redirector only ever forwards to an allowlisted partner host that matches the listing, preventing open-redirect abuse.
No system is perfectly secure, but we aim to keep the attack surface and the data we hold small by design.
10. Your rights
Depending on where you live, you have rights over your personal data. Under the GDPR these include the rights of access, rectification, erasure, portability, objection (including to processing based on legitimate interests), and restriction of processing, plus the right to withdraw consent. Under California’s CCPA/CPRA you have rights to know, delete, correct, and to opt out of the “sale” or “sharing” of personal information — and we do not sell or share personal information for cross-context behavioural advertising, so that opt-out is already the default for everyone.
To exercise any right, email privacy@truetotalcalculator.com. We may need to verify your request, and — because our attribution record is keyed on the SubID rather than your name — we may ask you for the SubID or link you used so we can locate the relevant events. We will respond within the timeframes the applicable law requires. You also have the right to lodge a complaint with a supervisory authority; in Ireland that is the Data Protection Commission (dataprotection.ie), or the authority in your country of residence.
11. Cookies
Our use of cookies — one functional locale cookie, your consent record, and an operator-only login cookie — is described in full, including lifetimes, in the Cookie Policy. There are no advertising or analytics cookies.
12. Changes to this policy
We will update this policy when our processing or the law changes, and revise the effective date at the top. If a change materially affects cookies or consent, the cookie notice is re-shown so you can make a fresh choice.
13. Contact
Questions, requests, or complaints: privacy@truetotalcalculator.com. The named data-protection contact (and DPO, if appointed) will be confirmed here before publication.