Privacy Policy
This Privacy Policy explains how True Square Ltd (registration number HE 368592, registered office Charalambou Mouskou 20, ABC Building, Floor 3, Office 306, 8010 Paphos, Cyprus) — the data controller — processes personal data in connection with the Shortlister Service, in accordance with the EU General Data Protection Regulation (GDPR) and Cyprus data-protection law. Privacy contact: hello@shortlister.cy.
1. Personal data we process
- Account & identity data: name, email, phone, messenger handle (e.g., Telegram), login, role.
- Subscription & billing data: plan, status, transaction identifiers and invoices. Card/payment details are collected and processed by our payment provider / Merchant of Record, not stored by us.
- Usage & device data: log data, IP address, approximate location, pages and features used, and similar technical data.
- Communications & support: messages, support tickets and enquiries you send us, including via the landing-page lead form.
- Cookies & local storage: see the Cookies & Local Storage section below.
2. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service, manage your account and access | Performance of a contract (Art. 6(1)(b)) |
| Process subscriptions, billing and invoicing | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Secure the Service, prevent abuse and credential sharing | Legitimate interests (Art. 6(1)(f)) |
| Respond to support requests and communications | Contract and legitimate interests (Art. 6(1)(b), (f)) |
| Maintain accounting records and comply with law | Legal obligation (Art. 6(1)(c)) |
| Measure aggregate usage to improve the Service | Legitimate interests (Art. 6(1)(f)) |
3. Recipients and processors
We share personal data with service providers (processors) who act on our instructions, including hosting, database, payments, communications and analytics providers. We require each processor to provide appropriate safeguards and to process data only as instructed. Our principal processors include our hosting/CDN and serverless provider, our database provider, our Merchant of Record (Paddle.com Market Limited) for payments, and our transactional email provider. A current list is available on request.
4. International transfers
Some processors are located outside the European Economic Area (e.g., in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or an adequacy decision, and apply additional measures where needed. You may request information about these safeguards via hello@shortlister.cy.
5. Retention
We keep personal data only as long as necessary for the purposes above: account data for the life of your subscription and for 12 months thereafter; billing and accounting records for the period required by Cyprus law (generally six years); support communications for 24 months. We then delete or anonymise the data.
6. Your rights
Subject to conditions, you have the right to access, rectify, erase, restrict and object to processing, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise your rights, contact hello@shortlister.cy. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy) or your local supervisory authority.
7. Security
We apply appropriate technical and organisational measures, including encrypted transport (HTTPS), access controls and authentication, to protect personal data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
8. Children
The Service is intended for professional adults and is not directed at children. We do not knowingly process the personal data of persons under 18.
9. Cookies & local storage
- Strictly necessary. We use a strictly necessary authentication cookie (named "tsq_auth") to keep you signed in and secure your session. This cookie is essential for the Service to function and does not require consent. It is set only after you log in, is HttpOnly and Secure, and expires after the session period.
- Local storage. We use your browser's local storage to remember non-essential preferences and working state, such as your selected interface language and your draft selection of units. This data stays in your browser and is not used for tracking or advertising.
- Analytics. We use a privacy-friendly, cookieless analytics tool that measures aggregate usage without setting tracking cookies or identifying you individually. If we ever introduce technologies that require consent, we will request your consent through a cookie banner before they are used.
- Managing cookies. You can delete or block cookies via your browser settings; blocking the strictly necessary cookie will prevent you from logging in. Clearing local storage will reset your preferences.
10. Changes
We may update this Policy and will post the updated version with a new effective date; we will notify you of material changes.