Privacy Policy
Last updated: 1 October 2026
The short version.
We collect an email if you ask us to keep you posted. Analytics only run if you accept cookies, and you can change your mind. We do not sell personal data to anyone.
The full policy below is the part that governs, because “trust us” is not a legal basis.
1. Who we are
TruffleGig (“TruffleGig”, “we”, “us”) operates the website trufflegig.com, a freelance market radar built from public job posts.
For the personal data described in this policy, we act as the data controller under Regulation (EU) 2016/679 (the “GDPR”). You can reach us about any privacy matter at [email protected]. We have not appointed a Data Protection Officer, as we are not required to.
2. Scope
This policy covers trufflegig.com, including the market snapshot, waitlist, and contact channels.
It does not cover third-party websites we link to, or the job platforms whose public posts we measure, which are operated by those companies.
3. Personal data we process
We keep this deliberately narrow. We process:
- Waitlist and contact data — the email address you submit, plus anything you choose to write to us in an email.
- Technical and usage data — IP address (from which an approximate location is derived), browser and device type, referring page, pages viewed, and interaction events, collected via server logs of our hosting provider and, subject to your consent, Google Analytics.
We do not knowingly process special categories of personal data under Article 9 GDPR, and we ask you not to send any to us.
4. Why we process it, and on what legal basis
Each activity below relies on a specific legal basis under Article 6(1) GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Adding you to the waitlist and telling you when new tools are ready | Email address | Consent — Art. 6(1)(a). Withdrawable at any time. |
| Answering your emails | Contact data | Legitimate interests where no contract exists — Art. 6(1)(f) |
| Operating the site securely and preventing abuse | Technical data | Legitimate interests in a secure, functioning site — Art. 6(1)(f) |
| Measuring site traffic to improve content | Analytics data via cookies | Consent — Art. 6(1)(a), together with Art. 5(3) ePrivacy Directive |
We do not use your personal data for automated decision-making or profiling that produces legal effects for you, and we do not use it to train machine-learning models.
5. Who we share data with
We do not sell personal data, and we do not share it for anyone else’s marketing. We use a short list of processors who act on our instructions under Article 28 GDPR:
| Processor | What it does | Data involved |
|---|---|---|
| Google Ireland Ltd. / Google LLC — Cloud Storage | Website hosting and delivery | Technical data, server logs |
| Google Ireland Ltd. / Google LLC — Analytics 4 | Aggregate traffic measurement, after consent | Analytics and device data |
| Heralds, our waitlist form provider | Receiving and storing waitlist submissions | Email address |
We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims. If we ever restructure or transfer the business, personal data may transfer with it, and this policy continues to apply until we tell you otherwise.
6. International transfers
Some of our processors are based in, or have parent companies in, the United States, so your personal data may be transferred outside the European Economic Area. Where that happens we rely on the safeguards in Chapter V GDPR: the European Commission’s Standard Contractual Clauses in the relevant processor’s data processing terms and, where the recipient is certified, the EU-US Data Privacy Framework adequacy decision.
You may request a copy of the relevant transfer safeguards by emailing us.
7. How long we keep it
| Data | Retention |
|---|---|
| Waitlist email | Until we contact you and you either stay on the list or ask to be removed, and in any case no longer than 24 months from collection |
| Support correspondence | Up to 24 months after the conversation ends |
| Analytics data | Per the retention setting in Google Analytics, a maximum of 14 months |
| Server logs | Up to 12 months, then deleted or aggregated |
8. Your rights
Under Articles 15 to 22 GDPR you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, portability of data you provided to us, and to object to processing based on our legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
Email [email protected] to exercise any of these. We will respond within one month, extendable by two further months for complex requests, as permitted by Article 12(3). We do not charge for this unless a request is manifestly excessive.
If you are unhappy with how we handled your data, you can complain to the supervisory authority where you live or work. We would appreciate the chance to fix it first.
9. Security
The site is served over HTTPS. We limit access to personal data to the people who need it, keep the data we collect to a minimum, and use reputable infrastructure providers.
No service can promise absolute security. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform you where the GDPR requires it.
10. Children
TruffleGig is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, email us and we will delete it.
11. Changes to this policy
As the product develops, this policy will change. The date at the top always shows the current version. If a change materially affects how we use your personal data, we will make it obvious on the site and, where we hold your email for that purpose, tell you directly.
12. Contact
[email protected]. A real person reads it.