Privacy Policy

Last updated: 2 October 2026

Fiducia is provided by Lumnika, the data controller for the processing described here. Contact: fiducia@lumnika.com.

What we collect

Reviewers: the name you choose to display, your rating and text (public), and your email address. The email is used once to send the verification link; we store only a one-way hash of it, used to detect duplicates and let you update your own review.
Invited customers: when a business invites you, the invitation token is stored as a hash and becomes invalid after use.
Everyone: your IP address is held in memory for a short time for rate limiting and abuse prevention. When you report a review, we store a one-way hash of your IP address with the report, to stop the same person from reporting repeatedly; the address itself is not stored. We use no advertising or tracking cookies.
Visit counting: each page loads a small script from our own server that, once you have stayed on the page for a few seconds or interacted with it, adds one to a daily count of human visits. It sets no cookie and sends no identifier; your IP address is kept in memory only to avoid counting the same visitor twice on the same day, and only the aggregate daily number is stored.
Businesses: there are no passwords. To sign in, you receive a one-time link at an email address on your business domain; we keep that address, the public information shown on the business page, your plan status, and the customer names and email addresses you upload to send review invitations (used only to send those invitations and reminders). We also send you service emails about your account: a weekly digest, trial and plan reminders, and a few onboarding messages, each with an unsubscribe link.
Free check tool: if you leave your email and domain on /check, we send you the report and then a weekly re-check of the score until you unsubscribe (link in every email), claim the domain, or a small maximum number of emails is reached.
Payments: card and billing details are entered on Stripe and never reach our servers; we receive only the plan, its status and dates.

Why (legal basis)

To publish reviews you asked us to publish and to provide the service a business signed up for (contract), to keep reviews genuine and the service secure, and to send the check-tool and account emails you can unsubscribe from at any time (legitimate interest).

Who receives it

Reviews, display names and ratings are public by design and may be read and cited by search engines and AI assistants. We use these processors:

Hetzner (Germany): hosting of our servers and database.
Resend: delivery of all our emails (verification, invitations, account and check-tool emails).
Stripe: payments, as reseller and merchant of record for Fiducia Pro.
Google (Gemini API): when a Pro business asks for an AI-drafted reply to a review, the review text, rating, business name and chosen tone are sent to Gemini to generate the draft. Reviewer emails are never sent.

Some processors may handle data outside the EU under the European Commission's standard contractual clauses. We do not sell personal data.

Retention

Published reviews are kept while the business page exists. Unverified reviews are never published. Login links expire after 15 minutes and sessions after 30 days. Report IP hashes are kept with the report. You can ask us at any time to delete your review and its email hash.

Your rights

You can request access, correction, deletion, restriction or portability of your data, and object to processing, by writing to fiducia@lumnika.com. You may also complain to your data protection authority. If you own a business listed on Fiducia, use "Request removal" on its page (/b/your-domain/remove) or write to the same address to have the page erased (GDPR art. 17 and 21).