This policy explains what personal data [Business legal name] ("we", "us") handles when you use WidgetPop at https://widgetpop.com, why, and the choices you have. It covers our customers, the visitors of websites that embed our widget, and the people whose reviews a widget shows.
1. Who is responsible
[Business legal name], [Business address], is responsible for your personal data (the "data fiduciary" or "controller"). Questions and requests go to support@widgetpop.com. Our grievance officer is [Grievance officer name], at the same email address.
2. What we collect
From you, as a customer
- Account details: your name, email address and password (stored only as a secure hash).
- Widget details: the businesses you pick (Google place ID and name), your widget settings, an optional logo for your review poster, and the website domains you allow the widget on.
- Billing details: your plan, subscription status and payment references. Payments are handled by Dodo Payments; we never see or store your card, UPI or bank details.
- Messages you send us, such as support emails.
From visitors of websites that show a widget
- When a widget loads, the visitor's browser connects to our servers, which receive technical data such as the IP address, the website it loads on and the browser type. We use the IP address only to count views once per visitor every 30 minutes and to stop abuse; that record is deleted after 30 minutes. We keep counts, not the addresses themselves.
- We count clicks on the widget's buttons. We do not set cookies on visitors' devices.
- Reviewer profile photos and review photos in a widget load straight from Google's image servers, so Google receives the visitor's IP address for those images, under Google's own privacy policy.
About reviewers
- A widget shows a reviewer's public name, profile photo, rating, review text and date, as published on the business's public Google listing. We store copies to show them and refresh them on a schedule.
Automatically, in our dashboard
- Server logs with IP addresses and request details, kept for security and troubleshooting.
- Your browser keeps a sign-in token in local storage so you stay logged in. We use no advertising or tracking cookies.
3. Why we use it
- To provide the Service you signed up for: your account, widgets, analytics and support.
- To take payment and manage your plan, including plan limits and usage emails.
- To keep the Service secure and prevent fraud and abuse.
- To meet our legal obligations, such as tax and accounting records.
- To send you service messages. We only send marketing emails if you agree, and you can opt out.
Where the GDPR applies, our legal bases are performing our contract with you, our legitimate interest in running a secure and working service (including showing publicly available reviews and counting views), our legal obligations, and your consent where we ask for it.
4. Who we share it with
We do not sell personal data. We share it only with service providers that help us run the Service:
- hosting and database providers;
- our email delivery provider;
- Dodo Payments, our merchant of record, for payments, tax and invoices;
- Google, whose Maps service powers the place search in your dashboard (Google's own privacy policy applies to that search);
- third-party data providers that help us retrieve publicly available review information.
We may also disclose data when the law requires it, or to protect our rights and users. Some of these providers are outside your country; where that happens we rely on appropriate safeguards required by law.
5. How long we keep it
- Account and widget data: while your account is open, and deleted within 30 days after you close it.
- Billing records: as long as tax and accounting laws require.
- Visitor IP addresses for view counting: 30 minutes. Daily view and click counts: while the widget exists.
- Stored reviews: while a widget uses that business, then removed.
6. Your rights
Depending on where you live, you can ask to access, correct or delete your personal data, get a copy of it, object to or restrict how we use it, and withdraw consent you have given. You can also nominate someone to act for you, and complain to your data protection authority. Email support@widgetpop.com and we will reply within 30 days.
Reviewers: if a widget shows your review and you want it removed from our widgets, email us with the business name and your reviewer name, and we will stop showing it in every widget for that business. Editing or deleting the review on Google also reaches the widget when it next refreshes.
7. Security
We use encrypted connections, hashed passwords, access controls and restricted API keys to protect data. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
8. Children
The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect their data.
9. Changes
We may update this policy. The date at the top shows the latest version, and we will tell you about important changes by email or in your dashboard.
10. Contact
[Business legal name]
[Business address]
Email: support@widgetpop.com
See also our Terms of Service.