Privacy Policy

1. What we collect

When you create an Account: your email address and authentication credentials, handled by our authentication provider (Supabase).

When someone submits a testimonial on a collection page: their name, star rating, and written review are always collected. Company name, email address, a profile photo, and a recorded video are collected only if the Reviewer chooses to provide them. A Reviewer's email address is used only to let the Account contact them about their submission — it is never shown on the public widget or shared with anyone outside the Account.

We also process the IP address of visitors submitting a public review form, solely to apply spam-prevention rate limits and to run Cloudflare Turnstile's bot-verification check. We do not otherwise log or store visitor IP addresses.

2. How we use it

Testimonial content is used to power the moderation queue and, once approved by the Account, the embeddable widget shown on the Account's website. We send a single transactional email (via Resend) to an Account's owner when a new testimonial arrives. We do not use submitted data for advertising and do not sell personal data to third parties.

3. Where data is stored

Account and testimonial records are stored in a managed Postgres database (Supabase). Uploaded photos, videos, and screenshots are stored in Cloudflare R2 object storage. Approved photos and videos are, by design, served publicly — that is what makes the embeddable widget work — so a Reviewer who uploads a photo or video should expect it to be publicly visible once the Account approves the testimonial.

4. Cookies and local storage

We use a session cookie, set by our authentication provider, to keep Account users signed in. We use your browser's local storage to remember your light/dark theme preference. Neither is used for cross-site tracking or advertising.

5. Third parties we rely on

Supabase (authentication and database), Cloudflare (file storage and bot-verification via Turnstile), and Resend (transactional email). Each processes data only as needed to provide their respective part of the service.

6. Your choices

A Reviewer can ask the Account that collected their testimonial to remove it, since the Account controls what is approved and displayed. An Account owner can request deletion of their Account and its associated data by contacting us.

7. Contact

Questions about this policy, requests to delete an Account, and requests from a Reviewer to remove their testimonial can all be sent to emregozleyici@gmail.com.