Privacy Policy

Last updated: October 13, 2026

1. Information We Collect

We collect the following information:

  • Account data: Your email address and account profile. Sign-in uses an email magic link. Connecting Google Business Profile is a separate optional authorization.
  • Business data: Business name, address, phone, website URL as you provide
  • Review data: Google reviews synced from your business profile
  • Usage data: Widget views and interaction metrics
  • Website visitor data: When a widget loads on your site, we briefly use the visitor's IP address to prevent abuse (rate limiting) and to count each visitor's view only once. These counters expire automatically and are not used to build visitor profiles.
  • Workspace data: Review collections, private team notes, reply drafts, collaborator invitations, and recorded content permissions.
  • Google authorization: Tokens needed to access the Business Profile locations you connect. New and refreshed tokens are stored with application encryption.

2. How We Use Your Data

  • To provide and maintain the Service
  • To display review widgets on your website
  • To generate structured data (schema.org) for SEO
  • To sync and update your reviews
  • To process payments and manage subscriptions
  • To prepare optional reply drafts and approved promotional assets

3. Data Sharing

We do not sell your personal data. We share data only with:

  • Google APIs: To fetch and sync your reviews
  • Outscraper: To resolve business listings and import Google review content when connecting by link
  • OpenAI: When you request an AI reply draft, we send business/reviewer context, review text, and the internal note or guidance used for that draft. Avoid including information that you do not want processed by this provider.
  • Resend: To deliver sign-in links and review notifications
  • Payment processor: To handle billing (DodoPayments)
  • Hosting provider: Infrastructure to run the Service
  • Database, cache and jobs: Supabase/Postgres, Upstash Redis and Inngest support storage, request limits, counters, caching and background processing.

4. Data Retention

Account and customer-supplied content are retained while your account is active. Imported source-review content has a 29-day retention ceiling after its most recent successful refresh. Source expiry does not grant promotional reuse rights. Sync logs are retained for up to 90 days and Redis counters/cache entries expire according to their purpose. Public embed cache entries last up to 12 hours, with earlier invalidation on edits or source expiry.

Deleting your account first cancels its linked subscription and revokes linked Google grants, then removes active account records and associated businesses, reviews, widgets, collections, assets and memberships. If an external cancellation or revocation cannot be confirmed, your deletion request remains recoverable and publication pauses until you retry. Backups and third-party billing or service records follow the retention rules of those systems; deleting active application data does not immediately erase independent provider records.

5. Your Rights

You have the right to:

  • Access: Export available review data as CSV from the dashboard, up to 10,000 rows per export
  • Delete: Permanently delete your account and all data from Settings
  • Rectify: Update your business information at any time
  • Port: Download your data in a standard format

6. Cookies

We use essential cookies for authentication. The widget measures aggregate visible impressions to track allowance usage. Additional interaction events require analytics to be enabled and the embedding site to signal consent. Popup display and dismissal preferences can use the visitor's local/session storage. The embedding site is responsible for its own consent interface and configuration.

7. Security

We protect your account with email sign-in links, check on every request that you can only see and change your own data, encrypt the Google access tokens we store, and send all data over encrypted connections. Access to our databases is limited to the systems that run the Service.

8. Google User Data

If you connect Google Business Profile, we access only the business locations and reviews you authorize, so we can show your reviews and post the replies you choose to send. VerifiedWidget's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general AI models, and people do not read it except with your permission, for security, or where the law requires. You can disconnect Google at any time from the dashboard, which revokes our access.

9. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes via email or in-app notification.

10. Contact

For privacy-related inquiries, contact us at privacy@verifiedwidget.com.