Privacy and consent¶

The people who submit testimonials are not your users — they are your customers' customers, and often they interact with us exactly once. This page is what the product does about that.

Approving a submission and being allowed to publish it are two different things.

Approved — you decided you want it.
Display consent — the person agreed you may show it publicly.

Both are required for an item to appear anywhere public. They are stored separately, and the public query needs both. Approving something submitted without consent is fine and sometimes useful: you can read it, learn from it, and go and ask.

When somebody ticks the box, we store what they were shown: the exact sentence, a policy version, where it happened, a truncated IP and a timestamp.

The exact sentence is the part that matters. A record saying "consented: true" proves nothing six months later; a record carrying the words they read proves what they agreed to. That is also why the wording changes when a video is attached — showing somebody's words and showing their face are not the same agreement, and the record has to say which one they gave.

Withdrawal¶

Every submission carries a withdrawal link, and withdrawal is immediate and complete:

The item is unpublished — out of every widget and every API response.
Caches are invalidated so no embed keeps serving it.
Any video is deleted from storage and purged from the CDN edge.

If a deletion or a purge fails, the leftover is recorded so a sweeper finishes the job. A file does not get to quietly survive a withdrawal because an API call timed out.

Contact export and deletion¶

A contact is a person, across all their submissions. For any of them you can:

Export everything held about them, as structured data.
Delete them and their submissions.

Both need admin or owner. Both are logged.

Retention¶

A retention policy can purge old submissions automatically. Off by default — deleting customer feedback on a schedule should be a decision somebody makes, not something that happens because a field had a default.

AI moderation¶

Off by default, per project. When on, submitted text goes to a third-party model for classification.

Switching it on changes what your privacy notice should say

Feedback text leaves our systems for a third-party model. If you enable it, say so in your own privacy notice — the disclosure is yours to make, because it is your relationship with the person who wrote the text.

The model's output is never a publication decision. It sorts your queue; a person still approves.

What the public payload cannot contain¶

The public API serialises through a single allowlist whose exact key set is regression-tested. No email addresses, no internal metadata, no IPs, no pending items. Adding a field to the model does not add it to the public payload — that takes a deliberate change to the allowlist, and the test fails until it is deliberate.