Privacy and consent¶

The people who submit testimonials are not your users — they are your customers' customers, and often they interact with us exactly once. This page is what the product does about that.

Approving a submission and being allowed to publish it are two different things.

Approved — you decided you want it.
Display consent — the person agreed you may show it publicly.

Both are required for an item to appear anywhere public. They are stored separately, and the public query needs both. Approving something submitted without consent is fine and sometimes useful: you can read it, learn from it, and go and ask.

When somebody ticks the box, we store what they were shown: the exact sentence, a policy version, where it happened, a truncated IP and a timestamp.

The exact sentence is the part that matters. A record saying "consented: true" proves nothing six months later; a record carrying the words they read proves what they agreed to. That is also why the wording changes when a video is attached — showing somebody's words and showing their face are not the same agreement, and the video sentence also names the automatic captioning that follows, so the record says which one they gave.

Withdrawal¶

Every submission carries a withdrawal link, and withdrawal is immediate and complete:

The item is unpublished — out of every widget and every API response.
Caches are invalidated so no embed keeps serving it.
Any video is deleted from storage and purged from the CDN edge.

If a deletion or a purge fails, the leftover is recorded so a sweeper finishes the job. A file does not get to quietly survive a withdrawal because an API call timed out.

Contact export and deletion¶

A contact is a person, across all their submissions. For any of them you can:

Export everything held about them, as structured data.
Delete them and their submissions.

Both need admin or owner. Both are logged.

Retention¶

A retention policy can purge old submissions automatically. Off by default — deleting customer feedback on a schedule should be a decision somebody makes, not something that happens because a field had a default.

AI moderation¶

Off by default, per project. When on, submitted text goes to a third-party model for classification.

Switching it on changes what your privacy notice should say

Feedback text leaves our systems for a third-party model. If you enable it, say so in your own privacy notice — the disclosure is yours to make, because it is your relationship with the person who wrote the text.

The model's output is never a publication decision. It sorts your queue; a person still approves.

AI follow-up questions¶

Off by default, per survey. When on, a low-scoring survey response triggers one AI-written follow-up question. What goes to the third-party model (through OpenRouter, zero-retention providers only) is minimised: the survey type, the score, the question labels, and the other answers — with emails, phone numbers and URLs redacted first. Names, emails, contact details, IPs and page metadata are never sent, and the owner's context prompt never leaves our servers.

The disclosure is yours to make

As with AI moderation, the respondent's answers leave our systems for a third-party model when you enable this. You are the data controller for your respondents and we are the processor — the same relationship as reCAPTCHA on your pages. Say so in your own privacy notice. The respondent is also shown, with every generated question, a note that it was written by AI.

Video transcription¶

Every published video testimonial is captioned automatically. When a clip finishes processing, its audio track alone is sent to a speech-to-text service — no name, email address or other profile detail is attached, though the recording itself contains whatever the person chose to say. Nothing is sent until the person has submitted with the consent sentence ticked, and the video sentence names this step; a transcript is never shown publicly until a moderator has read and, where needed, corrected it.

This one is not zero-retention

Transcription goes through OpenRouter, like the optional AI features — but OpenRouter does not apply its zero-retention routing to speech-to-text, so the audio is handled by the speech provider it routes to under that provider's own terms. This differs from AI moderation and follow-ups, whose text is routed only to providers that do not retain it. Say in your own privacy notice that video testimonials are transcribed by a third party; you are the data controller for the person who recorded, and we are the processor. Transcription can be switched off for the whole workspace if this trade is not one you want to make.

The audio track and the transcript are deleted with the video — on withdrawal, on deletion of the testimonial, and when an unfinished upload is reaped.

What the public payload cannot contain¶

The public API serialises through a single allowlist whose exact key set is regression-tested. No email addresses, no internal metadata, no IPs, no pending items. Adding a field to the model does not add it to the public payload — that takes a deliberate change to the allowlist, and the test fails until it is deliberate.