Privacy Policy

The administrator of the testimonialmanager.com service is responsible for personal data of visitors and account holders. You can reach the administrator at [email protected] about anything in this policy.

When a business uses TestimonialManager to request, collect and publish testimonials from its own customers, that business decides why and how those customers' data is used. The business is the controller of that data, and we act as its processor, handling the data only on the business's instructions and to provide the service.

Our data processing agreement (DPA) sets out these terms. It forms part of our agreement with every business that uses the service, and a signed copy is part of the Scale and Enterprise plans.

If you left a testimonial for a business and want it changed or removed, use the withdraw link in the request you received or contact that business directly. You can also write to us, and we will pass your request to the business and help it respond.

• Account data, such as name, work email, password in hashed form, company name, brands and locations, team members and their roles.
• Demo selections, such as the company name, industry and widget style entered in the homepage demo, stored with your signup so the next steps can refer to them.
• Billing data, such as plan, billing period, invoices and the status of payments. Full card numbers are handled by our payment processor and are not stored by us.
• Usage data, such as sign ins, pages and features used, requests sent, opened and answered, and error logs.
• Testimonials, including text answers, star ratings, photos, names and job titles the customer chooses to share, tags and notes added by the business.
• Video testimonials and their transcripts, including the face and voice of the person recording.
• Consent records, such as what the customer agreed to, the wording of the consent shown, any later change or withdrawal.
• Technical data, such as IP addresses, timestamps, browser and device type, recorded with signups, sign ins, testimonials and consent records.
• Contact data of the business's customers, such as email address and phone number, uploaded or sent from connected tools so the business can send requests.
• Messages you send to support.

• To create and run your account and provide the service you subscribed to, on the basis of our contract with you.
• To send requests, reminders and notifications on behalf of a business, on that business's instructions as processor.
• To take payments, issue invoices and keep accounting records, on the basis of our contract and our legal obligations.
• To keep consent records that show who agreed to what and when, on the basis of the business's legal obligations and legitimate interest in being able to prove consent.
• To secure the service, prevent abuse and fix errors, on the basis of our legitimate interest in a safe and working service.
• To send you service messages and the next steps after signup, on the basis of our contract, and product news only where you agreed or where the law allows it.
• To answer your messages, on the basis of our legitimate interest and, where relevant, our contract.

For visitors and users in the European Economic Area and the United Kingdom these purposes rely on the legal bases of the GDPR named above. For residents of US states with privacy laws, such as the California Consumer Privacy Act, we use personal data only for the business purposes described here. We do not sell personal data and we do not share it for cross context behavioral advertising.

AI highlights and transcripts are produced by an AI model provider that processes the testimonial text or video audio only to return the highlight or transcript to us. The original testimonial is kept unchanged, and every suggestion is shown to the business, which decides what to publish. Testimonials are not used by us to train AI models.

We share personal data only with service providers that help us run TestimonialManager, under contracts that limit their use of the data to that purpose, and only to the extent needed:

• a hosting provider that stores and runs the service,
• a payment processor that handles subscription payments,
• an email and SMS delivery provider that sends requests, codes and service messages,
• an AI model provider that produces highlights and transcripts,
• a cookieless analytics provider that measures visits in aggregate.

Testimonials that a business approves for publication are shown publicly on that business's website through its widgets and walls. We may also disclose data where the law requires it, for example in response to a valid legal request.

Some providers may process data outside your country. Where data leaves the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as standard contractual clauses.

We use only cookies that are essential for the site and the service to work: the session that keeps you signed in, protection against cross site request forgery and your interface preferences. We do not use advertising cookies or tracking pixels, and our analytics work without cookies. Because no optional cookies are set, there is no cookie banner. Widgets embedded on a business's website do not set tracking cookies on its visitors.

• Account data, for as long as the account exists, and for up to 90 days after it is closed so it can be restored on request, then deleted.
• Testimonials, videos and transcripts, until the business deletes them or closes its account, then deleted from active systems within 90 days.
• Consent records, for as long as the related testimonial is kept and afterwards for as long as the business needs them to show that consent was given, unless the business deletes them earlier.
• Invoices and payment records, for as long as tax and accounting law requires.
• Security and access logs, for up to 12 months.
• Support messages, for up to 24 months after the last reply.

Backups are overwritten on a rolling schedule, so deleted data disappears from them over time.

Depending on where you live, you have the right to access your data, receive a copy of it, correct it, delete it, restrict or object to its use and, where processing relies on consent, withdraw that consent at any time. Residents of some US states also have the right to know what categories of data we collect and to opt out of sale or sharing, which we do not do. We will not treat you differently for using any of these rights.

To use your rights, write to [email protected] from the email linked to your account. If your request concerns a testimonial you left for a business, that business is the controller, and we will forward your request to it. You may also complain to your local data protection authority.

Data is encrypted in transit and at rest, access is limited to the people who need it for their work, and actions in the service are logged. Details are on the testimonial software security page.

TestimonialManager is a service for businesses and is not directed at children. We do not knowingly collect data from children under 16. Businesses must not use the service to request testimonials from children. If you believe a child's data has reached us, write to us and we will delete it.

We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change is significant, we notify account holders by email before it takes effect.

Questions about this policy or your data go to [email protected]. More ways to get help are on the contact page.