Privacy Policy

Last updated: 18 October 2026

This Privacy Policy explains how Truewidgets, a service of Loom Factor Limited ("Truewidgets", "we", "us"), collects, uses, and protects information when you use our website and services (the "Service") — the review widgets, dashboards, and the optional Google Business Profile connection. By using the Service you agree to this Policy.

1. Information we collect

• Account information — your name, email address, and a securely hashed password when you create an account. If you sign up or sign in with Google instead, Google gives us your name, email address, profile picture and Google account ID (and no password).
• Business content you provide — the business names, locations, logos, colours, and widget settings you add.
• Google account data (only if you connect Google Business Profile, or share your business through a link someone sent you) — see Section 4.
• Business verification — before anything about a business is shown publicly, you show it's yours. For a business that isn't on Google, that is the website address you give us (we look for a code on its homepage) or an email address at its domain (we send it a one-time link, and keep the address to record how the business was verified).
• Business lookups — when you search for a business in the demo on our website, or check Local ranking in your dashboard, we look it up with Google Maps Platform to show you the results there and then (see Section 6). We keep nothing from those lookups. The demo also shows the business's website icon, which your browser loads from DuckDuckGo's icon service.
• Reviews and private notes customers leave — through your review link or QR code: the name, rating and words they give, and an email address or phone number if they choose to add one.
• Payment information — if you subscribe to a paid plan, payments are processed by Stripe. We receive limited billing details (plan, status, last four digits, country); we never see or store your full card number.
• If you add Truewidgets Reviews to a Wix site — Wix tells us the site's ID, name and address, the email address of the site's owner, and which of our plans the site pays for. We use them to set up and run that site's Truewidgets account. Wix takes the payments for the app; we never see card details.
• If you add Truewidgets Reviews to a Shopify store — Shopify tells us the store's name, its myshopify.com address and its own domain, the email address Shopify has for it, whether it is a development store, and which of our plans it pays for; the app also reads which theme is live, to check that it takes our blocks. We use them to set up and run that store's Truewidgets account, and we email the store only once its owner switches emails on in the app and confirms the address. The app asks Shopify for nothing about the store's customers or orders, and the reviews it adds to the store's pages send nothing about the people who visit them: views and clicks on Shopify stores aren't counted. Shopify takes the payments for the app; we never see card details.
• If you use our Framer plugin — the plugin signs you in to Truewidgets and lists your businesses, so you can choose which one's reviews go on your Framer site. The component it adds to your site asks us for that business's reviews, by its widget's ID alone, when a page opens. Nothing about the page or its visitors is sent with it, and views and clicks on Framer sites aren't counted.
• Usage & device data — basic logs, IP address, browser type, and aggregate widget impression/click counts used to operate and improve the Service (never from Framer sites that use our Framer plugin, or from Shopify stores).
• Chat & call button — on websites that show the chat & call button from a Truewidgets account, we count how often it’s shown and opened, and how often visitors tap WhatsApp or call, as daily totals for each page, with no cookies and nothing about the visitors themselves. The free button code from our button maker counts nothing.
• Where you came from — when you make an account from our website, we keep with it the page you signed up from, the name of the website that sent you to it if any (for example a search engine), and, if you came from one of our ads or another link of ours with tracking tags, the ad's campaign, the search words it was shown for and Google's reference for that ad click. We use them only to see which ads and pages bring us customers. Nothing is stored on your device for this: it travels in the link. If you subscribe, Stripe keeps the same short note with your customer record.
• Cookies — first-party cookies to keep you signed in, protect forms, and remember choices such as which location you're looking at; one (tw_signed_in) that tells our website you're signed in to the app, so it shows a link to your dashboard instead of "Log in" (it says nothing about who you are, and goes when you sign out); and one (tw_consent, kept for a year) that remembers your answer to our cookie question. Google Analytics sets its cookies (_ga and _ga_…, kept for up to two years) so we can see how our website and app are used: the pages visited, the buttons used, the device and browser, and the rough location (country and city); and, when we advertise with Google, how our ads do. In the UK, the EU and everywhere outside the US, only if you accept: until then Google Analytics stores nothing on your device and receives only measurements without cookies. In the US they're on unless you turn them off, with the notice or with "Cookie settings"; if your browser sends a Global Privacy Control signal, they stay off. To tell which applies, our website looks up the country of your internet connection on each visit, only to choose which question to show (and, in our chat button maker, which country’s phone numbers to start with), and doesn't store it. We don't use these cookies to show you our ads again on other websites. You can change your answer at any time with "Cookie settings" at the foot of any page of our website. Google Analytics is never added to your widgets, your reviews page or your review form, so the people who visit them are not measured by it. If you press a button that opens our live chat ("Chat with us", or "Get free setup" in our install guides), on our website or in the app, the live chat (tawk.to) loads and sets its own cookies to keep the conversation going; before that it isn't loaded at all.

2. How we use information

• To provide, maintain, and secure the Service and your account.
• To pull, cache, and display your reviews and business information inside your widgets.
• To process subscriptions and prevent fraud and abuse.
• To respond to support requests and send essential service notices.
• To send you one email about 12 minutes after you sign up, offering help with the step of set-up you’ve reached. It’s only about setting up, and its stop link turns set-up emails off.
• To understand aggregate usage so we can improve features and performance.

3. Legal bases

Where applicable law (such as the GDPR) requires it, we process your information to perform our contract with you, to comply with legal obligations, for our legitimate interests in operating and securing the Service, and — where required — with your consent (for example, when you connect your Google account).

4. Google user data

If you choose to connect your Google Business Profile, you authorise us through Google's OAuth consent screen using the https://www.googleapis.com/auth/business.manage scope. With your authorisation we access, on your behalf, only the data needed to provide the Service:

• the Business Profile accounts and listings you manage, and whether Google has verified that you manage each one (that is how we know a business is yours);
• your reviews, star ratings and replies — to show them in your widgets and on your reviews page, to tell you about new and low ratings, and to post the replies you write;
• your business information (name, address, categories, description, hours, phone, website) — to set up your location and show how complete your profile is;
• how your profile is doing (views, calls, website clicks, direction requests) — shown on your Google listing page;
• your services and posts — so the posts you write here, and the services and posts you approve in Autopilot, go on your listing.

We change your listing only when you ask: a reply or post you write and send, or an Autopilot draft you approve. If you switch on Autopilot's automatic publishing for a location, the drafts it writes from your own website go on that listing without a click each time, until you switch it off.

We store an encrypted Google refresh token so the connection keeps working, and a copy of the reviews and profile fields you display. We refresh that copy every day while you're connected (once a month on Free), and delete anything we haven't been able to refresh within 30 days. You can disconnect at any time from your dashboard, and you can remove our access at myaccount.google.com/permissions.

When you ask for a draft reply or a post caption, the review's text and rating are sent to our AI provider (Anthropic, Section 6) to write it, and come back to you to edit. Nothing is sent for that unless you ask.

When you switch on "Summary of your reviews" for a widget, the star ratings and words of your business's reviews, and your business's name, are sent to Anthropic to write the one-line summary shown with your widget. The reviewers' names are never sent. While the summary is on, it is written again when your reviews change, at most once a day.

If someone sent you a link to share your Google reviews

A web designer or agency that uses Truewidgets can send a business owner a link, so the business's Google reviews can be shown on the website they're making. If you open one and continue with Google, you authorise us through Google's consent screen with the same business.manage scope, and Google gives us your Google account's email address. We use them only for this:

• the list of businesses your Google account manages, and whether Google has verified you for each — only to show you the list to pick from;
• for the one business you pick: its name, town and Google Maps place, and its reviews, star ratings and replies — to show in the widgets of the person who sent the link and on the business's reviews page. Nothing else on your listing is read, and nothing on it is ever changed for a business shared this way: no replies, posts or edits;
• your email address — only to send you one email that says what you shared, with a link to stop sharing. We don't show it to the person who sent the link, and we don't use it for anything else.

We store an encrypted Google refresh token for that business, kept apart from the account of the person who sent the link, and a copy of its reviews, refreshed every day (once a month on Free); what we can't refresh within 30 days is deleted. Stop sharing, in the email we send you, deletes our token, so we can't read your listing any more, and deletes the business's Google reviews from Truewidgets straight away. If the person who sent the link removes the business or closes their account, we delete the token too. To take Truewidgets off your Google account as well, remove it at myaccount.google.com/permissions (that ends every connection your Google account has with Truewidgets); new reviews then stop, and the ones we stored go within 30 days.

5. If a business asked us to email you

Businesses that use Truewidgets can ask us to email their customers, asking for a review on Google. If you got one of those emails, this section is for you. The business decides who is asked and is responsible for your details (it’s the controller); we send the emails for it (we’re its processor).

Where your details came from. From the business: it typed them in, uploaded a list, or sent them from its own software, such as its invoicing app.

What we hold. Your name and email address, which business asked us to email you, when we sent each email, and when you opened the review link in it. We don’t track whether you open the email itself: there’s no tracking pixel. If a new Google review for that business has your name within 21 days, we show the business it’s probably yours.

Why. Because the business asked us to. We use your details only to send its review request and one reminder, and to show it how they went: never for anything else, and never for our own emails. The business has promised us that you’re its customer, that you could say no to its emails when you gave it your address, and that it asks every customer, however it went.

How long. We delete your name and email address 60 days after the last email we send you for that business, or on the day the business closes its Truewidgets account, if that comes first. Two scrambled codes made from your address, which can’t be turned back into it, stay a little longer: one for 90 days, so the business doesn’t ask you twice in that time, and one with the unsubscribe link in each email, for 60 days after it. If you unsubscribe from that business, we keep its code for the business for as long as it uses Truewidgets. If you unsubscribe from every business, or an email to you bounces or is marked as spam, we keep a code so no business emails you through us again; for that list, we’re the controller.

Your choices. Every email has an unsubscribe link. It keeps working for at least 60 days after each email, even if the business closes its Truewidgets account. It stops review requests from that business, and one more choice stops them from every business on Truewidgets. Your mail app’s own unsubscribe button works too. For anything else, contact the business: replying to its email reaches it. Or write to us at hello@truewidgets.com and we’ll help.

Who else sees them. Postmark, which delivers the emails for us, and our hosting providers (Section 6). Postmark keeps its own list of addresses that bounced or were marked as spam, so it doesn’t send to them again.

6. How we share information

We do not sell your personal information. We share it only with:

• Service providers (subprocessors) that run the Service on our behalf, each with only what its job needs:
  • Vercel (our website) and Cloudways (our app and its database) — hosting;
  • Stripe — payments;
  • Zoho Mail — sending our emails, so it handles the email addresses and what the emails say;
  • Postmark — delivering review requests for the businesses that use them: the customer’s name and email address, the business’s name and address, and what the email says. It tells us when an email can’t be delivered, is marked as spam, or someone unsubscribes;
  • tawk.to — the live chat on our website and in the app, only if you open it: what you write in the chat, any name or email address you give, and the page you were on. It loads, and sets its own cookies, only once you press a button that opens it ("Chat with us", or "Get free setup" in our install guides);
  • Anthropic — AI writing: for a draft reply or caption you ask for, the review's text and rating and your business's name; for the summary of your reviews, once you switch it on, the star ratings and words of your business's reviews (never the reviewers' names) and your business's name; for Autopilot, text from your own website's pages. Anthropic does not use what we send to train its models;
  • DataForSEO — for Keywords: short phrases from your reviews and your business's name, to look up how often people search for them (no personal information);
  • Google — the Business Profile connection you choose, sign-in with Google if you use it, and Google Maps Platform for business lookups;
  • Google Analytics — measuring how our website and app are used and, when we advertise, our ads: only as described under Cookies in Section 1;
  • Wix — if you use Truewidgets Reviews on a Wix site: Wix runs the app's billing, and we check with Wix which site and which plan a request is for.
  • Shopify — if you use Truewidgets Reviews on a Shopify store: Shopify runs the app's billing, and we check with Shopify which store and which plan a request is for.
• Legal and safety — where required by law, or to protect the rights, safety, and security of Truewidgets, our users, or the public.
• Business transfers — if Truewidgets is involved in a merger, acquisition, or asset sale, subject to this Policy.

Google Maps Platform. The business search in our website's demo and Local ranking in your dashboard use Google Maps Platform (the Places API). What is looked up through them is also subject to the Google Privacy Policy, which is incorporated into this Policy by reference for those features.

7. Data retention & deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account at any time from your dashboard or by contacting us; we will delete or anonymise your personal information within a reasonable period, except where we must retain it to comply with legal obligations. Disconnecting Google deletes the stored Google token straight away; the Google reviews and profile content we stored are deleted within 30 days of their last refresh. For a business shared through a link, Stop sharing deletes its token and its Google reviews straight away (Section 4). If you remove Truewidgets Reviews from a Wix site, we keep that site's account for 30 days in case you add the app back, then delete it. If you remove it from a Shopify store, we keep that store's account for 28 days in case you add the app back, then delete it and everything in it.

8. Security

We protect your information with encryption in transit (HTTPS), encryption of sensitive tokens at rest, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to promptly address any issues.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at the address below. You also have the right to complain to your local data protection authority.

10. International transfers

We may process and store information in countries other than yours. Where we transfer personal information internationally, we take steps to ensure it receives an adequate level of protection.

11. Children

The Service is for businesses and is not directed to children under 16, and we do not knowingly collect their personal information.

12. Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the "Last updated" date above; material changes will be communicated where appropriate.

13. Contact us

Questions about this Policy or your data? Email hello@truewidgets.com.

The controller of your personal information is Loom Factor Limited, Unit 12, Dewsbury WF13 1QU, United Kingdom.