Privacy Policy

This policy applies to two groups of people. Customers — the businesses, creators, and teams who create a Webmonials account and use our service. Respondents — the people who submit a testimonial, review, or rating through a Webmonials collection form or whose public post is imported by a customer.

When a customer collects testimonials with Webmonials, that customer decides what to ask and how to use the responses. For that data, the customer is the data controller and Webmonials acts as a data processor on their behalf.

From customers, we collect:

• Account details: name, email address, password (hashed), and optional profile information.
• Billing details: plan, payment method, and billing address — processed by Stripe; we never store full card numbers.
• Workspace content: forms, branding assets, tags, widgets, and settings you create.
• Usage data: pages visited in the app, features used, and device/browser information, used to improve the product.

From respondents, on behalf of our customers, we may collect:

• Testimonial content: text answers, star ratings, and video or audio recordings, including automatic transcripts.
• Attribution details the respondent chooses to share: name, job title, company, photo, and links.
• Consent records: the permission a respondent grants for their testimonial to be displayed publicly.

• To provide the service: hosting forms, storing and transcribing videos, rendering widgets and walls of love.
• To operate your account: authentication, billing, support, and service announcements.
• To improve Webmonials: aggregated, de-identified analytics about how features are used.
• To keep the platform safe: detecting abuse, fraud, and spam submissions.

We do not sell personal data. We do not use testimonial content to train AI models or show advertising. Transcription and translation are performed by vetted subprocessors solely to deliver the feature.

The point of a testimonial is to be seen. When a respondent submits through a Webmonials form, they are shown clearly who is collecting the testimonial and asked to grant permission for public display. Customers may embed approved testimonials on their websites, in emails, and in marketing material.

Respondents can withdraw consent at any time by contacting the business that collected their testimonial, or by emailing us at privacy@webmonials.com — we will pass the request to the customer and remove the content from Webmonials-hosted surfaces.

Our marketing site and app use a small number of first-party cookies: a session cookie to keep you signed in, and a preference cookie for settings like your billing toggle. We use privacy-friendly, cookieless analytics on the marketing site. Embedded widgets on customer websites do not set tracking cookies and do not fingerprint visitors — they record only an anonymous, aggregate view count.

We share data only with service providers needed to run Webmonials, under data processing agreements:

• Cloud hosting and storage (application data, video files) — hosted in the EU and US.
• Stripe — payment processing.
• Transactional email provider — receipts, invites, and notifications.
• Speech-to-text provider — video transcription, processed transiently.

We may disclose information if required by law, or as part of a merger or acquisition — in which case this policy continues to apply and we will notify you.

We keep your data for as long as your account is active. If you delete your account, workspace content — including all testimonials and videos — is permanently deleted within 30 days, with encrypted backups purged within 90 days. Respondents' removal requests are honored within 14 days.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is restricted, logged, and protected with hardware-key two-factor authentication. We follow the principle of least privilege internally and review access quarterly. If we ever discover a breach affecting your data, we will notify you without undue delay and within 72 hours.

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise most of these directly from your account settings — including a full export on every plan. For anything else, email privacy@webmonials.com and we'll respond within 30 days.

Webmonials is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has submitted data through our service, contact us and we will delete it.

We may update this policy as the product or the law evolves. For material changes, we'll email account owners and post a notice in the app at least 14 days before the change takes effect. The "last updated" date at the top always reflects the current version.

Questions, concerns, or requests? Email privacy@webmonials.com. We read everything and a real person replies — usually within one business day.