Privacy Policy

1. Who We Are

ReviewWidget (“we,” “us,” or “our”) is operated by Photobooth Decor. We provide a software-as-a-service platform that lets businesses display their Google Business Profile reviews as embeddable widgets on their own websites.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to our dashboard at reviewwidget.com (the “Dashboard”), the embeddable review widget (the “Widget”), and any related APIs or services (collectively, the “Service”).

2. Information We Collect

2.1 Information you provide

• Account information — When you sign up we collect your name, email address, and password (or Google account identifier if you use Google Sign-In).
• Workspace & widget settings — Names, themes, layout preferences, and allowed-domain lists you configure in the Dashboard.
• AI app connections — You can connect an AI app, such as Claude or ChatGPT, to your account. It gets access only after you click Allow on our sign-in screen. For each connection we store your user ID, the app’s name and ID, when you connected, and when the app last used it. We store only one-way fingerprints (SHA-256 hashes) of the app’s access and refresh tokens, never the tokens themselves. A sign-in code we send back to the app expires after 5 minutes. An access token lasts 1 hour. A connection ends 60 days after it was last used.
• Support requests — Any information you provide when you contact us for help.

2.2 Information from Google

When you connect a Google Business Profile, we use OAuth 2.0 to request access. We collect:

• OAuth tokens — A refresh token that lets us request new access tokens on your behalf. Tokens are stored server-side and never exposed to browsers or the Widget.
• Business profile data — Account and location identifiers, business name, and reviews (reviewer display name, profile photo URL, star rating, comment text, and timestamps).

We do not access your Gmail, Google Drive, Google Contacts, or any other Google service beyond the Google Business Profile API.

2.3 Information collected automatically

• Log data — IP address, browser type, operating system, referring URL, pages visited, and timestamps.
• Widget load data — When a visitor’s browser loads the Widget on your website, we receive the page URL and the widget public ID. The Widget’s fonts are served from our own servers, so loading them sends nothing to a third-party font service.
• Install locations — To show a business where its widgets are installed, we keep the domain and page path (the part of the address after the domain, without any query string or fragment) of pages where each review widget was recently displayed, and the domain where each social-proof script was recently loaded. A page path is stored as it appears, so any identifier a website puts in its page path (for example an order or customer number) is stored with it. Paths are capped at 200 characters. We keep up to the 20 most recent entries per widget or site. The list of recent pages is deleted automatically 30 days after the most recent sighting (entries older than 30 days are removed whenever a new sighting is recorded), and immediately when the widget, site or workspace is deleted. We also keep the most recent domain and time on the widget or site until you delete it, and the date your first widget was seen on a website until you delete the workspace. We store no visitor data with these entries. Our own dashboard previews are not recorded.
• Visitor identifier — The Widget stores a randomly generated visitor identifier in the browser’s local storage, and a separate identifier for the current browsing session, on the site where it is embedded, plus small flags for returning visitors, dismissed notifications (session storage) and the visitor’s opt-out choice. We use them to avoid showing a visitor the same notification twice, to tell new from returning visitors, and to attribute the interactions below. Whether the identifiers are stored and interactions recorded depends on consent. The dismissal and opt-out flags are stored regardless of consent, because they record the visitor’s own choice. Where the Widget detects a supported cookie banner (Cookiebot, OneTrust, CookieYes, Shopify’s consent banner or Google Consent Mode), notifications may be shown but nothing is recorded until the visitor accepts analytics cookies. A banner that loads after the Widget can leave a short gap before it is detected. Where no supported banner is detected (no banner, or a custom one), the Widget stores its identifiers, sends the visitor identifier and records interactions from the first page view, unless the website owner sets it to wait for consent (data-consent="required", in which case nothing is recorded until the site calls our consent function). If the owner sets data-consent="ignore", the Widget ignores banners altogether, including a refusal. A Global Privacy Control signal from the browser always stops tracking. Visitors can also opt out on any site that links to its opt-out address (or adds ?proof_optout=1 to a page address, or uses the Widget’s JavaScript API). Opting out hides notifications, stops tracking and deletes the identifiers stored in the browser. On Shopify stores it also blanks our cart attribute. When the Widget detects that consent has been withdrawn it likewise clears the identifiers and the cart attribute. Local storage is separate for every website, so this identifier does not follow a visitor from one site to another and we do not use it to build a cross-site profile. Clearing your browser storage for that site removes it.
• Approximate country — The Widget estimates a visitor’s country from the browser’s time-zone setting, inside the browser, to decide which notifications to show. The country is not sent to or stored by our servers.
• Widget interactions — We record when a notification is shown (impression), hovered, clicked, or dismissed, together with the visitor and session identifiers above, the page URL, and a timestamp. Per-page daily totals keep only the page path (the part of the address after the domain, without any query string or fragment) in plain text. Because the path is stored as it appears, any identifier a website puts in its page paths (for example an order or customer number) is stored with it. Daily counts of unique visitors are kept as well, using markers that hold the visitor identifier (see section 6), and daily totals are broken down by device type and browser.
• Goal completions — If a business defines a goal page (for example an order confirmation page), the Widget tells us when a visitor reaches it. This is recorded only under the same consent rules as the interactions above: nothing is sent or stored unless tracking is allowed. The record holds the goal, the visitor identifier, whether that visitor hovered over or clicked a notification on the site in the previous 7 days and, if so, which notification, and a timestamp. Each visitor is recorded at most once per goal within 180 days.
• Conversion data (social-proof notifications) — When a business connects a store, we receive a record of each recent order it chooses to publicise: a customer name, city, region and country, the product title and image, the Shopify product ids of the items ordered (or the product id you pass to our capture API), and the order amount and currency. We use the product ids to count recent orders of a given product, so a notification on a product page can show how many people bought that product. When a visitor views a product page, the Widget sends that page’s product id to our servers with the request for notifications. We use it only to look up the count and do not store it with the visitor. This data comes from the business, about its own customers. If the visitor identifier is passed with an order (as a hidden Shopify cart attribute, or through our capture API), we store a hash of it with that order so we never show a buyer a notification about their own purchase. The hash is an unkeyed SHA-256 of the website’s site ID and the visitor identifier. We do not store the raw identifier with the order, but the hash is not anonymous: the raw identifier is stored with the widget interactions above for 30 days, with goal completions (above) for 180 days, in the short-lived daily-visitor markers (2 days), and in a live-visitor record until the site’s next impression, so anyone with access to our database could match an order to that visitor’s recorded activity during that period. The hash is kept for as long as the order record, with no automatic expiry.
• Inline placements — A notification can be placed inside a page of the website (a data-proof-inline element) instead of appearing as a popup. Inline notifications follow the same consent, Global Privacy Control, opt-out and tracking rules as popups: they record impressions and clicks only when tracking is allowed, and an opt-out removes them.
• Form submissions (form capture) — If a business turns on form capture, the Widget watches form submissions on the pages the business selects. When a visitor submits such a form, the Widget sends us, and we store: the visitor’s first name and last initial, a city derived from the browser’s time-zone setting, a one-way SHA-256 hash of the email address, and the address of the page where the form was submitted. Form capture follows the same consent, Global Privacy Control and opt-out rules as the interactions above: nothing is read or sent unless tracking is allowed. The Widget also sends the random visitor identifier described above. We use it for short-lived rate limiting, in records deleted within about two hours, and we store a hash of it with the submission (the same hash described under conversion data) so the visitor is not shown their own submission. The email address itself is never transmitted to us, no other field is read, and forms containing a password field are never read. The hash is placed in a public Gravatar image address shown inside the notification, so the browser of every visitor who views that notification requests the image from Gravatar, and Gravatar, as well as anyone viewing the notification, receives the hash. A hash is not anonymous: anyone who already knows an email address can compute its hash and match it.

3. How We Use Your Information

• Provide the Service — Authenticate you, sync reviews, render widgets, and enforce domain allow-lists.
• Improve the Service — Analyse usage patterns, diagnose technical issues, and develop new features.
• Communicate with you — Send transactional emails (password resets, account alerts) and, with your consent, product updates.
• Security & compliance — Detect fraud, enforce our Terms of Service, and meet legal obligations.

4. Google API Services — Limited Use Disclosure

ReviewWidget’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the scopes necessary to read your Google Business Profile reviews.
• We do not sell, lease, or sublicense Google user data to third parties.
• We do not use Google user data for advertising, market research, or email campaigns.
• We do not allow humans to read your Google data except where (a) you give explicit consent, (b) it is necessary for security purposes (e.g., investigating abuse), or (c) it is required by law.
• We send Google user data, such as reviewer names, ratings and review text, only to AI apps you connect and approve, and only in answer to your own requests in that app. You can disconnect an app at any time in Settings.

5. Data Sharing & Third Parties

We do not sell your personal data. We share information only in these limited circumstances:

• Service providers — We use Google Firebase and Google Cloud (database, authentication, serverless functions, and API access) and Vercel (application hosting). Our database and serverless functions run in Google Cloud’s northamerica-northeast1 (Montreal, Canada) region. Account authentication is handled by Firebase Authentication, which Google operates on global infrastructure and which is not confined to a single region. These providers process data on our behalf under contractual data-protection terms.
• Widget visitors — Content you choose to display is served publicly through the Widget to anyone who visits your site. For review widgets that is review content (reviewer display name, rating, comment, and photo URL as provided by Google). For social-proof notifications it also includes your customers’ details — the purchaser’s name and city, and the product they bought — shown to other visitors of your site. If you enable social-proof notifications, you are responsible for having a lawful basis to publicise your customers’ purchases in this way. Businesses can choose to show only first names, hide names entirely, show only the country, hide exact times and round counts.
• Public review page — A business can publish a review page at an address on our site for Google locations it manages through its connected Google Business Profile account. It shows the Google reviews of those locations that the business selects (reviewer display name, profile photo, star rating, comment and date) to anyone with the link, and to search engines if the business allows it. The business can make the page private at any time. We count page views, unique visitors and link clicks for the page as a whole, as totals only; these counts are not linked to a visitor.
• Twilio and Resend — If a business uses guest text messages, guest phone numbers and message text go to Twilio, and private feedback goes to Resend for delivery by email. See section 6.
• AI apps you connect — When you ask a connected AI app about your account, we send it the data it asks for to answer you, such as reviews, stats and settings. Guest phone numbers are sent as their last 4 digits only. The AI app’s own privacy policy covers what it does with that data. We never send it your password, API keys or Twilio details.
• BoothRoll — If a business connects its BoothRoll account, we store its BoothRoll API key encrypted and use it only to read the business’s album list (album title, date, photo count and guest link). We refuse keys that can delete albums.
• “Email me this link” — If a guest asks us to email them their event page, their email address goes to Resend to deliver that one email. We do not store it.
• Email delivery — When someone joins our waiting list, we use Resend (an email delivery provider) to email us, the service operator. The name, email address, optional company or website, and optional message the person submitted are sent to Resend for that purpose. Resend may process this data outside Canada.
• Google (reviewer photos) — Review widgets and a business’s public review page show each reviewer’s profile photo at the address Google provides. Each visitor’s browser loads that image directly from Google’s servers, which receive the visitor’s IP address and browser details under Google’s own privacy policy.
• Gravatar (Automattic) — Form-capture notifications show a profile image from Gravatar, a service operated by Automattic Inc. Each viewer’s browser requests that image directly from Gravatar, which receives the SHA-256 hash of the submitting visitor’s email address (see section 2.3) along with the viewer’s IP address and browser details, under Automattic’s own privacy policy.
• Legal requirements — We may disclose data if required by law, regulation, legal process, or governmental request.
• Business transfers — In the event of a merger, acquisition, or asset sale, user data may be transferred. We will provide notice before data becomes subject to a different privacy policy.

6. Data Retention

• Account data — Retained while your account is active. If you delete your account, we delete your data within 30 days (except where retention is required by law).
• Cached reviews — Synced reviews are retained as long as the associated workspace and Google connection exist. Deleting a workspace removes all associated reviews from our database.
• OAuth tokens — Deleted when you disconnect a Google connection or delete a workspace. You can also revoke access from your Google account permissions page.
• BoothRoll API keys — Deleted when the business disconnects BoothRoll or deletes the workspace.
• Album passwords — A password a business types for a guest text event is stored encrypted, shown to guests who open that event’s page and tap “Show password”, and deleted with the event or the workspace.
• Widget event data — Individual widget events (impressions, hovers, clicks, dismissals) are automatically deleted 30 days after they are recorded. Short-lived markers used to count unique daily visitors, which hold the visitor identifier, are deleted after 2 days. Daily aggregate counts derived from events, including counts per page path (path only, no query string), device type and browser, are kept for 400 days. Goal completion records, which hold the visitor identifier, are deleted 180 days after they are recorded. Records of conversions attributed to a widget, including the product ids stored with them, are kept for as long as the workspace exists and are removed when it is deleted.
• Public review page — The page’s settings and its view and click counts are kept while the workspace exists. When a business changes the page address, the old address is held for 30 days so only the same business can take it back. The review page and every address it holds are deleted when the workspace is deleted.
• Install locations — For each widget or site, the list of recent domains and page paths where it was displayed is deleted automatically 30 days after its most recent sighting (entries older than 30 days are removed whenever a new sighting is recorded), and immediately when the widget, site or workspace is deleted. We also keep the most recent domain and time on the widget or site until you delete it, and the date your first widget was seen on a website until you delete the workspace.
• AI app connections — Sign-in codes are deleted automatically within about a day after they expire. A connection is deleted when you disconnect the app in Settings, sign out, change or reset your password, or delete your account. An unused connection is deleted automatically after it ends, 60 days after it was last used. An app registration that is not used for 90 days is deleted automatically.
• AI security records — When an AI connection fails a security check, or an AI app changes something in your account, we keep a record with your user ID and the connection ID. For a change, it also holds the action name, the workspace and the IDs of the items changed. It never holds a token, an email address or an IP address. These records are deleted automatically after 30 days.
• Rate-limit records — To limit abuse we keep short-lived counters under hashed rate-limit keys. Some keys are built from a hashed IP address and others from your user ID. They are deleted automatically one day after their time window ends.
• Server logs — Automatically purged after 90 days.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• All data transmitted between your browser and our servers is encrypted with TLS.
• OAuth refresh tokens are stored server-side and never exposed to client-side code.
• The database rejects all direct access from browsers and widgets. Every read and write goes through our server, which checks on each request that your account is a member of the workspace whose data is being touched.
• We never see or store your password. Sign-in is handled by Firebase Authentication, which stores credentials in salted, hashed form (scrypt) on Google’s infrastructure.

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us immediately.

8. Cookies

The Dashboard uses essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies. The embeddable Widget sets no cookies, but it does store a visitor identifier and a session identifier in the browser’s local and session storage on the site where it is embedded (see section 2.3). Storage of that kind is treated like a cookie under privacy law even though it is not one. It is scoped to that single site and is not used for advertising or cross-site tracking. On Shopify stores, when tracking is allowed (see 2.3) and has items in the cart, the Widget adds a hidden attribute containing the visitor identifier to the store’s cart. It is blanked if the visitor opts out or the Widget detects withdrawn consent. When an order is placed, Shopify copies the attribute onto the order, where the store owner can see it in their Shopify order admin, so the visitor identifier stays on the store’s order record. Blanking the cart attribute does not change orders already placed.

The guest event page linked from a business’s text message sets one cookie, sms_seen_<event code>, the first time a browser opens it. It holds no identifier (its value is just “1”), is sent only to that one event page, and expires after 30 days. It exists so that a browser opening the page again is not counted as a new page open.

A business’s public review page sets one cookie, rp_seen_<page address>, the first time a browser opens it. It holds no identifier (its value is just “1”), is sent only to that one page, and expires after 30 days. It exists so that a browser opening the page again is counted as a repeat view, not a new visitor. Visits and clicks from recognised crawlers and link-preview fetchers are not counted.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”).
• Export your data in a portable format.
• Restrict or object to certain processing of your data.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

10. Children’s Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, reach out to us:

• Email: privacy@reviewwidget.com
• Company: Photobooth Decor