Privacy Policy
Last updated: 4 October 2026
This Privacy Policy explains how Truewidgets, a service of Loom Factor Limited ("Truewidgets", "we", "us"), collects, uses, and protects information when you use our website and services (the "Service") — the review widgets, dashboards, and the optional Google Business Profile connection. By using the Service you agree to this Policy.
1. Information we collect
- Account information — your name, email address, and a securely hashed password when you create an account. If you sign up or sign in with Google instead, Google gives us your name, email address, profile picture and Google account ID (and no password).
- Business content you provide — the business names, locations, logos, colours, and widget settings you add.
- Google account data (only if you connect Google Business Profile) — see Section 4.
- Business verification — before anything about a business is shown publicly, you show it's yours. For a business that isn't on Google, that is the website address you give us (we look for a code on its homepage) or an email address at its domain (we send it a one-time link, and keep the address to record how the business was verified).
- Business lookups — when you search for a business in the demo on our website, or check Local ranking in your dashboard, we look it up with Google Maps Platform to show you the results there and then (see Section 5). We keep nothing from those lookups. The demo also shows the business's website icon, which your browser loads from DuckDuckGo's icon service.
- Reviews and private notes customers leave — through your review link or QR code: the name, rating and words they give, and an email address or phone number if they choose to add one.
- Payment information — if you subscribe to a paid plan, payments are processed by Stripe. We receive limited billing details (plan, status, last four digits, country); we never see or store your full card number.
- If you add Truewidgets Reviews to a Wix site — Wix tells us the site's ID, name and address, the email address of the site's owner, and which of our plans the site pays for. We use them to set up and run that site's Truewidgets account. Wix takes the payments for the app; we never see card details.
- Usage & device data — basic logs, IP address, browser type, and aggregate widget impression/click counts used to operate and improve the Service.
2. How we use information
- To provide, maintain, and secure the Service and your account.
- To pull, cache, and display your reviews and business information inside your widgets.
- To process subscriptions and prevent fraud and abuse.
- To respond to support requests and send essential service notices.
- To understand aggregate usage so we can improve features and performance.
3. Legal bases
Where applicable law (such as the GDPR) requires it, we process your information to perform our contract with you, to comply with legal obligations, for our legitimate interests in operating and securing the Service, and — where required — with your consent (for example, when you connect your Google account).
4. Google user data
If you choose to connect your Google Business Profile, you authorise us through Google's OAuth consent screen using the https://www.googleapis.com/auth/business.manage scope. With your authorisation we access, on your behalf, only the data needed to provide the Service:
- the Business Profile accounts and listings you manage, and whether Google has verified that you manage each one (that is how we know a business is yours);
- your reviews, star ratings and replies — to show them in your widgets and on your reviews page, to tell you about new and low ratings, and to post the replies you write;
- your business information (name, address, categories, description, hours, phone, website) — to set up your location and show how complete your profile is;
- how your profile is doing (views, calls, website clicks, direction requests) — shown on your Google listing page;
- your services and posts — so the posts you write here, and the services and posts you approve in Autopilot, go on your listing.
We change your listing only when you ask: a reply or post you write and send, or an Autopilot draft you approve. If you switch on Autopilot's automatic publishing for a location, the drafts it writes from your own website go on that listing without a click each time, until you switch it off.
We store an encrypted Google refresh token so the connection keeps working, and a copy of the reviews and profile fields you display. We refresh that copy every day while you're connected, and delete anything we haven't been able to refresh within 30 days. You can disconnect at any time from your dashboard, and you can remove our access at myaccount.google.com/permissions.
When you ask for a draft reply or a post caption, the review's text and rating are sent to our AI provider (Anthropic, Section 5) to write it, and come back to you to edit. Nothing is sent for that unless you ask.
Limited Use disclosure. Truewidgets' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you see in Truewidgets. We do not use it for advertising, we do not sell it, we do not use it to develop, improve or train artificial intelligence or machine-learning models (ours or anyone else's), and we do not allow humans to read it except (a) with your consent, (b) for security or to comply with law, or (c) where the data is aggregated and anonymised.
5. How we share information
We do not sell your personal information. We share it only with:
- Service providers (subprocessors) that run the Service on our behalf, each with
only what its job needs:
- Vercel (our website) and Cloudways (our app and its database) — hosting;
- Stripe — payments;
- Zoho Mail — sending our emails, so it handles the email addresses and what the emails say;
- Anthropic — AI writing: for a draft reply or caption you ask for, the review's text and rating and your business's name; for Autopilot, text from your own website's pages. Anthropic does not use what we send to train its models;
- DataForSEO — for Keywords: short phrases from your reviews and your business's name, to look up how often people search for them (no personal information);
- Google — the Business Profile connection you choose, sign-in with Google if you use it, and Google Maps Platform for business lookups;
- Google Analytics — measuring how our website and app are used and, when we advertise, our ads: only as described under Cookies in Section 1;
- Wix — if you use Truewidgets Reviews on a Wix site: Wix runs the app's billing, and we check with Wix which site and which plan a request is for.
- Legal and safety — where required by law, or to protect the rights, safety, and security of Truewidgets, our users, or the public.
- Business transfers — if Truewidgets is involved in a merger, acquisition, or asset sale, subject to this Policy.
Google Maps Platform. The business search in our website's demo and Local ranking in your dashboard use Google Maps Platform (the Places API). What is looked up through them is also subject to the Google Privacy Policy, which is incorporated into this Policy by reference for those features.
6. Data retention & deletion
We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account at any time from your dashboard or by contacting us; we will delete or anonymise your personal information within a reasonable period, except where we must retain it to comply with legal obligations. Disconnecting Google deletes the stored Google token straight away; the Google reviews and profile content we stored are deleted within 30 days of their last refresh. If you remove Truewidgets Reviews from a Wix site, we keep that site's account for 30 days in case you add the app back, then delete it.
7. Security
We protect your information with encryption in transit (HTTPS), encryption of sensitive tokens at rest, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to promptly address any issues.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at the address below. You also have the right to complain to your local data protection authority.
9. International transfers
We may process and store information in countries other than yours. Where we transfer personal information internationally, we take steps to ensure it receives an adequate level of protection.
10. Children
The Service is for businesses and is not directed to children under 16, and we do not knowingly collect their personal information.
11. Changes to this Policy
We may update this Policy from time to time. We will post the new version here and update the "Last updated" date above; material changes will be communicated where appropriate.
12. Contact us
Questions about this Policy or your data? Email hello@truewidgets.com.
The controller of your personal information is Loom Factor Limited, Unit 12, Dewsbury WF13 1QU, United Kingdom.