Privacy Policy

This Privacy Notice for Testify ("we", "us", "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.testify.day or any website of ours that links to this Privacy Notice
• Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. Contact us at hello@testify.day.

Summary of key points

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use.

Do we process any sensitive personal information? We do not process sensitive personal information (e.g. race, sexual orientation, religious beliefs).

Do we collect any information from third parties? We do not collect any information from third parties.

How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

With whom do we share personal information? Only with the third-party processors listed in section 4 below.

What are your rights? Depending on where you are located, you may have rights to access, correct, delete, port, or restrict processing of your personal information.

1. What information do we collect?

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register on the Services, express interest in our products, participate in activities on the Services, or contact us. This may include:

• names
• email addresses
• passwords (stored as bcrypt hashes only)
• optional profile pictures
• workspace details (business name, logo, brand colours)
• testimonial content you or your customers upload (text, images, videos, ratings, and optional respondent name / email / company)

Sensitive information. We do not process sensitive information.

Payment data. All payment data is handled and stored by Stripe. You may find their privacy notice at https://stripe.com/privacy. We only receive a Stripe customer ID and subscription status.

Social media login data. We may provide you the option to register using your Google account. If you choose to register this way, we collect the profile information described in section 5.

Information automatically collected. Some information — such as your IP address and browser characteristics — is collected automatically when you visit our Services. This includes:

• Log and usage data — IP address, device information, browser type, pages viewed, features used, error reports.
• Device data — device model, operating system, browser, screen resolution.
• Location data — approximate location derived from IP address (not GPS).

2. How do we process your information?

We process your personal information for a variety of reasons, including:

• to facilitate account creation, authentication, and manage user accounts;
• to deliver the Services (hosting your dashboard, serving embed widgets, sending new-testimonial email alerts);
• to process payments and prevent fraud (via Stripe);
• to protect our Services (spam detection, rate limiting, brute-force lockout);
• to respond to your support requests;
• to save or protect an individual's vital interest, such as to prevent harm;
• to comply with legal obligations.

3. What legal bases do we rely on to process your information?

The GDPR and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent. When you have given us permission to use your personal information for a specific purpose. You can withdraw consent at any time.
• Performance of a contract. To provide the Services you signed up for.
• Legitimate interests. To improve, secure, and market our Services, provided this is not overridden by your rights.
• Legal obligations. To comply with tax, accounting, and other legal requirements.
• Vital interests. To protect the safety of any person.

4. When and with whom do we share your personal information?

Vendors, consultants, and other third-party service providers. We may share your data with third parties who perform services on our behalf and require access to do that work.

The third parties we share personal information with are:

• Database hosting — MongoDB Atlas
• Backend hosting — Railway
• Frontend hosting & CDN — Vercel
• Media storage (avatars, images, videos) — Amazon Web Services S3
• Invoice and billing — Stripe
• Transactional email — Resend
• Spam & bot protection — Google reCAPTCHA
• Social login — Google Sign-In

We also may need to share your personal information in the following situations:

• Business transfers. In connection with any merger, sale of company assets, financing, or acquisition of all or part of our business.

5. How do we handle your social logins?

Our Services offer you the ability to register and log in using your Google account. When you do this we receive certain profile information about you from Google — typically your name, email address, and profile picture. We use this information only for the purposes described in this Privacy Notice. We do not control, and are not responsible for, other uses of your personal information by Google. Review Google's privacy notice to understand their practices.

6. Is your information transferred internationally?

Our servers and cloud providers are located in India and the United States. If you are accessing our Services from outside these countries, be aware that your information may be transferred to, stored by, and processed by us and our processors in the United States, India, and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not have data-protection laws as comprehensive as those in your country. We will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law, including standard contractual clauses where required.

7. How long do we keep your information?

We only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax records — kept for 7 years).

When you delete your account, we remove personal data within 30 days from active databases. If any data has been backed up, we isolate it from further processing until deletion is possible.

8. Do we collect information from minors?

We do not knowingly collect data from, or market to, children under 16 years of age. By using the Services, you represent that you are at least 16, or that you are the parent or guardian of such a minor. If we learn that personal information from users under 16 has been collected, we will deactivate the account and delete the data. If you become aware of any data we may have collected from a child under 16, contact us at hello@testify.day.

9. What are your privacy rights?

In some regions (like the EEA, UK, Switzerland, and California) you have certain rights under applicable data-protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict processing of your personal information, (iv) data portability, and (v) not to be subject to automated decision-making.

You can exercise most of these directly from Settings → Account in your dashboard, or by emailing hello@testify.day. We will consider and act on any request in accordance with applicable law.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you also have the right to complain to your local data-protection authority.

Withdrawing your consent. If we are relying on your consent, you have the right to withdraw it at any time — this will not affect the lawfulness of processing before its withdrawal.

Account information. If you would like to review or change the information in your account or terminate your account, contact us using the contact details in section 12.

10. Controls for Do-Not-Track features

Most web browsers include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will inform you in a revised version of this Privacy Notice.

11. Do we make updates to this notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date at the top. If we make material changes, we may notify you either by prominently posting a notice in-app or by emailing you. We encourage you to review this Privacy Notice frequently.

12. How can you contact us about this notice?

If you have questions or comments about this notice, email us at hello@testify.day.

13. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. To request to review, update, or delete your personal information, please email us at hello@testify.day. Most of these actions can also be performed directly from Settings → Account inside your dashboard.