Privacy Policy

Last updated 25 September 2026. [Registered company name], [Registered office address, India].

This policy explains what personal data Testimonia processes and why. It is written to meet India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU/UK GDPR.

What we collect

• Account data: your email address and name, and your Google account ID if you sign in with Google.
• Workspace content: your brand details, product description, forms, widgets, website research results and the reviews in your workspace.
• Reviewer data: when someone submits a review on your form: their name, rating, words, optional photo, video, role, company and links, and their consent. For this data, your business decides how it is used and we process it on your behalf.
• Payment data: handled by Razorpay. We receive the subscription status, never your full card or UPI details.
• Technical data: a session cookie to keep you signed in, IP address for security and rate limiting, and server logs.

Why we use it

To provide the service you signed up for, to secure it, to bill you, to send service emails (sign-in links, new-review alerts), and to meet legal duties. We do not sell personal data and do not use it for third-party advertising.

Who we share it with

• Hosting and database: Railway (United States).
• File storage: Cloudflare R2.
• Email delivery: Resend.
• Payments: Razorpay (India).
• AI processing: OpenRouter and the model provider it routes to, only for the text you or your customers ask the AI to work on. They may process data outside India.

How long we keep it

For as long as your account exists. When you delete your account, your workspace, reviews, forms and media are deleted immediately from our database; backups roll off within 30 days. Payment records are kept as tax law requires.

Your rights

You can access and export your data (Settings → Account & data), correct it, and delete your account. Reviewers who want their review removed can ask the business that collected it, or write to us and we will pass it on. You may withdraw consent at any time.

Cookies

We use one essential cookie to keep you signed in, and a short-lived one during Google sign-in. No advertising or tracking cookies.

Security

Data is encrypted in transit. Sign-in links and sessions are stored only as hashes. Access to production data is limited to people who need it to run the service.

Children

The service is not meant for anyone under 18.

Grievance Officer

[Name of Grievance Officer], [Registered company name], [Registered office address, India]. Email: [grievance@yourdomain.com]. We acknowledge complaints within 24 hours and resolve them within 15 days.

Questions: [support@yourdomain.com] · Terms · Privacy · Refunds