Privacy Policy

This policy explains how [company legal name, e.g. Example Technologies Private Limited] ("Widgetcraft", "we", "us") collects, uses and protects personal data when you use Widgetcraft — our website, dashboard and the review widgets our customers embed on their websites. It is published under the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For personal data of our customers we act as a Data Fiduciary.

1. Who we are

[company legal name, e.g. Example Technologies Private Limited], [registered office address]. Email: [support email].

2. Data we collect

From customers (people who create an account):

• Account data: name, email address and a password (stored only as a one-way hash).
• Billing data: your Stripe customer and subscription identifiers and billing status. Card details are entered on Stripe's page and are never seen or stored by us. Stripe may collect your billing address and tax ID for invoices.
• What you put into the product: widget names and settings, the Google Maps links of the businesses you add, labels, testimonials you type or import, and uploaded images.
• Technical data: a session cookie that keeps you logged in, and IP addresses used briefly for security and rate limiting (not stored in our database).

Public review data: for the businesses our customers add, we read the reviews Google shows publicly — the reviewer's public display name, profile photo link, star rating, review text, photos, date and the business owner's reply — and the business's public name, address, rating and review count. This data has been made public by the reviewers on Google. We store it so our customers can display it on their own websites. We do not combine it with other data or use it to profile anyone.

Visitors to our customers' websites: when a widget loads, the visitor's browser connects to our servers. We count widget views per widget per month (a number, not per person) and use the visitor's IP address only transiently for security and rate limiting. The widget sets no cookies and has no advertising or analytics trackers. Review photos and profile pictures load from Google's servers.

3. Why we use it

• To provide the service: your account, widgets, review refreshes and the public widget data (performance of our contract with you).
• To take payments and keep tax records (contract and legal obligation).
• To send service emails such as password resets, security notices and important changes. We do not send marketing email.
• To generate optional AI summaries of the public reviews in your widget.
• To keep the service secure, prevent abuse and fix problems.

Where we rely on your consent you can withdraw it at any time; this does not affect processing done before withdrawal.

4. Who we share it with

We do not sell personal data. We use these service providers (data processors), only for the purposes above:

• Oracle Cloud Infrastructure — servers, database, backups and email delivery (data centre in Frankfurt, Germany).
• Stripe — payments, subscriptions and invoices.
• Google (Gemini API) — writes the optional AI summary from the public review text in a widget.
• Resend — internal operational alerts to our team (they contain no customer data beyond technical details).

We may disclose data when required by Indian law or a lawful order of a court or government authority.

5. Transfers outside India

Our servers are in Germany and some providers process data in other countries. Transfers are made under the DPDP Act, which permits them except to countries restricted by the Government of India, and our providers protect the data with industry-standard safeguards.

6. How long we keep it

• Account and widget data: while your account is open. When you delete your account (or ask us to), we delete it within 30 days, except what we must keep by law (for example invoices and tax records, kept for 8 years under Indian tax law).
• Public review data: while at least one customer's widget uses that business; removed reviews are deleted on request.
• Backups: up to 30 days, after which they are deleted automatically.

7. Security

We use reasonable security practices as required by the IT Act and its rules: encrypted connections (HTTPS), hashed passwords, hashed session tokens, access limited to the people who run the service, firewalled servers and encrypted, access-controlled backups. If a personal data breach occurs we will inform the Data Protection Board of India and affected users as the law requires.

8. Your rights

Under the DPDP Act you can ask us to: tell you what personal data we hold and how we use it; correct, complete or update it; erase it; and address a grievance. You may also nominate a person to exercise these rights if you die or become incapacitated. Email [support email] — we reply within 30 days.

Reviewers: if a review you wrote on Google is shown in a widget and you want it removed, email us with a link to the review. Deleting or editing it on Google also removes or updates it at our next refresh (within 24 hours).

9. Children

Widgetcraft is a business service for people aged 18 and over. We do not knowingly collect data from children.

10. Grievance Officer

In line with the IT Act, 2000 and the rules made under it, and the DPDP Act, our Grievance Officer is:

[grievance officer name]
[company legal name, e.g. Example Technologies Private Limited], [registered office address]
Email: [grievance officer email]

We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

11. Changes

We will post changes here with a new effective date, and email account holders about material changes before they apply.