Privacy Policy

Last updated: July 13, 2026

We built ReviewSnippet to be privacy-friendly by default: no cross-site tracking, no behavioural profiling, no advertising cookies, no reCAPTCHA/hCaptcha, and we never sell personal data. Spam is prevented by an in-browser proof-of-work that sends nothing to any third party.

This marketing site shows ads -- the privacy-first kind. reviewsnippet.us runs contextual ads via Pixboard (another product of ours): they're chosen by the page's topic, not by anything about you -- no cookies, no profile, no cross-site tracking. They're served first-party, proxied through our own server under an opaque path, so your browser never contacts an ad network and the ad network never sees you; each ad carries an "Ads by Pixboard" label. The reviews widget you install on your own site carries none of this -- it loads nothing from anyone.

One more script here is a third party in the browser's sense of the word: the chat bubble is Curio, another product of ours, served from getcurio.chat. Your browser loads it on every page here, so that domain sees your IP and which page you're on, and it keeps your conversation in your browser's local storage. It's there to answer questions, not to follow you, and we don't use it for advertising or analytics -- but it is a separate origin, and you deserve to be told rather than to find it in the network tab. The reviews widget itself loads nothing from anyone; this applies to reviews.whitneys.co, not to sites that install ReviewSnippet.

1. Our two roles: controller and processor

• For account holders (site owners). When you create an account and use the dashboard, we are the controller of your account data (for example, your email address).
• For reviews collected through your widget. The reviews your visitors submit are personal data that you decide the purposes for. For that data you are the controller and we act as your processor, handling it on your documented instructions to provide the service. If you are subject to the GDPR, a Data Processing Agreement governs that relationship -- contact us to put one in place.

2. Data we process

• Account data: your email address, the sites you register (name, slug, allowed domains, theme, settings), and one-time login tokens.
• Review data: the reviewer's chosen display name, star rating, review text, and the time of submission. For spam prevention and abuse handling we also record the submitter's IP address and browser user-agent with the review.
• Server logs: standard request metadata (IP address, user-agent, timestamps, paths, error events) generated when the service is used, kept for security and reliability.
• Session cookie: a single strictly-necessary cookie that keeps you signed in to the dashboard. That's the only cookie we set.

The embeddable widget itself does not set any cookies on your visitors' browsers.

3. Why we process it, and our lawful bases (GDPR Article 6)

• To provide the service -- create your account, store and display reviews, run the dashboard: performance of a contract (Art. 6(1)(b)).
• To authenticate you via magic link: performance of a contract.
• To keep the service secure and spam-free -- proof-of-work checks, rate limiting, and retaining a submission's IP/user-agent: our legitimate interests in preventing abuse and protecting the service and its users (Art. 6(1)(f)).
• To comply with legal obligations where they apply (Art. 6(1)(c)).

For the review data where we act as your processor, the lawful basis is determined by you, the site owner, in your own privacy notice.

4. Cookies

We use one strictly-necessary session cookie to keep dashboard users logged in. Under the GDPR/ePrivacy rules, strictly-necessary cookies do not require consent, so we show no cookie banner. We use no analytics, advertising, or third-party cookies.

5. Sharing and subprocessors

We do not sell personal data or share it for advertising. We share data only with providers that help us run the service, under appropriate contractual protections:

• Hosting & database -- our own server and a MongoDB database hosted with DigitalOcean (United States), where the application and data are stored.
• Email delivery -- Zoho Mail, used to send magic-link login emails.

We may also disclose data if required by law or to protect our rights, and we may transfer data as part of a merger or acquisition, subject to this policy.

6. International transfers

Our servers are located in the United States. If you or your visitors are in the European Economic Area, the UK, or Switzerland, your data may be transferred outside those areas. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact us for details.

7. Retention

• Reviews are kept until the person who wrote them erases them, or the site owner closes the account. The site owner cannot delete a review; only its author can. A review taken down for a stated policy reason stops being displayed but is retained as a record of the takedown.
• Account data is kept for as long as the account is active, then deleted or anonymized within a reasonable period after closure.
• Magic-link tokens expire after 20 minutes and are single-use.
• Server logs are retained only as long as needed for security and operations, then rotated or deleted.

8. Your rights

Depending on where you live (including under the GDPR/UK GDPR), you may have the right to: access a copy of your personal data; correct inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent where processing relies on it. You will not be discriminated against for exercising these rights.

• For a review you wrote, erasure is in your own hands. The link you received when you submitted it erases the review together with everything stored alongside it -- your name, the text, your email if you gave one, and the IP it came from. No request, no identity check, no waiting on anyone. If you no longer have the link, email reviews@whitneys.co and we will verify you another way; we cannot resend the link itself, because we do not store it.
• To exercise any of these for data where we are the controller, email reviews@whitneys.co. We may need to verify your identity.
• For a review you submitted on someone's website, the site owner is the controller -- contact them, or contact us and we will pass the request along and assist as their processor. Note the site owner has no ability to erase your review even if asked; that control belongs to you.
• If you are in the EEA/UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

9. Security

We protect data with measures including passwordless magic-link authentication (no stored passwords), transport encryption (HTTPS), one-time login tokens bound to the requesting browser, invisible proof-of-work and rate limiting against abuse, isolation of the widget in a Shadow DOM, and access controls so owners only see their own sites. No method of transmission or storage is completely secure.

10. Children

The service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided data, contact us and we will delete it.

11. For site owners using our widget

If you collect reviews with ReviewSnippet, you are a data controller for that data. You are responsible for having a lawful basis, providing your own privacy notice to your visitors, and honoring their rights. We will support you as your processor, including with a Data Processing Agreement on request.

12. Changes

We may update this policy. We will change the "last updated" date above and, for material changes, take reasonable steps to notify account holders.

13. Contact

Privacy questions or requests: reviews@whitneys.co. If we appoint an EU or UK representative under Article 27, their contact details will be listed here.