Privacy policy

Controller. TrustPlug is the controller of the data described in section 1 for our own website and inbox. Contact for any privacy request: [email protected].

Two roles. For anything a plugin does on a published site — showing reviews, checking a visitor's country, collecting feedback — the site owner is the controller and we act as their processor, on their documented instructions (their settings). The site owner is responsible for giving their own visitors any privacy notice, and for any consent their jurisdiction requires. A data-processing addendum is available on request.

Open Hours fetches the opening hours of the place you connect, and — if you connect one — the events of a Google Calendar made public, or of any calendar whose iCal (.ics) address you give us. We retrieve all of it server-side, using our own Google keys, which are never placed in your published page.

Requests your published page makes. The widget calls our API (a Cloudflare Worker) and nothing else on our side:

These values are the site owner's, not the visitor's. There is no per-visitor check, no IP geolocation, no counter and no profile for these two plugins. Like any web server, our API receives the visitor's IP address in order to answer; our code does not store it or write it to a log. One thing to know: reviewers' profile photos are loaded by the visitor's browser straight from Google's servers, so Google can see that request.

Social Hub fetches the public profile and posts of the social media accounts you connect (name, picture, follower count, the image or video link, caption and post link). The latest TikTok videos are retrieved through Apify, a third-party scraping service; YouTube, Snapchat, LinkedIn, X and the other networks are read from their public pages, feeds and embeds. Everything is cached (24 hours through Apify, 6 hours otherwise) so we do not re-fetch on every page view. We never ask for, receive or store a password, and the plugin does not log in to any network. Only connect an account you own or are authorized to represent, and make sure you have the right to show its content on your site.

We do not copy the pictures or videos to our servers. The visitor's browser loads them directly from each network's content servers (and plays videos in the network's own player), so that network can see the request — including the visitor's IP address. If you need to avoid that, do not use this plugin on your site, or mention it in your own privacy notice. Our API itself performs no per-visitor check and sets no cookie.

Landmark sends the address you typed to our API, which builds the address of a Google Maps embed and returns it. The map itself is Google's: the visitor's browser loads it from Google, so Google receives the visitor's IP address and may read or set its own cookies, under Google's privacy policy. The Maps Embed API itself is free for us; the key it needs is restricted to that one product. If the embed cannot load, the plugin falls back to a plain link to Google Maps. If your jurisdiction requires consent before loading Google content, you can place the plugin behind your own consent banner.

When a rule depends on where the visitor is, the page asks our API for the visitor's approximate location. Our servers answer from the data Cloudflare attaches to the connection (country, and where available region, city and whether the country is in the EU). The IP address is used for that lookup only. Nothing is stored and there is no individual record of the visit. No automated decision produces legal or similarly significant effects: the check only decides which page a browser shows.

Feedback asks a visitor how well the site helped them, and optionally to report a problem, suggest an idea or write a message. A visitor can answer with a single click, with no email and no text. Each answer is sent to our API, which checks it and forwards it to the destination the site owner chose.

Cookie Consent runs entirely in the visitor's browser and sends nothing to our servers. It keeps the visitor's choice (which categories were accepted, and when) in a first-party cookie named tp_consent, with a copy in the browser's local storage, on the site where it runs and for the period the site owner sets (6 months by default, 13 at most). Once a category is accepted, it loads the tracking tools the site owner configured (for example Google Analytics or the Meta Pixel), which are then governed by those companies' own policies. When a category is refused or withdrawn, it deletes those tools' cookies on that site.

Each plugin page runs the real plugin. To do that, your browser calls our API with the demo's public values: a public Google Place ID (Open Hours), a public address (Landmark), and NASA's public social media accounts (Social Hub). Smart Pricing asks for your country and today's exchange rates, and Store Locator for your city and the location of its sample addresses. The demos for Feedback, Booking, Quote Calculator and Launch List send nothing: they run in test mode on this site, and Status Page shows sample data. Standby Mode runs in preview mode with a simulated visitor. The same rules as above apply to what the API sees.

Only to run the service: fetching and caching what a plugin displays, applying a rule, relaying an answer, protecting against abuse, and answering you. We never sell or rent personal data, we do not use it for advertising, and we do not build profiles of site owners or their visitors.

Where a provider is outside the EU/EEA, transfers rely on the safeguards that provider offers under the GDPR (an adequacy decision or Standard Contractual Clauses). We use these providers only for the purposes above.

Cached social posts expire after 6 to 24 hours, opening hours after 6 hours, calendar events after 5 minutes, located addresses after 30 days. The rate-limit counter lasts 10 minutes. Held booking times are deleted 30 days after the appointment; Launch List sign-ups are kept until the site owner asks us to delete the list; Status Page history is kept for up to 100 days (section 10). We do not keep visitor IP addresses. Waitlist addresses are kept until the plugin you asked about launches and we have written to you once, or until you unsubscribe or ask us to delete them; contact and suggestion messages are kept for 12 months after the last exchange. The hash of your IP address used for rate limiting is kept with the entry it belongs to and deleted with it. Every mail we send carries a one-click unsubscribe link, and an address can be erased entirely, messages included, on request. Customer accounts are kept until you delete them; an account whose email is never confirmed is erased after 30 days. Sessions expire after 30 days, or when you sign out. You can delete your account yourself in one click from your account page (/account): any subscription still running is stopped first (it stays active until the end of the period already paid, then ends), and your email, password hash, profile picture, sessions and pending links are erased at once. Purchase records are kept for 10 years, as French accounting law requires, with your email only as a salted hash. To have any other data deleted, write to us at the address below; we answer within 30 days, except for records we must keep by law.

Under the GDPR and similar laws you can ask to access, correct, delete, restrict or object to the use of your data, to receive it in a portable format, and to withdraw consent where processing relies on it. Email [email protected]. You can stop a subscription, open your invoices, or delete your account yourself, in one click, from your account page. You can also complain to your data protection authority — in France, the CNIL. If your data was handled by a plugin on a site you visited, send your request to that site's owner (the controller); they can instruct us as their processor.

Our website sets no cookies. If you sign in, your browser keeps your session token in its local storage (trustplug-session) so that you stay signed in; the TrustPlug plugin inside Framer does the same (trustplug-studio-session). Signing out or deleting your account removes it. Our plugins set one cookie on your visitors, and only Cookie Consent does: tp_consent, which remembers their cookie choice (section 9). The other things they keep in a visitor's own browser are functional notes described above: when a countdown began (Standby Mode), and that a feedback popup was answered or put off, and which FAQ answers were voted on (Feedback and FAQ), a visitor's reading settings (Accessibility), their own invite code and the code that invited them (Launch List), the currency they picked (Smart Pricing) and that the greeting was shown (Contact Bubble). None are shared with us or used for tracking. Content loaded from Google (the map) and from the social networks you connect (images, videos) is governed by those companies' own cookie and privacy policies.

Everything is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes, and session and email-link codes only as hashes. Sign-up, sign-in and password-reset requests are rate-limited, and an account works only once its email is confirmed. Our Google and Apify keys are held only on our servers and are never placed in a published page. Webhook destinations are restricted to a fixed list of hosts, and messages relayed to chat tools are escaped so they cannot trigger mentions. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authority as the law requires.

Our plugins are still in development, and this policy describes how the code behaves today. We will update it — and the date above — whenever that changes, in particular before payments or VPN detection go live. Questions or requests: [email protected].