Privacy Policy

ReTestimonial is operated by G.A.M. Chamal Priyadarshana Rathnayaka of C/56/1, Dadayamthalawa, Ampara, Eastern Province, Sri Lanka. In this policy, ReTestimonial, we, us, and our refer to that operator.

For account, website, billing, and direct support information, ReTestimonial generally acts as the controller that decides why and how the information is processed. For testimonial content and other personal information a workspace customer submits or collects through the service, that customer generally acts as the controller or business and ReTestimonial acts as its processor or service provider. Requests about customer-controlled content should normally be directed first to the customer that collected it.

The information we collect includes:

• Account details such as your name, email address, company information, authentication provider identifiers, workspace settings, and billing metadata needed to operate your account.
• Customer proof content that you or your customers submit, import, record, upload, or connect, including testimonials, reviews, ratings, media files, transcripts, avatars, custom fields, tags, form responses, and related approvals.
• Usage, device, log, and analytics information such as IP-derived request data, browser and device details, pages viewed, embed events, widget impressions, video playback events, timestamps, referral URLs, and diagnostic logs.
• Integration and payment information from services you connect, such as authentication, review platforms, video hosting, storage, email delivery, rewards, payments, analytics, and webhooks. Payment card details are handled by our payment processor and are not stored directly by ReTestimonial.

We use information to provide, secure, maintain, and improve ReTestimonial, including collection forms, imports, widgets, Walls of Love, share pages, video processing, smart invites, notifications, support, abuse prevention, billing, and product analytics.

We may process testimonial content to generate transcripts, previews, summaries, recommendations, translations, spam signals, proof intelligence, and other features you choose to use.

We use contact and billing information to communicate about your account, send operational notices, process subscriptions and credits, respond to support requests, and enforce our agreements.

For processing governed by Sri Lanka's Personal Data Protection Act or the EEA or UK GDPR, we rely on performance of a contract to create and operate accounts and deliver requested features; our legitimate interests in securing, supporting, improving, and enforcing the service, preventing fraud and abuse, and understanding limited product usage; consent for optional marketing, non-essential technologies, or other processing where consent is requested; compliance with tax, accounting, regulatory, and other legal obligations; and, where applicable, the establishment, exercise, or defense of legal claims or protection of vital interests. We balance our legitimate interests against the rights and reasonable expectations of affected individuals.

Some features, such as spam detection, translation, transcription, and proof analysis, rely on automated processing of content that you or your customers submit. We do not use these features to make decisions that produce legal or similarly significant effects about an individual without human involvement. Where regional law gives you rights in relation to solely automated decision-making, we honor them as described below.

We and our providers use cookies and similar technologies, such as local storage, pixels, and device identifiers, to keep you signed in, remember preferences, secure the service, measure widget and page performance, and understand product usage. Strictly necessary technologies are required to operate the service; others are optional.

Our public embeds, widgets, share pages, and Walls of Love may set limited storage or send analytics events to measure impressions, playback, and interactions. Where you enable optional analytics integrations, such as Google Analytics or Google Tag Manager, those tools are configured by you and are governed by the applicable provider's terms and your own privacy notices.

You can control cookies through your browser settings, and blocking some technologies may affect how the service works. Where applicable law requires prior opt-in consent for non-essential technologies, we will offer a consent choice for them.

We share information with vendors and subprocessors that help us operate the service, such as hosting, database, authentication, video hosting, object storage, email delivery, payments, rewards, observability, AI/OCR providers, and customer support tools.

The providers we currently rely on include, among others:

• Authentication and account management — Clerk.
• Application hosting and delivery — Vercel.
• Database and file storage — Supabase and Cloudflare R2.
• Content delivery, edge caching, and rate limiting — Cloudflare and Upstash.
• Video hosting, streaming, and transcripts — Mux.
• Social video rendering — Amazon Web Services.
• Email delivery — Resend.
• Payments — Stripe.
• Gift card rewards — Tremendous.
• AI and OCR processing — Anthropic and OpenAI.
• Review and social media imports — Apify and Bright Data.

We maintain the current list of subprocessors and will make it available on request, and we require these providers to protect information consistent with this policy and to use it only to provide services to us.

We may disclose information if required by law, to protect rights and safety, to investigate abuse, or as part of a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by California law. We do not use your customer testimonial content for third-party advertising.

You control which testimonials, reviews, widgets, Walls of Love, forms, and share pages are published. Published content may be visible to anyone with access to the page, embed, or link.

You are responsible for having the rights, permissions, notices, and consents needed to collect, upload, import, display, and process customer content in ReTestimonial.

If you remove, archive, or unpublish content, it may take a reasonable period for caches, embeds, backups, and external search indexes to update.

We retain customer content while the relevant account is active. After account termination, the account owner may request an export for 30 days. Unless a shorter period is requested or a longer period is legally required, we delete customer content from active production systems within 60 days after termination and from routine backups within 90 days after termination.

We generally retain security and diagnostic logs for up to 12 months and billing, tax, and transaction records for up to seven years. We retain consent, unsubscribe, suppression, dispute, and legal-compliance records only for as long as reasonably necessary to honor preferences, demonstrate compliance, resolve disputes, or meet legal requirements.

You may delete projects, testimonials, media, forms, widgets, and other workspace data through the product where available. Video, cache, search-index, and other asynchronous deletion jobs may take additional time within the periods above. De-identified or aggregated information that can no longer reasonably identify a person may be retained longer.

We may preserve specific information beyond these periods when required by law, court order, fraud prevention, security investigation, payment dispute, or legal hold. When the exception ends, the information will return to the applicable deletion schedule.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, API key gates for internal services, signed webhook patterns, spam protections, and provider-level infrastructure controls.

No online service can guarantee absolute security. Please use strong credentials, protect your authentication provider, and contact us promptly if you believe your account or data has been compromised.

Sri Lanka. Subject to the Personal Data Protection Act and its commencement rules, you may request access, withdraw consent, object to certain processing, correct or complete inaccurate information, request erasure in the circumstances provided by law, and request review of certain decisions based solely on automated processing. If we refuse an eligible request, you may appeal to the Data Protection Authority of Sri Lanka.

EEA and United Kingdom. You may request access, rectification, erasure, restriction, and portability; object to processing based on legitimate interests; withdraw consent at any time; and complain to the supervisory authority where you live or work. You have an unconditional right to object to direct marketing. Withdrawing consent does not affect processing already carried out lawfully.

United States. Residents of California and other states with applicable privacy laws may have rights to know or access, correct, delete, and obtain a portable copy of personal information; opt out of sale, sharing, targeted advertising, or qualifying profiling; limit certain uses of sensitive personal information; receive equal service; and appeal a denied request where state law provides that right. ReTestimonial does not currently sell personal information or use it for targeted advertising.

Do Not Track and opt-out preference signals. Because we do not sell personal information or share it for cross-context behavioral advertising, we do not offer a “Do Not Sell or Share My Personal Information” page. Some browsers and extensions send Do Not Track or Global Privacy Control signals; where applicable law requires us to treat a recognized opt-out preference signal as a valid request, we honor it for the browser or device that sends it. The categories of personal information we collect, the sources, the purposes for using it, and the categories of recipients are described in the sections above and serve as our notice at collection under United States state privacy laws.

Canada, Australia, and New Zealand. Depending on the applicable law, you may request access or correction, withdraw consent where processing depends on consent, and complain to ReTestimonial or the relevant privacy regulator. Other regions may provide comparable rights, which we will honor where they apply.

To exercise a right, email privacy@retestimonial.com with your name, account email, relationship to ReTestimonial or a workspace customer, jurisdiction, and the right you wish to exercise. We may verify your identity and authority, and an authorized agent may need to provide written authorization. We aim to respond within one month for eligible Sri Lankan, EEA, and UK requests and within 45 days for eligible US state requests, subject to extensions allowed by law. If the information is controlled by one of our customers, we will direct the request to that customer or assist it as required.

You may unsubscribe from non-essential emails using the link in the message. You may also withdraw consent for optional processing by using the relevant product control or contacting us, without affecting processing already completed lawfully.

ReTestimonial is operated from Sri Lanka and uses service providers that may process information in the United States and other countries where they operate. Recipients may include the hosting, database, authentication, video, storage, email, payment, rewards, observability, AI/OCR, analytics, and support providers described above. Privacy laws in those locations may differ from the laws where you live.

ReTestimonial has not self-certified under the EU-U.S. Data Privacy Framework and does not currently offer its own EU Standard Contractual Clauses, UK International Data Transfer Agreement, or UK Addendum. Before making a restricted transfer that requires a specific legal mechanism, we will rely on an applicable adequacy decision, enter into the required approved contractual safeguards with the recipient, or use another transfer basis permitted for that transfer. If no lawful mechanism is available, we will not make the restricted transfer. Acceptance of this policy alone is not consent to an otherwise unlawful transfer.

Contact privacy@retestimonial.com before submitting EEA or UK personal information if you need confirmation of the transfer mechanism that will apply, or to request a copy of an applicable safeguard. Transfers from Sri Lanka will be handled under the Personal Data Protection Act, including any instruments specified by the Data Protection Authority or a statutory exception that applies to the particular transfer.

ReTestimonial is a business service and is not directed to children. We do not knowingly collect personal information from children under 16, and account holders must be adults as described in our Terms of Service.

If you are a customer collecting testimonials, you are responsible for having the appropriate consents where a person submitting content may be a minor. If you believe a child has provided us with personal information, contact privacy@retestimonial.com and we will take reasonable steps to delete it.

When you use ReTestimonial to collect testimonials and other personal information from your own customers, you generally act as the controller or business and we act as your processor or service provider for that content. If you require a Data Processing Agreement to govern that relationship, contact privacy@retestimonial.com and we will make one available.

If you are in the European Economic Area or the United Kingdom and interact with us as a controller in your own right, you can reach us about data-protection matters at privacy@retestimonial.com. Where we are required to designate a representative under Article 27 of the EU or UK GDPR, we will appoint one and identify it here or provide its details on request.

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify account owners or present notice in the product.