Privacy policy

Controller. TrustPlug is the controller of the data described in section 1 for our own website and inbox. Contact for any privacy request: [email protected].

Two roles. For anything a plugin does on a published site — showing reviews, checking a visitor's country, collecting feedback — the site owner is the controller and we act as their processor, on their documented instructions (their settings). The site owner is responsible for giving their own visitors any privacy notice, and for any consent their jurisdiction requires. A data-processing addendum is available on request.

Testimonials fetches the public Google reviews of the place you connect (review text, rating, the author's display name and photo as published by Google, and the date). Open Hours fetches that place's opening hours, and — if you connect one — the events of a Google Calendar made public, or of any calendar whose iCal (.ics) address you give us. We retrieve all of it server-side, using our own Google keys, which are never placed in your published page.

Requests your published page makes. The widget calls our API (a Cloudflare Worker) and nothing else on our side:

These values are the site owner's, not the visitor's. There is no per-visitor check, no IP geolocation, no counter and no profile for these two plugins. Like any web server, our API receives the visitor's IP address in order to answer; our code does not store it or write it to a log. One thing to know: reviewers' profile photos are loaded by the visitor's browser straight from Google's servers, so Google can see that request.

Social Feed fetches the public posts of the Instagram account you connect (the image or video link, caption and post link). We retrieve them through Apify, a third-party scraping service, and cache them for 24 hours so we do not re-fetch on every page view. We never ask for, receive or store an Instagram password, and the plugin does not log in to Instagram. Only connect an account you own or are authorized to represent, and make sure you have the right to show its content on your site.

We do not copy the pictures or videos to our servers. The visitor's browser loads them directly from Instagram's content network, so Instagram (Meta) can see that request — including the visitor's IP address. If you need to avoid that, do not use this plugin on your site, or mention it in your own privacy notice. Our API itself performs no per-visitor check and sets no cookie.

Landmark sends the address you typed to our API, which builds the address of a Google Maps embed and returns it. The map itself is Google's: the visitor's browser loads it from Google, so Google receives the visitor's IP address and may read or set its own cookies, under Google's privacy policy. The Maps Embed API itself is free for us; the key it needs is restricted to that one product. If the embed cannot load, the plugin falls back to a plain link to Google Maps. If your jurisdiction requires consent before loading Google content, you can place the plugin behind your own consent banner.

When a rule depends on where the visitor is, the page asks our API for the visitor's approximate location. Our servers answer from the data Cloudflare attaches to the connection (country, and where available region, city and whether the country is in the EU). The IP address is used for that lookup only. Nothing is stored and there is no individual record of the visit. No automated decision produces legal or similarly significant effects: the check only decides which page a browser shows.

Feedback asks a visitor how well the site helped them, and optionally to report a problem, suggest an idea or write a message. A visitor can answer with a single click, with no email and no text. Each answer is sent to our API, which checks it and forwards it to the destination the site owner chose.

Each plugin page runs the real plugin. To do that, your browser calls our API with the demo's public values: a public Google Place ID (Testimonials, Open Hours), a public address (Landmark), and the @nasa Instagram account (Social Feed). The demo for Feedback sends nothing: its submit action is switched off on this site. Gatekeeper, Pathfinder and Standby Mode run in preview mode with a simulated visitor, so no real location lookup is made for them. The same rules as above apply to what the API sees.

Only to run the service: fetching and caching what a plugin displays, applying a rule, relaying an answer, protecting against abuse, and answering you. We never sell or rent personal data, we do not use it for advertising, and we do not build profiles of site owners or their visitors.

Where a provider is outside the EU/EEA, transfers rely on the safeguards that provider offers under the GDPR (an adequacy decision or Standard Contractual Clauses). We use these providers only for the purposes above.

Cached reviews and Instagram posts expire after 24 hours, opening hours after 6 hours, calendar events after 5 minutes. The rate-limit counter lasts 10 minutes. We do not keep visitor IP addresses. Waitlist addresses are kept until the plugin you asked about launches and we have written to you once, or until you unsubscribe or ask us to delete them; contact and suggestion messages are kept for 12 months after the last exchange. The hash of your IP address used for rate limiting is kept with the entry it belongs to and deleted with it. Every mail we send carries a one-click unsubscribe link, and an address can be erased entirely, messages included, on request. To have your data deleted, write to us at the address below; we answer within 30 days, except for records we must keep by law.

Under the GDPR and similar laws you can ask to access, correct, delete, restrict or object to the use of your data, to receive it in a portable format, and to withdraw consent where processing relies on it. Email [email protected]. You can also complain to your data protection authority — in France, the CNIL. If your data was handled by a plugin on a site you visited, send your request to that site's owner (the controller); they can instruct us as their processor.

Our website sets no cookies and uses no browser storage. Our plugins set no cookies on your visitors. The only things they keep in a visitor's own browser are functional notes described above: that a banner was dismissed (Pathfinder), when a countdown began (Standby Mode), and that a feedback popup was answered or put off, and which FAQ answers were voted on (Feedback and FAQ). None are shared with us or used for tracking. Content loaded from Google (the map, reviewers' photos) and Instagram (images) is governed by those companies' own cookie and privacy policies.

Everything is served over HTTPS. Our Google and Apify keys are held only on our servers and are never placed in a published page. Webhook destinations are restricted to a fixed list of hosts, and messages relayed to chat tools are escaped so they cannot trigger mentions. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authority as the law requires.

Our plugins are still in development, and this policy describes how the code behaves today. We will update it — and the date above — whenever that changes, in particular before accounts, billing, VPN detection or stored feedback go live. Questions or requests: [email protected].