Who this covers
Wallsy (“we”, “us”) runs wallsy.live, a tool that helps businesses collect testimonials from their customers, approve them, and show them on a Wall of Love page or a website widget. This policy covers four groups of people:
- Account holders — businesses and people who sign up and use Wallsy.
- Reviewers — customers who send a testimonial through a business’s collection page.
- Authors of imported posts — people whose public post on X (Twitter) a business on a paid plan has chosen to import as a testimonial.
- Visitors — anyone browsing wallsy.live, our blog, or a page or widget that shows testimonials.
For account and website data, we decide how it is used. For testimonials, the business that asked for them decides what to collect and publish, and we process that data on its behalf to provide the service.
What we collect from account holders
- Sign-in details. You sign in with Google. Google shares your name, email address and basic profile information with us; we never see your Google password.
- Business profile. The business name, website address, logo and brand colour you add in Settings.
- What you create. Collection pages, Walls of Love, widgets, tags, and your approve, reject and publish decisions.
- Billing. Payments for Pro are handled by Polar, our payment provider, on its own secure checkout. We do not receive or store your card number. We keep your plan, subscription status and billing period so we know which features to switch on.
What we collect from reviewers
When you send a testimonial through a collection page, we store what you type into the form:
- your name, star rating and testimonial text (required);
- your email address, if you give one — it is only visible to the business and is never shown publicly;
- your company, job title, a photo and a social or website link, if the business’s form asks for them and you fill them in;
- a record of your permission to publish: whether you agreed and when. The consent checkbox is required before a testimonial can be sent;
- a scrambled (salted and hashed) version of your IP address, used to spot spam and abuse. We don’t store the IP address itself.
Nothing you send goes public on its own. A testimonial only appears on a Wall of Love or widget after the business has reviewed and published it, and only if you gave permission. Your email address is never part of what is shown.
What we collect about imported posts from X
On a paid plan, a business can paste the link to a public post on X and add it as a testimonial. We then fetch that post once through X’s official API and store the public information that comes with it:
- the author’s display name, username and profile photo;
- the post’s text, any images (for videos, the preview image), its link and when it was posted;
- its like, reply and repost counts at the time it was imported.
We only fetch posts a business asks for, and only information that is already public on X. Imported posts are shown with a link back to the original post and without a star rating. The business decides which posts to import and is responsible for showing them. If you wrote a post that was imported and want it removed, contact the business or email us and we’ll take it down.
What we collect from visitors
- Analytics. On wallsy.live and our blog we use Google Analytics 4 to understand which pages people visit and how they found us. Google Analytics sets its own cookies and collects details such as pages viewed, rough location, device and browser.
- Collection pages and widgets do not load Google Analytics. The widget script that businesses add to their websites does not set cookies.
- Server logs. Like most websites, our servers record basic request information (such as IP address, time and the page requested) for security, rate limiting and troubleshooting.
Cookies
We keep cookies to a minimum:
- Essential cookies keep you signed in and protect forms against cross-site request forgery. The site doesn’t work without them.
- Analytics cookies are set by Google Analytics on wallsy.live and the blog, as described above.
We don’t use advertising cookies and we don’t sell data to advertisers.
How we use data
- to run your account and the features you use — collecting, moderating and publishing testimonials;
- to send emails the service depends on: email verification, password resets and new-testimonial alerts;
- to take payments and apply the right plan, through Polar;
- to keep the service safe — detecting spam, limiting abuse and fixing problems;
- to understand how wallsy.live is used so we can improve it;
- to meet legal obligations, such as keeping billing records.
Where the law asks for a legal basis, we rely on providing the service you asked for (contract), our legitimate interest in keeping it secure and improving it, the reviewer’s consent to publish, and legal obligations.
Who we share data with
We share data only with the providers we need to run Wallsy:
- Google — sign-in and website analytics.
- Polar — subscription checkout, invoices and billing management.
- X (Twitter) — when a business imports a post, we send X the post’s ID to fetch it through X’s API. We don’t send X any other personal data.
- Hosting and email delivery providers — to store data and send the service emails listed above.
Published testimonials are, by design, visible to anyone who views the business’s Wall of Love or a website that embeds its widget. We may also disclose data if the law requires it. We don’t sell personal data.
How long we keep data
- Account data is kept while your account is open. Ask us to close your account and we’ll delete it.
- Testimonials are kept until the business deletes them or closes its account. A deleted testimonial disappears from the business’s walls and widgets straight away. If you want it permanently erased from our systems, email us.
- Imported posts from X are kept until the business deletes the testimonial or closes its account, or until the author asks us to remove them.
- Billing records are kept for as long as tax and accounting rules require.
Your choices and rights
Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you can ask to see the data we hold about you, correct it, delete it, receive a copy, or object to how it is used. You can also complain to your local data protection authority.
- Account holders can edit most details in Settings and email support@wallsy.live for anything else, including closing the account.
- Reviewers who want a testimonial changed or taken down should contact the business first — it controls what is published. If you can’t reach the business, email us and we’ll help.
We aim to reply to requests within 30 days, and may need to confirm who you are before acting on one.
Security
We use encrypted connections, keep each business’s data separate from other businesses, store reviewer IP addresses only as hashes, and limit who can access the systems. No online service can promise perfect security, so if you notice something wrong, please tell us at support@wallsy.live.
Children
Wallsy is a tool for businesses and isn’t aimed at children. Account holders must be at least 18. If you believe a child has sent us personal data, contact us and we’ll delete it.
International transfers
Our providers may process data in countries other than yours. Where that happens, we rely on the safeguards those providers offer for international transfers.
Changes to this policy
If we change this policy, we’ll update the date at the top of this page. For important changes, we’ll also let account holders know by email or in the app.
Contact
Questions or requests about privacy: support@wallsy.live. See also our Terms & Conditions.