Privacy policy

This page explains what personal information HappySaid collects, why, and what you can do about it. We have written it in plain language. Where a detail is still to be confirmed, it appears in [square brackets].

Who we are

HappySaid is a service for collecting and showing customer testimonials. [Legal entity name and address to be added.] You can reach us at support@happysaid.com, or at privacy@happysaid.com for anything about personal data. For the testimonials that account holders collect, we are the processor and the account holder is the controller.

What we collect

• Account details. Your email address and, if you sign in with Google, your name and the Google account identifier. We have no passwords.
• Space content. The names, settings, logos, testimonials, tags, widgets and proof page settings you create.
• Testimonial givers' details. When someone sends a testimonial through a collection page, we store what they typed: the text, a rating if they gave one, their name, and optionally their title, company, website, handle, photo and email. We also store the consent they gave and when.
• Hashed IP addresses. To limit spam and repeat submissions, we keep a one-way hash of the visitor's IP address. We don't keep the IP address itself.
• Aggregated widget counts. We count widget views, badge clicks and collection page visits. These are totals per widget and per day. They are not tied to an individual visitor.
• Billing information. Our payment partner, Polar, handles your card details. We receive your plan and the status of your subscription, not your card number.

Why we use it

• To provide the service: to run your account, show your testimonials where you choose and send you the emails you ask for.
• To keep the service safe: to prevent spam, abuse and fraud.
• To improve the service: using the aggregated counts above and anonymous site statistics.
• To meet legal duties and to handle requests, such as a request to remove a testimonial.

We don't sell personal information, and we don't use testimonials or the details in them for advertising.

Cookies

happysaid.com and every widget, collection page and proof page set no cookies. The dashboard uses one essential sign-in cookie. It is called happysaid_session. The removal pages set no cookies and use no local storage. Our staff tools use one more essential cookie, happysaid_viewas, which only staff ever receive. Essential cookies need no consent banner.

Analytics

We use Plausible Analytics on our marketing pages. It uses no cookies and collects no personal data. The widgets you embed on your site send simple counts to us, as described above.

Retention

We keep each kind of data only as long as we need it.

• Your account and everything in it: until you delete it. After you ask, we wait 7 days (so you can change your mind) and then delete it for good.
• Sign-in links and email-change links: 7 days.
• Removal requests: the requester's email, name and message are removed 30 days after the request is closed. We keep a hashed email, the outcome and the consent record for 3 years, as proof of how consent was given and withdrawn.
• Unconfirmed removal requests: 7 days. If the person never opens the confirmation link, the request is deleted.
• Logged privacy requests: 3 years after we close them, as a record that we answered on time.
• Deletion records: about 13 months. They hold only internal ids (no names, emails or text) so a restored backup can be cleaned.
• Data exports: the file is deleted 7 days after it is ready, and the record 90 days after you ask.
• Hashed IP addresses on testimonials: 12 months.
• Abuse reports: the reporter's email is removed 90 days after the report is resolved, and the report after 1 year.
• Staff audit records: 2 years.
• Widget counts: 90 days.
• Backups: daily backups are kept for 30 days and monthly backups for 12 months. If we restore a backup, we delete again the deleted accounts and testimonials deleted at a giver's request.
• Invoices: as long as the law requires Polar to keep them.
• Logs and error reports: about 30 days, without emails, names or testimonial text.

Your rights

You can ask us to access, correct, delete, export or restrict your data, and to stop using it. You can also object, withdraw consent and complain to your data protection authority.

• Export: in your account, open Privacy and data and choose Request export. You get one ZIP with everything.
• Delete your account: open Account settings and choose Delete account.
• Remove a testimonial you gave: use the private link from your thank-you page or receipt email, or go to happysaid.com/remove. See Remove a testimonial you gave.
• Anything else: write to privacy@happysaid.com. We answer within 30 days (45 days for California requests). If your request is about a testimonial, we pass it to the Space owner, who decides what to do with it, and we tell you we did.

California residents have the right to know, delete and opt out of the sale or sharing of personal information. We do not sell or share personal information.

Sub-processors

The companies that help us run HappySaid are on the sub-processor list. If you are a customer, our data processing agreement covers them.

Contact

For any question about your information, or to use your rights, write to privacy@happysaid.com.