Legal

Privacy policy

Last updated: 12 November 2026. Plain English first; the details follow.

Draft — to be reviewed by a lawyer before launch.

Who we are

Testihub (“we”) provides a service that asks a business’s customers for testimonials and displays approved ones. [Legal entity name, address and contact email.]

Two kinds of people

Owners sign up and use the dashboard. Customers are the people our owners ask for a testimonial. For customer data, the owner is the controller and we process it on their behalf.

What we collect

  • Owners: email address, password (hashed by our auth provider) or Google sign-in, business name, logo, and settings.
  • Customers: email address and name (from the owner’s connected payment provider (Stripe, Razorpay, Lemon Squeezy, Dodo Payments or Paddle), CSV upload, API or manual entry), payment count, and whether a payment was refunded or disputed.
  • Testimonials: the name, optional role, optional photo, rating and words a customer submits, and when they confirmed them.
  • Technical: a hashed (not stored) IP address for rate limiting the public form, and standard server logs.
  • Website visits: anonymous page-view counts through Vercel Web Analytics, which uses no cookies and doesn’t identify you.

What we don’t collect

We never receive card numbers or bank details. Payment providers send us only events about successful payments, refunds and disputes. For Paddle, which leaves the customer’s email out of these events, we use a read-only key the owner gives us to look up that customer’s email and name.

How we use it

  • To send a testimonial request and at most one reminder, and never more than once in 90 days.
  • To show approved testimonials on the owner’s website and Wall of Love page.
  • To run, secure and bill for the service.

Your choices

Every email has an unsubscribe link that works immediately. Customers can ask the business to remove a testimonial at any time. Owners can export or delete all their data from Settings.

Service providers

Convex (database, file storage and authentication), Vercel (hosting), Resend (email delivery), Dodo Payments (billing, as merchant of record). Each one processes data only to run its part of the service.

Retention

We keep data while the account is active. Deleting a business removes its testimonials, customers and requests. [Add backup retention period.]

Contact

Questions about your data: hello@testihub.com.