Privacy Policy
Last updated: 13 August 2026
1. Who this covers
This policy explains what Windex Infotech does with personal data when you use TrustGetter — the website at trustgetter.com, the application at app.trustgetter.com, and the review widget embedded on customers' websites. For that data, Windex Infotech is the data fiduciary (controller).
2. The short version
- We collect what we need to run your account and show your reviews. Nothing more.
- The embedded widget sets no cookies and does not track the people who visit your website.
- We use Google Analytics on our public website to see which pages people find useful. It sets cookies. It is not on the embedded widget, and we do not sell or rent data to anyone.
- Card details never reach our servers — Razorpay handles payment.
3. What we collect
Account information
Your name, email address and a one-way cryptographic hash of your password. We never store the password itself and cannot recover it — a reset link is the only way back in.
Business and review data
When you connect a Google business listing, we store the listing's public details (name, address, rating, review count) and a copy of the reviews Google returns, including the reviewer's display name, profile photo URL, rating, text and date. That content is published by reviewers on Google and obtained through Google's APIs.
Google sign-in and Google Business Profile access
If you sign in with Google, we receive your name, email address and Google account identifier, and use them only to create and secure your TrustGetter account.
If you choose Show all your reviews, you authorise us on
Google’s own consent screen to access the Google Business Profile
you manage (the business.manage permission). We store an
access token for it, encrypted at rest, and use it for one purpose:
reading the reviews of your own listing so your widget
can display them. We do not post, reply to, edit or delete reviews, and
we do not change anything on your Business Profile.
TrustGetter’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI or machine-learning models, and do not let people read it except where you ask us to for support, where security requires it, or where the law does.
You can disconnect at any time from your TrustGetter dashboard, or by removing TrustGetter at myaccount.google.com/permissions. Disconnecting asks Google to revoke our access and marks the stored token revoked, so it is never used again. Deleting your TrustGetter account deletes it entirely — see section 11.
Instagram account and post data
When you connect an Instagram account, you authorise us on Instagram’s own sign-in screen — we never see or store your Instagram password. From that point we store an access token for the account, encrypted at rest, together with the account’s username, profile picture, follower and post counts, and a copy of your recent posts: the image or video, the caption, the date, the media type and the link back to the original post.
We use that data for one purpose: rendering the Instagram feed widget you configured on the website you installed it on. We do not use it to build a profile of you, and we do not sell or share it for advertising.
The access we request is read-only. We cannot post, comment, like, follow, send messages or change anything on your account, and we cannot read your direct messages, your followers’ details, or any account you have not connected.
You can disconnect at any time from your TrustGetter dashboard, or by removing our access in your Instagram settings. Disconnecting deletes the stored token and the cached posts for that account. Deleting your TrustGetter account removes them as well — see section 11.
Billing information
If you buy a plan, we store your subscription's status, plan, period and payment history as reported by Razorpay, together with the identifiers Razorpay assigns. We do not receive your full card number, CVV or UPI credentials.
Technical logs
Our servers keep standard request logs — IP address, timestamp, the URL requested, browser user-agent — for security, abuse prevention and debugging. These are kept for 30 days.
Messages you send us
If you email us at hi@trustgetter.com, that message and our reply sit in our mailbox with our email provider.
The contact form on our website does not send anything itself — it composes a message and hands it to WhatsApp on your device, and you choose whether to send it. Any conversation that follows sits in WhatsApp and is subject to WhatsApp's own privacy policy as well as this one.
4. What the widget does on your visitors' browsers
The embedded widget requests your review or post data from our server and draws it. It sets no cookies, writes nothing to local storage, and contains no analytics, advertising or fingerprinting code.
One exception, and it is worth stating plainly: the Instagram feed widget loads your photographs and videos directly from Instagram’s own content servers. Instagram serves media from signed addresses that expire, so those addresses cannot be stored and re-served by us. That means a visitor’s browser makes a request to Meta’s servers to fetch each picture, and Meta will see that request — including the visitor’s IP address — in the same way any embedded image from another domain is fetched. We do not send Meta anything about your visitors ourselves, and no cookie of ours is involved, but the request is theirs to log.
The Google reviews widget has no equivalent: reviewer profile pictures are the only external media it can load, and everything else it draws comes from us.
As with any request to any server, our logs record the IP address and the address of the page the widget was loaded from. We use that to serve the widget, to apply the domain restrictions you configure, and to tell you when a widget was first loaded on a live site. We do not build profiles of your visitors and we do not track them across sites.
5. Cookies
The application at app.trustgetter.com sets one cookie,
tg_session, which keeps you signed in. It is strictly
necessary, HTTP-only, and removed when you sign out.
Analytics on our public website
Our public website at trustgetter.com uses Google Tag
Manager to load Google Analytics. Tag Manager
is a loader — it sets no cookies of its own — but Google Analytics does,
typically _ga and _ga_*, which last up to two
years. They record which pages are visited, roughly where in the world
the visitor is, and which site or search sent them, so we can tell which
pages are worth keeping. We use this to understand our own website. We
do not use it to build advertising profiles and we do not sell what it
collects.
None of this runs on the review widget. The widget you embed on your own site loads no analytics, sets no cookies, and does not track your visitors — see section 4. Analytics are on our marketing pages only, and the signed-in application at app.trustgetter.com sets nothing beyond the session cookie above.
You can opt out with Google's browser add-on, or by blocking cookies for this site in your browser. Nothing about the website stops working if you do.
6. Why we process this data
| Purpose | Basis |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Fetching and displaying your reviews | Performance of our contract with you |
| Taking payment and issuing receipts | Contract, and legal obligation for tax records |
| Security, abuse prevention and debugging | Our legitimate interest in a service that stays up |
| Service emails (password resets, plan change notices) | Performance of our contract with you |
We do not send marketing email. If that ever changes, it will be something you opt into, not out of.
7. Who we share it with
We use a small number of processors, each for one job:
| Who | What for |
|---|---|
| Google LLC | Source of business listing and review data; website analytics (Google Analytics via Tag Manager, on trustgetter.com only) |
| Meta Platforms, Inc. | Source of Instagram account and post data, where you have connected an Instagram account |
| Razorpay Software Private Limited | Payment processing and subscription billing |
| Our hosting provider | Server hosting |
| Our email provider | Sending transactional email |
Google, Meta and Razorpay are named because you deal with them directly — your reviews come from one, your posts from another, your payment goes to the third, and each has its own policy that applies to you. We will identify our hosting and email providers on request; write to us at the address in section 11.
We may also disclose data where the law requires it, or to establish or defend a legal claim. We do not sell personal data.
8. Where data is held
Our servers are located in India. Some of our processors operate internationally, which can mean data is processed outside India under appropriate safeguards.
9. How long we keep it
- Account data — while your account is open, and for a short period afterwards in case you return.
- Reviews cache — while at least one account is connected to that business. Once nobody is, the cached copy is dropped.
- Instagram posts and access token — while the account stays connected. Disconnecting it, or deleting your TrustGetter account, removes both.
- Billing records — for as long as tax and accounting law requires, currently eight years.
- Server logs — 30 days.
10. How we protect it
- Everything travels over HTTPS; the application is not reachable over plain HTTP.
- Passwords are hashed with bcrypt and are never stored or logged in readable form.
- Sessions live server-side and can be revoked; a password reset revokes every existing session.
- Access to production systems is limited to people who need it.
No system is perfectly secure, but if a breach affects your data we will tell you and the relevant authority as the law requires.
11. Your rights
Under India's Digital Personal Data Protection Act, 2023 — and under the GDPR if you are in the EU or UK — you can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. You can also withdraw consent where consent is what we relied on, and nominate someone to exercise these rights on your behalf.
Email us at hi@trustgetter.com from the address on your account and we will act on it, normally within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Grievance officer
The Windex Infotech team — hi@trustgetter.com.
12. Reviewers' data
Reviews contain personal data belonging to the people who wrote them. We process it to display it, as the reviewer published it on Google, and we neither edit nor enrich it. If you are a reviewer and want your review removed from a website, the effective route is to remove or amend it on Google — it will then disappear from any TrustGetter widget at the next refresh. You can also contact us and we will act on it directly.
13. Children
TrustGetter is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.
14. Changes
We will post any update here with a new date at the top, and tell you by email if the change is significant.
15. Contact
Windex Infotech — hi@trustgetter.com. Registered address: 514, Saffron Building, Abbas Tyabji Rd, Jayesh Colony, Fatehgunj, Vadodara, Gujarat 390008, India.