Privacy Policy
Last updated: 13 August 2026
Draft for review. Anything marked in yellow still needs a real value, and this document has not yet been checked by a lawyer. Replace this notice before launch.
1. Who this covers
This policy explains what Windex Infotech does with personal data when you use TrustGetter — the website at trustgetter.com, the application at app.trustgetter.com, and the review widget embedded on customers' websites. For that data, Windex Infotech is the data fiduciary (controller).
2. The short version
- We collect what we need to run your account and show your reviews. Nothing more.
- The embedded widget sets no cookies and does not track the people who visit your website.
- We do not run advertising or analytics trackers, and we do not sell or rent data to anyone.
- Card details never reach our servers — Razorpay handles payment.
3. What we collect
Account information
Your name, email address and a one-way cryptographic hash of your password. We never store the password itself and cannot recover it — a reset link is the only way back in.
Business and review data
When you connect a Google business listing, we store the listing's public details (name, address, rating, review count) and a copy of the reviews Google returns, including the reviewer's display name, profile photo URL, rating, text and date. That content is published by reviewers on Google and obtained through Google's APIs.
Billing information
If you buy a plan, we store your subscription's status, plan, period and payment history as reported by Razorpay, together with the identifiers Razorpay assigns. We do not receive your full card number, CVV or UPI credentials.
Technical logs
Our servers keep standard request logs — IP address, timestamp, the URL requested, browser user-agent — for security, abuse prevention and debugging. These are kept for [RETENTION PERIOD, e.g. 30 days].
Messages you send us
If you contact us on WhatsApp, that conversation sits in WhatsApp and is subject to WhatsApp's own privacy policy as well as this one.
4. What the widget does on your visitors' browsers
The embedded widget requests your review data from our server and draws it. It sets no cookies, writes nothing to local storage, and contains no analytics, advertising or fingerprinting code.
As with any request to any server, our logs record the IP address and the address of the page the widget was loaded from. We use that to serve the widget, to apply the domain restrictions you configure, and to tell you when a widget was first loaded on a live site. We do not build profiles of your visitors and we do not track them across sites.
5. Cookies
The application at app.trustgetter.com sets one cookie, tg_session,
which keeps you signed in. It is strictly necessary, HTTP-only, and
removed when you sign out. We use no analytics, advertising or
preference cookies anywhere on our sites, which is why you are not being
asked to accept any.
6. Why we process this data
| Purpose | Basis |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Fetching and displaying your reviews | Performance of our contract with you |
| Taking payment and issuing receipts | Contract, and legal obligation for tax records |
| Security, abuse prevention and debugging | Our legitimate interest in a service that stays up |
| Service emails (password resets, plan change notices) | Performance of our contract with you |
We do not send marketing email. If that ever changes, it will be something you opt into, not out of.
7. Who we share it with
We use a small number of processors, each for one job:
| Who | What for |
|---|---|
| Google LLC | Source of business listing and review data |
| Razorpay Software Private Limited | Payment processing and subscription billing |
| Oracle Cloud Infrastructure | Server hosting |
| Rediffmail Pro | Sending transactional email |
We may also disclose data where the law requires it, or to establish or defend a legal claim. We do not sell personal data.
8. Where data is held
Our servers are located in [SERVER REGION]. Some of our processors operate internationally, which can mean data is processed outside India under appropriate safeguards.
9. How long we keep it
- Account data — while your account is open, and for a short period afterwards in case you return.
- Reviews cache — while at least one account is connected to that business. Once nobody is, the cached copy is dropped.
- Billing records — for as long as tax and accounting law requires, currently eight years.
- Server logs — [RETENTION PERIOD].
10. How we protect it
- Everything travels over HTTPS; the application is not reachable over plain HTTP.
- Passwords are hashed with bcrypt and are never stored or logged in readable form.
- Sessions live server-side and can be revoked; a password reset revokes every existing session.
- Access to production systems is limited to people who need it.
No system is perfectly secure, but if a breach affects your data we will tell you and the relevant authority as the law requires.
11. Your rights
Under India's Digital Personal Data Protection Act, 2023 — and under the GDPR if you are in the EU or UK — you can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. You can also withdraw consent where consent is what we relied on, and nominate someone to exercise these rights on your behalf.
Message us on WhatsApp from the number or email associated with your account and we will act on it, normally within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Grievance officer
[NAME], Windex Infotech — [EMAIL], WhatsApp +91 98240 62057.
12. Reviewers' data
Reviews contain personal data belonging to the people who wrote them. We process it to display it, as the reviewer published it on Google, and we neither edit nor enrich it. If you are a reviewer and want your review removed from a website, the effective route is to remove or amend it on Google — it will then disappear from any TrustGetter widget at the next refresh. You can also contact us and we will act on it directly.
13. Children
TrustGetter is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.
14. Changes
We will post any update here with a new date at the top, and tell you by email if the change is significant.
15. Contact
Windex Infotech — WhatsApp +91 98240 62057. Registered address: 514, Saffron Building, Abbas Tyabji Rd, Jayesh Colony, Fatehgunj, Vadodara, Gujarat 390008, India.