Privacy Policy

Here we explain in plain words which personal data Widget Fox processes, why, and on what legal basis. This policy applies to the website widget-fox.com, the dashboard and the delivery of the widgets. Further down you will find separate sections for visitors to websites with a Widget Fox widget and for people whose Google reviews or Instagram posts a widget shows. In this policy, GDPR means the General Data Protection Regulation (German: DSGVO).

Who is responsible

Steven Braun
Widget Fox
Voltastraße 1
30165 Hannover
Deutschland
Email: info@widget-fox.com

We have not appointed a data protection officer because we are not legally required to. If you have any questions about data protection, simply write to us at the email address above.

These are the services Widget Fox uses

• Cloudflare (Cloudflare, Inc., USA): operation of the website and the dashboard. Transfer to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses.
• Cloudflare Email Service (Cloudflare, Inc., USA): sending our emails, for example the login link, the notices about your views and the emails with a discount code. The basis for the transfer is the same as for Cloudflare.
• Supabase (Supabase Inc., USA): database and login for your account. The database is located in Frankfurt am Main. Under its data processing agreement, Supabase may also process at other locations; the basis for this is standard contractual clauses.
• Bunny.net (BunnyWay d.o.o., Slovenia): CDN and storage in the EU. The widget files with reviews, images and fonts are delivered to visitors through it. We also store a backup of our database there every day, in a separate, non-public storage in Germany.
• Apify (Apify Technologies s.r.o., Czech Republic): retrieval of the public Google reviews and Instagram posts that a widget shows. According to Apify’s data processing agreement, processing may also take place in the USA or other countries in which Apify or its subprocessors operate; the basis for this is standard contractual clauses.
• Google Places API (Google LLC, USA): profile search by name and place, in the dashboard and in the live builder. The request comes from our server, not from your browser. Transfer to the USA on the basis of the EU-US Data Privacy Framework.
• Stripe and Link (Stripe companies and Sold through Link, LLC, USA): payment and subscription management for the Pro plan, and the discount codes for Pro. Stripe and Link process the data in the payment process as controllers in their own right, under their own privacy notices.
• Google tag (Google): measurement on widget-fox.com and in the dashboard, only after your consent in the cookie banner. Described in the section “Measuring with the Google tag”.
• Google Ads Data Manager (Google LLC or Google Ireland): reporting of the click ID of an ad when a widget is embedded for the first time and when you pay for Pro for the first time, directly from our server and without a Google script on the website. Transfer to the USA on the basis of the EU-US Data Privacy Framework.

Cloudflare, Supabase, Bunny.net and Apify work for us as processors: they process the data only on our instructions. We concluded the data processing agreement with Bunny.net on 24.10.2026.

Visiting the website and the dashboard

When you open widget-fox.com or the dashboard, Cloudflare processes technically necessary data: your IP address, date and time, the address requested, your browser (user agent) and the page you came from. Without this data the page cannot be delivered. It also helps us find errors and fend off attacks.

The legal basis is our legitimate interest in a secure and functioning website (Art. 6 para. 1 lit. f GDPR). We keep the logs for 7 days at most.

Without your consent, no Google tag runs on our website. If you choose “Accept all” in the cookie banner, it runs (see “Measuring with the Google tag” below). No other analytics or advertising scripts run.

Cookies and storage in the browser

We set cookies when you log in to the dashboard: session cookies that keep you logged in. They are strictly necessary for us to provide the dashboard to you, and therefore need no consent (§ 25 para. 2 no. 2 TDDDG). In the live builder, we remember the ID of your draft in your browser’s storage (localStorage) and in the cookie wf_entwurf, so that you can carry on after reloading. It contains no personal data; you delete both with your browser data.

If you click the link to book in an email with a discount code, we remember the code for 7 days in the cookie wf_rabatt, so that it is already entered in the form for Pro after you log in. The cookie applies only to the dashboard and contains only the code.

When you make a choice in the cookie banner, we remember it for 180 days in the cookie wf_cookie_wahl (value “alle” or “notwendig”, that is, all or necessary only). It is technically necessary so that the banner does not ask again on every visit, and therefore needs no consent (§ 25 para. 2 no. 2 TDDDG). After that the banner asks again. If you choose “Accept all”, the Google tag sets cookies on our domain whose names begin with _ga, _gid, _gat or _gcl_. If you later switch to “Necessary only”, we delete them. We use no other cookies or storage in the browser.

Account and login

For your account we store your email address, your plan, the time of sign-up and the link to your subscription at Stripe. You log in with a link that we send you by email; there is no password. The login runs through Supabase, and we send the email with the link through Cloudflare Email Service.

The legal basis is the contract with you (Art. 6 para. 1 lit. b GDPR). Without an email address we cannot create an account for you. We store the data until you delete your account. You can do this yourself in the dashboard at any time.

Widgets, profiles and Instagram accounts

When you create a widget, we store its settings and which Google profile or Instagram account it is meant to show. We retrieve the reviews or posts regularly through Apify and store them with us (sync). We copy images to our storage at Bunny.net so that visitors load nothing from Google or Instagram.

We also count how often your widgets are loaded so that we can check the limits of your plan, on the Pro plan the fair-use limit. For this we store only the number of views per widget and day, no IP addresses. On the Free plan you get an email at 80 % and 100 % of your views in a month.

The legal basis is the contract with you (Art. 6 para. 1 lit. b GDPR). For the data of reviewers and of the Instagram posts we are your processor; for this there is our Data Processing Agreement.

Profile search through Google

If you search for a profile by name and place in the dashboard or in the live builder, our server sends your input to the Google Places API of Google LLC and receives up to five matching businesses in return: ID, name, address, average rating and number of reviews. The request comes from our server, your IP address and your browser do not go to Google in the process. If you search instead with a link to a Google Maps profile, the search does not go through Google Places but through Apify.

In the live builder we remember your input and the results for 24 hours so that the same search does not cause costs again. We do not store data about you for this, such as your IP address. For the limits on searching, see “Protection against misuse” below.

The legal basis in the dashboard is the contract with you (Art. 6 para. 1 lit. b GDPR); in the live builder without an account it is the initiation of a contract at your request (Art. 6 para. 1 lit. b GDPR). Google LLC is certified under the EU-US Data Privacy Framework.

Payment

You pay for Pro through Stripe Managed Payments. Link processes the payment (Sold through Link, LLC, a company of the Stripe group). Link calculates and reports the sales tax and sends you receipts and invoices. We remain your contractual partner for Widget Fox.

Before you book Pro, you confirm that you are booking as an entrepreneur and state your company name. We store the company name and the time of this confirmation on your account; a new confirmation replaces the old one. When you book Pro, we create you as a customer at Stripe and transfer for this your email address, the ID of your account with us and your company name as the customer name. You enter your payment details directly at Stripe or Link; we do not see them. From Stripe we receive the details of your subscription and your payments, for example whether a payment was successful, as well as the order data that Link shares with us.

For the payment process itself, Stripe and Link are controllers in their own right. Our legal basis is the contract with you (Art. 6 para. 1 lit. b GDPR) and our legal retention obligations (Art. 6 para. 1 lit. c GDPR). We keep accounting vouchers for 8 years, books and records for 10 years and business letters for 6 years (§ 147 AO).

Emails to you

The contract includes the login link, the notices about your views and messages about your account. The legal basis for this is the contract with you (Art. 6 para. 1 lit. b GDPR). There is no newsletter. We send you advertising by email only as described in the next section.

When you write to us, we use your message and your email address to reply to you. We keep messages relating to the contract as business letters for 6 years (§ 147 AO).

Advertising by email: discount code and reminders

If you reach all the views of a month on the Free plan, we send you an email the next morning at 9 a.m. with a personal discount code for Pro. The code is valid for 7 days. As long as it is valid, we remind you of it up to four times: on the third and the fifth day after the first email, and on the sixth day in the morning and in the evening. These emails advertise Pro.

For this we use your email address, for the salutation your first name if we know it, otherwise the name of your first profile, and the number of your views. We create the code at Stripe. The code there carries the ID of your account with us, not your email address. You only get a code if you have never paid at Stripe before.

The legal basis is our legitimate interest in sending you, as our customer, an offer for Pro (Art. 6 para. 1 lit. f GDPR in conjunction with § 7 para. 3 UWG).

You can object to this advertising at any time (Art. 21 para. 2 GDPR), without incurring any costs other than the transmission costs at the basic rates.

For this, it is enough to click “Unsubscribe from discount codes and reminders” at the bottom of each of these emails and then the button on the page that opens. You can also write a short email to info@widget-fox.com. After that you will receive no discount code and no reminder any more, not in later months either.

We note your unsubscription at Stripe on your discount code so that we can comply with it. You keep receiving the notices at 80 % and 100 % of your views, then without a discount code, because they are part of the contract.

Waitlist

For announced widget types, currently the Instagram feed, you can put yourself on a waitlist on our website. For this we store your email address, the widget type and the time. We use your email address only to let you know when the widget type is available.

The legal basis is your request, that is, the initiation of a contract (Art. 6 para. 1 lit. b GDPR).

After signing up you get a link to leave the waitlist. If you open it and click “Leave waitlist”, we delete your entry immediately. Otherwise we store it until the widget type is available and we have let you know.

Contact form

You can send us a message through the contact form. For this we process your email address, your message and your name if you give it. We use this information only to answer your request. We need the email address and the message for this; you can leave out the name. The message goes to our mailbox as an email through Cloudflare Email Service; we do not store it in our database.

The legal basis is the contract with you or its initiation if your request is related to it (Art. 6 para. 1 lit. b GDPR), otherwise our legitimate interest in answering requests (Art. 6 para. 1 lit. f GDPR).

We delete your message as soon as your request is dealt with and we do not have to keep it. We keep messages relating to the contract as business letters for 6 years (§ 147 AO). We need the check values against misuse for this for one hour. How we protect the form against misuse is described in the next section.

Protection against misuse: check values instead of IP addresses

So that nobody misuses our forms and the profile search in bulk, we limit how often they can be used from one connection. For this we never store your IP address itself, only a check value calculated from it. For IPv6 addresses we calculate with the network of your connection (the first 64 bits), not with the full address.

• Requesting a login link: check value (SHA-256) of the IP address, for 15 minutes.
• Contact form: one check value (SHA-256) each from your IP address and from your email address, for one hour.
• Waitlist: check value (SHA-256) of the IP address, for 24 hours at most.
• Live builder: check value (HMAC-SHA-256 with a secret key) of the IP address for every search and every draft, for 24 hours.
• Profile search in the dashboard: check value (HMAC-SHA-256 with a secret key) of the IP address for every search, for 24 hours. Search texts and your account are not in the record.

We delete expired check values as soon as the next operation of the same kind comes. If none comes for a long time, they can stay longer than stated above; for the limit they then no longer count.

The legal basis is our legitimate interest in fending off misuse and limiting the costs of the services (Art. 6 para. 1 lit. f GDPR).

Measuring with the Google tag (cookie banner)

On widget-fox.com and in the dashboard, a cookie banner asks you whether we may load the Google tag. The purpose is to measure which pages and ads lead to customers, so that we can use our advertising budget sensibly. The provider is Google.

If you choose “Accept all”, we load the tag from Google. In doing so, your IP address and details about your browser technically go to Google, and the tag sets cookies (see “Cookies and storage in the browser”). It reports to Google: every page view, clicks on buttons to start with Free and on “Choose Pro”, that you created an account for the first time, that you copied the embed code and that you came back from Stripe after a purchase. If you choose “Necessary only” or have not chosen yet, the tag does not load and there are no Google cookies.

The legal basis is your consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR). The recipient is Google. In this process, data can reach the USA and other countries outside the EU. Your cookie with the choice is valid for 180 days; how long Google stores its cookies and data is determined by Google.

You can withdraw your consent at any time: the link “Cookie settings” at the bottom of every page opens the banner again. With “Necessary only”, we delete the Google cookies on our domain and reload the page without the tag. The withdrawal does not affect the lawfulness of the processing until then (Art. 7 para. 3 GDPR).

Separate from this is the reporting of the click ID by our server, which the next section describes. It runs through our server, not through the Google tag.

Measuring our Google ads (click ID)

We advertise with ads on Google. If you come to us through such an ad, Google attaches an identifier to the link, the click ID (depending on the device under the name gclid, gbraid or wbraid). We read it from the address and pass it on through links and form fields until sign-up. We never store it in a cookie, in localStorage or in any other storage in your browser. At sign-up we store the click ID on your account.

When one of your widgets runs for the first time on a website that does not belong to us (embedding), our server reports the click ID to Google (Google Ads Data Manager) together with the time and a random ID of the embedding. This happens once per account and only if your sign-up was no more than 90 days before that time. We recognise the embedding by the website from which the widget is loaded. For this we remember on which website (only the domain name, for example beispiel.de) and when your widget first ran.

When you pay for Pro for the first time, our server reports the click ID to Google (Google Ads Data Manager) together with the amount, currency, time and an ID of the payment. This happens only if your sign-up was no more than 90 days ago. We send neither name, email address nor the website with either of the two reports. This way we see which ads lead to customers who really embed a widget or pay, and can use our advertising budget sensibly.

The legal basis is our legitimate interest in measuring the success of our advertising (Art. 6 para. 1 lit. f GDPR). We do not ask for consent for this. We store the click ID, the first embedding and the notes on whether we have reported the embedding and the first payment until you delete your account. Google LLC is certified under the EU-US Data Privacy Framework.

Your right to object to the reporting of the click ID

If you came to us through a Google ad, we report the identifier from the ad’s link (click ID) to Google as soon as one of your widgets runs for the first time on a website that does not belong to us (embedding), and as soon as you pay for Pro for the first time (see “Measuring our Google ads” above). For the embedding, the click ID, the time and a random ID go to Google; for the payment, also the amount and currency.

You can object to the reporting of your click ID to Google at any time (Art. 21 GDPR).

For this, a short email to info@widget-fox.com is enough. We will then delete the click ID on your account and report nothing to Google.

When you visit a website with a Widget Fox widget

Our customers add widgets to their own websites. The respective operator of the website is responsible for the embedding and for the data processing on their website. We deliver the widget on their behalf.

Your browser loads the widget as a finished file with all images and fonts from our CDN at Bunny.net in the EU. In doing so it loads nothing from Google or Instagram. When the file is retrieved, Bunny.net technically processes your IP address, date and time, the file retrieved, your browser and the page from which your browser loads the file (usually only its domain name), and keeps server logs of this. Once a day we read out of these logs only which widget file was retrieved and from which website (only the domain name, for example beispiel.de). We store the number of views per widget and day and, when a widget runs for the first time on a customer’s website, its domain name. We do not store your IP address or the address of the individual page you visit.

The widget sets no cookies and uses neither localStorage nor any other storage in your browser.

You can learn more in the privacy policy of the website you are visiting. You can also direct questions to us.

Information for authors of Google reviews and Instagram posts

This section is addressed to you if a Widget Fox widget shows a Google review or an Instagram post by you. We did not collect the data from you yourself, so we inform you here (Art. 14 GDPR).

Which data, from where

• For Google reviews: your name as displayed at Google, your profile photo, stars, text and date of the review, photos in the review and a reply from the owner.
• For Instagram posts: image or preview image, caption, date and link of the post. People can also be seen in an image.
• The source is the publicly accessible pages of Google Maps or Instagram. We retrieve them through Apify.

Why and on what basis

The widget shows the reviews of a business, or the posts of an Instagram account, on the website of exactly this business. The customer who adds the widget to their website is responsible for the display; we process the data on their behalf. The legal basis is the customer’s legitimate interest in showing public reviews and posts about their business on their own website (Art. 6 para. 1 lit. f GDPR). You wrote your review publicly and under your name about this business.

So that visitors do not have to load anything from Google, we copy your profile photo and other images to our storage at Bunny.net in the EU and deliver them from there.

Recipients and storage period

Recipients are Apify (retrieval), Supabase (database), Bunny.net (storage, delivery and daily backup of the database) and the visitors to the website on which the widget appears. We store the data as long as a widget uses the profile or the Instagram account. If a review or post is missing at the source, we remove it from the widget at the next sync. It then stays in our backups for up to 30 more days.

Objection and deletion

You can object to the display of your review, your name or your profile photo at any time and demand deletion. To do so, send an email to info@widget-fox.com and tell us the review or the post, ideally with a link. We look into your request, consult the customer if necessary, and then remove the review, your name or your photo from the widgets. If you delete your review at Google, it also disappears from the widget at the next sync.

Storage periods at a glance

• Logs when visiting the website and the dashboard: 7 days at most.
• Account, widgets and settings, company name and confirmation as an entrepreneur: until you delete your account.
• Click ID, first embedding (domain name of the website and time) and the notes on the reports to Google: until you delete your account.
• Number of views per widget and day: until you delete the widget or your account.
• Reviews and Instagram posts: as long as a widget uses the profile or the account.
• Inputs and results of the profile search in the live builder: 24 hours.
• Discount code and note of your unsubscription: at Stripe, also after the code has expired.
• Waitlist: until you leave it or we have let you know.
• Messages from the contact form: until your request is dealt with, 6 years if related to the contract (§ 147 AO).
• Check values against misuse: 15 minutes to 24 hours depending on the form; they are deleted with the next operation of the same kind.
• Daily backups of the database: 30 days.
• Accounting vouchers 8 years, books and records 10 years, business letters 6 years (§ 147 AO).

If you delete your account, we cancel a running subscription at Stripe, remove your widget files from the CDN and delete your account together with the widgets and the data belonging to them. This data then stays in the daily backups for up to 30 more days until the backup is deleted automatically; we use it only to restore the database after an outage. What we have to keep for legal reasons we block and use only for that purpose.

Transfers to countries outside the EU

Some of our service providers are based in the USA or can process there: Cloudflare, Supabase, Apify, Stripe and Link, as well as Google with the Places API and the Ads Data Manager. We transfer data to the USA only on the basis of the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or of the standard contractual clauses of the EU Commission. Which basis applies to which service is stated in the list above. You can get a copy of the standard contractual clauses on request by email.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). If we process data on the basis of a legitimate interest, you can object on grounds relating to your particular situation (Art. 21 GDPR). You can object to advertising by email and to the reporting of your click ID without giving reasons, as described in the sections above. Write us an email for this.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover

Obligation to provide data and automated decisions

For an account we need your email address, otherwise we cannot conclude the contract. For Pro we additionally need your company name and your confirmation that you are booking as an entrepreneur. Beyond that, you are not obliged to give us data. Automated individual decision-making including profiling (Art. 22 GDPR) does not take place.

Changes

If our services or the legal situation change, we adapt this policy. The version that stands here applies.

Version as of: 30 October 2026