--- title: "Privacy Policy — Testymo" description: "What Testymo actually stores, by role: account holders, people who answer forms, and visitors who see a widget. No ad tech, no data sales, no cross-site tracking." url: https://testymo.com/privacy --- The paperwork — 2 of 2 # Privacy Policy Updated 12 August 2026 Operated by Anton Bakinouski · Poland [Terms of Service →](https://testymo.com/terms) The short version We collect what a login-and-billing product needs, and nothing more. No data sales, no AI training, no advertising — not on this site, not in the app, and not in the widget embedded on anyone else's site. These marketing pages do measure their own audience (section 04); the app and the widget measure nothing. What we hold about you depends on which hat you're wearing; each has its own section below. Testymo is operated by Anton Bakinouski, based in Poland — the data controller for everything described here, except testimonial submissions, where the business whose form you answered decides and we act on their instructions (§02). One address for all of it: [support@testymo.com](mailto:support@testymo.com). ## 01 You have an account We store your name, your email address (we send one verification email so we know it's yours) and your password — hashed, so we couldn't read it if we wanted to. If you sign in with Google instead, Google tells us your name, email and profile picture, and that's all the access we get. Each active session records the IP address and browser it came from, so we can tell a hijacked session from a real one; that record goes when you sign out, and it never outlives your account. If you upgrade to a paid plan, Stripe handles the payment as merchant of record — your card number goes to Stripe and never touches our servers. All we keep is your subscription's plan, status and billing dates, plus a billing email if you set one for receipts. The only emails we send are the ones the product requires: verification, password reset, invitations, and a heads-up when your paid plan is ending or has ended. There is no marketing list. ## 02 You answered someone's form The business that sent you the form decides what it asks and where your answer appears; we store and display it on their behalf. What we keep: your answers exactly as you submitted them — words, name, rating — plus, if you added a photo, a small resized copy of it with its hidden metadata (like where it was taken) stripped out. We also keep which version of the form you saw, and — if the form asked — your choice from the permission step: usable publicly, or only privately. That choice is stored with your submission, shown to the business, and our [Terms of Service](https://testymo.com/terms) require them to honor it. Your submission record holds no IP address, and answering needs no account. Form pages carry no analytics tag of any kind, so nothing about your visit is joined to what you wrote. To have a testimonial taken out of use, ask the business first — they know you, and for them it's one click. To have it fully deleted, or if you can't reach them, email [support@testymo.com](mailto:support@testymo.com) and we'll take care of it. ## 03 You saw a Testymo widget on some website The widget is one static script with the testimonials already inside it. It draws them and stops: no cookies, no local storage, no fingerprinting, no analytics, nothing phoning home. Loading the script and its photos appears in ordinary server logs (IP address, URL, time) like any request on the web; we use those only to keep the service running and secure. ## 04 You're just browsing testymo.com Two things measure these marketing pages. Cloudflare Web Analytics counts page views without cookies: which page loaded, what linked to it, how fast it rendered, plus the country and browser your request already tells any server — nothing stored on your device, no profile, no following you elsewhere. Google Analytics does more: it sets its own cookies to tell a returning browser from a new one, records the pages and events of a visit, and reports them to Google, who processes that data for us. We use it to see which pages bring people in; we have not linked it to any advertising product, and we don't sell what it collects. An ad blocker will stop it, and nothing on this site needs it to work. The pages behind sign-in and the form pages carry no Google tag at all, and fonts are served from our own domain. The app's few cookies are all functional — the session that keeps you signed in, plus short-lived helpers for the sign-in flow — and none of them track you. ## 05 Who else touches your data The third parties involved in running Testymo, in full: - **Cloudflare** — network and content delivery, page-view counting on this site, transactional email, and file storage. - **Stripe** — payments, as merchant of record for paid plans. - **Google** — Analytics on the marketing pages (§04), and sign-in, only if you choose it. That's the whole list. No ad networks, no data brokers, and no measurement anywhere but the marketing pages described above. We have never sold personal data, and we won't. All three are American companies, so some data crosses the Atlantic — each transfer runs under the EU–US Data Privacy Framework or the EU's standard contractual clauses, the mechanisms GDPR accepts for exactly this. If a breach ever touches your data, you'll hear about it from us without spin or delay, and we'll notify the authorities where the law requires it. ## 06 How long we keep it As long as your account or organization exists. Deleting a form deletes its submissions and uploads; deleting an organization deletes everything in it, and its embeds stop rendering immediately. Copies can persist in backups for a short period afterwards before they age out. To delete your account entirely, email [support@testymo.com](mailto:support@testymo.com). ## 07 Your rights GDPR applies. You can ask for a copy of your data, have it corrected or deleted, object to or restrict its processing, and take it with you. Email [support@testymo.com](mailto:support@testymo.com) — from your account address, or with enough detail to find your submission — and you'll have an answer within a month. If you think we've handled your data badly, you can complain to your local data-protection authority, or to Poland's UODO. The legal bases, since GDPR asks for them: your account and billing run on contract, security logs on our legitimate interest in keeping the service safe, and the permission step on consent. ## 08 Changes to this policy The date at the top names the current version, and small clarifications happen without fanfare. If a change meaningfully affects what we collect or who touches it, you'll get an email or a clear notice in the app before it takes effect.