Privacy Policy

Last updated: August 6, 2026

This policy explains what personal data Vanssay collects, why, on what legal basis, and your rights. It applies to our website (vanssay.net) and our Framer plugins: Google & Trustpilot Reviews, Instagram Feed, Bouncer, Router and Maintenance Mode.

1. Data we collect

• Account data: your email address and a securely hashed password (we never store your password in plain text). Optionally the plugin you signed up from.
• Plugin configuration: your settings per plugin, for Reviews, the profiles/pages you connect plus widget settings; for Bouncer, your blocking rules and screen styling; for Router, your redirect/suggestion rules (countries, regions, languages, devices, VPN options, destinations, UTM settings); for Maintenance Mode, your whitelist, page content and schedule; for Instagram Feed, the public Instagram handle you connect plus your layout, display settings and, in Curated mode, which posts you selected.
• Third-party content you connect: publicly available reviews fetched from Google Places and Trustpilot, and publicly available Instagram profile information and posts fetched via Apify. All of it is cached temporarily on our servers so your widgets load quickly (typically 24 hours for the posts a widget displays, up to 7 days for the larger set the Curated picker offers).
• Usage data: anonymous, aggregated counts per account (e.g. widget views, blocked or redirected visits) used for plan limits and analytics. In the plugin interface we also record which step you reached (opened, previewed, reached the paywall, subscribed) against a random identifier generated in your browser and stored alongside your session, so we can see where people get stuck. It is not linked to any advertising network, contains no IP address or device fingerprint, and clearing the plugin's site data removes it. We do not build profiles of you or your visitors.
• Billing data: payments are processed by Stripe; we receive your plan, status and country/tax info but never see or store your card details.
• Support data: emails you send us and their content.

2. Legal bases (GDPR Art. 6)

3. Your site visitors: Bouncer & Router

When you enable Bouncer or Router, each visit triggers a real-time, server-side check from the visitor's IP address, before your page is shown, to determine:

• the visitor's approximate country (and, on higher tiers, region/city), using a local geolocation database with ip-api.com as a fallback lookup; and
• whether the connection appears to be a VPN, proxy or datacenter IP.

We use the IP address only to make the allow/block (Bouncer) or redirect/suggest (Router) decision. We do not store visitors' IP addresses and do not build profiles of them. There is no automated decision producing legal or similarly significant effects on an individual, the decision only determines which page a browser sees. Where a plan keeps analytics, they are aggregated and non-identifying (e.g. blocked/redirected visits by country), never individual IP addresses.

Router may store a small functional value in the visitor's own browser (e.g. to remember a dismissed suggestion banner or a chosen region so they are not redirected twice). This is strictly for functionality, is not used for tracking or advertising, and is not shared with us.

You are the data controller for this visitor processing and Vanssay acts as your processor, carrying out the geolocation and VPN check on your behalf and on your documented instructions (your rules). You are responsible for providing any privacy notice and lawful basis your jurisdiction requires when filtering or redirecting visitors. A data-processing addendum is available at support@vanssay.net.

4. Maintenance Mode

Maintenance Mode compares a visitor's IP against the whitelist you configure, server-side, to decide whether they see the maintenance page or the live site. The IP is used only for that check and is not stored. As above, you are the controller and Vanssay is your processor for this processing.

5. Instagram Feed

Instagram Feed fetches the public profile information and posts of the Instagram account you connect (profile picture, name, biography, follower/post counts, and the posts themselves with their captions, like and comment counts). We retrieve this through Apify, a third-party scraping service, and cache it on our servers so your widget loads quickly and we do not re-fetch on every page view.

We do not ask for, receive or store your Instagram password, and the plugin does not log in to Instagram as you. You may only connect an account you own or are authorized to represent, and you are responsible for having the rights to display its content on your site.

Your site visitors. Unlike Bouncer, Router and Maintenance Mode, Instagram Feed performs no per-visitor check and no IP geolocation. When a page containing your feed is viewed we increment an aggregate counter for that feed, used solely to apply your plan's monthly view limit. No visitor IP address, identifier or profile is stored, and no cookie is set on your visitors.

Images are served through our servers rather than linked directly from Instagram, so that your visitors' browsers do not need to contact Instagram to display your feed.

6. How we use data

Exclusively to operate the Service: authenticating you, fetching and displaying your reviews and Instagram posts, enforcing your Bouncer/Router/Maintenance rules, applying plan limits, processing subscriptions, and sending essential transactional emails (from no-reply@vanssay.net via Brevo). We never sell or rent personal data, and we do not use it for third-party advertising.

7. Third-party processors & international transfers

Where a processor is outside the EU/EEA, transfers are covered by appropriate safeguards under the GDPR (Standard Contractual Clauses and/or an adequacy decision). We use processors only for the purposes above and under contract.

8. Data retention & deletion

Review caches expire automatically (short TTL). Visitor IP checks are transient and are not logged with IP addresses. Aggregated analytics and your account and configuration data are kept while your account is active. Billing records are kept as long as required by law (typically up to 10 years for accounting). To delete your account and all associated personal data, email support@vanssay.net; we process deletion requests within 30 days, except records we must retain by law.

9. Your rights

Under the GDPR and similar laws you have the right to: access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent where processing relies on it. Exercise any of these by emailing support@vanssay.net. You also have the right to lodge a complaint with a supervisory authority, in France, the CNIL. If your data is processed by a Vanssay plugin on a site you visited, direct your request to that site's owner (the controller), who can instruct us as their processor.

10. Cookies

Our website and account pages use only strictly necessary cookies/local storage (e.g. your login session). We set no advertising or third-party tracking cookies. On your published site, our widgets and checks set no tracking cookies on your visitors; Router may set a single functional value as described in §3.

11. Security

Data is transmitted over HTTPS, passwords are hashed, and access tokens are signed and time-limited. Access to production systems is restricted. No system is perfectly secure; we will notify affected users and the relevant authority of any breach as required by law.

12. Changes & contact

We may update this policy as the Service evolves; material changes are announced here with an updated date. Questions or requests: support@vanssay.net.