Reviews - Vanssay Privacy Policy

For the Webflow App "Reviews - Vanssay". Last updated: November 7, 2026

1. Who we are and scope

This policy covers Reviews - Vanssay (the "App"): the Webflow App (its authorization and its Designer Extension), the Reviews web app at webflow.vanssay.net/reviews, the script the App adds to your published Webflow site, and the Vanssay servers behind them. The controller for your account data is Marin de Vanssay, sole trader (micro-entreprise), SIREN 107304735, France. Contact for any privacy request: support@vanssay.net.

Two roles. For your account, billing and use of the App, we are the controller. For the requests your published site makes when a visitor views a page with your widget (§5), you are the controller of your site and we act as your processor.

2. Data we collect from you

• Account data. Your email address, which Webflow shares with us when you authorize the App, and your Webflow user ID. There is no password: you sign in through Webflow, or with a one-time link we email you. The same Vanssay account works across Vanssay products that use the same email.
• Webflow sites. For each site you authorize: its ID, name, Webflow address, custom domains and last publish date, the version of our script applied to it, and an access token issued by Webflow (see §4).
• Google connection. If you sign in with Google: the email of that Google account and an access token issued by Google (see §3).
• Businesses and reviews. The businesses you import and their reviews (see §3).
• Widgets. Each widget's name, layout and settings, the reviews you pinned or hid, the pages you placed it on (site, page title and path, recorded by the Designer app when you press Add to page), and its daily view counts (§5).
• Billing data. Payments are processed by Stripe. We receive your plan, its status, and your country and tax details. We never see or store your card details.
• Support. Emails you send us and their content.

The App never reads your Webflow pages, CMS or site content. The only parts of your site it touches are its own script in your site's custom code (§4) and the blocks you place with the Designer app.

3. Google Business Profile data

You choose how to bring in reviews. Search a business uses Google's Places API: we send the name you typed and receive the business's public details and the up to 5 reviews Google shows publicly. No Google sign-in is involved.

Sign in with Google lets us show all the reviews of a business you own or manage. We ask Google for one permission, https://www.googleapis.com/auth/business.manage, plus your Google account's email. Google offers no read-only version of that permission, so we limit ourselves in our own code: we only read. With it we read:

• the list of Business Profile accounts and locations your Google account manages (business name, address, Google Maps and "write a review" links), so you can pick the business to show;
• for the locations you pick: the reviews (star rating, text, date, the reviewer's public display name and profile photo, photos attached to the review) and your replies to them, plus the average rating and total review count.

We do not reply to reviews, edit your business information, post updates, upload photos, manage users, or change anything else on your Business Profile. We do not read your Gmail, contacts, calendar, Drive or any other Google data.

How we use it. Only to display your reviews in the widgets you create, on the websites you choose, and to show them to you in the web app so you can pick, hide or pin them. We refresh them automatically, about once a day, so new reviews appear without you doing anything.

Who sees it. The reviews you choose to show are published on your website by you, as you instructed. Apart from that we do not share, sell or transfer Google user data to anyone. It is never used for advertising, never sold to data brokers, never used to train artificial intelligence or machine learning models, and never used to assess creditworthiness. No person at Vanssay reads it, except with your permission (for example when you ask for support), when needed for security or abuse investigations, or when required by law.

Storage and deletion. We store the access granted by Google (a refresh token) encrypted on our servers, never in your browser or on your published site. We keep a copy of the reviews of the businesses you connected, so your widgets load quickly. When you press Disconnect Google in the web app, or Delete my data, we revoke the access at Google and delete the token and the stored reviews of those businesses straight away. If you remove our access from your Google account settings (myaccount.google.com/connections), we delete the token and the stored reviews at the next sync attempt, within 48 hours.

4. Webflow authorization, disconnect and uninstall

Authorization. When you install the App, Webflow shows its standard authorization screen and you choose the sites to authorize. If you cancel, we receive nothing and store nothing. If you authorize, the App receives an access token for those sites with these permissions, each used only as described:

• Authorized user (read): your Webflow email and user ID, to create or find your Vanssay account.
• Sites (read and write): to list the sites you authorized, with their names and domains, so the App only acts on sites you control. The write part is kept, as Webflow asks of Apps that remove their script while installed. The App never publishes your site and never changes your pages or content.
• Custom code (read and write): to register our one script, apply it to your site's footer, and remove it again, leaving your other custom code as it is.

The authorization request is protected by a random, single-use code tied to your browser, so it cannot be completed from another browser. We store the access token encrypted on our servers. It never reaches your browser, the Designer or your published site, and it is never used for anything else.

Designer app. When you open Reviews - Vanssay in the Designer, it asks Webflow for a short-lived token that identifies you, and our server checks it with Webflow before showing your widgets. It reads the current site and page only to place a widget and record where it is.

Disconnect ("Remove from this site"). In the web app or the Designer app, this removes our script from that site's custom code and unlinks the site from your account. We keep the Webflow authorization, so Turn back on works without authorizing again. To end the authorization, uninstall the App.

Uninstall. Uninstalling the App in Webflow ends our access at once, and Webflow removes the script the App added (live after your next publish). We check daily whether each authorization is still valid; once it is not, we delete the token and our record of the sites it covered, and never use it again. Your Vanssay account, widgets and imported reviews are kept so you can reinstall. Ask us to delete them at any time (§8).

5. Your published site and its visitors

When a page with your widget is viewed, the visitor's browser makes these requests, and only these:

The widget ID identifies your widget, not the visitor. No account ID or email is placed on your page. The script sets no cookie and writes nothing to localStorage or any other browser storage. It does not fingerprint the device and does not track the visitor across pages or sites. Counts are aggregate totals per widget and day: we cannot tell from them who visited.

Like any web server, ours sees the IP address of a browser that calls it in order to send the response. We use it only to answer and to apply anti-abuse rate limits, and our standard server logs keep it for up to 14 days. We do not store it against your widget and do not use it for analytics.

A data-processing addendum is available on request at support@vanssay.net.

6. Why we use data, and legal bases (GDPR Art. 6)

We never sell or rent personal data and never use it for advertising.

7. Processors and transfers

Webflow, Inc. runs the platform the App works on. Your use of Webflow is governed by Webflow's own privacy policy. Where a processor is outside the EU/EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.

8. Retention and deletion

• Google token and stored reviews: kept while the connection exists. Deleted at once when you disconnect Google or delete your data, and within 48 hours after you remove our access in your Google account.
• Webflow token and site records: kept while the App is installed. Deleted within a day of an uninstall (§4), or at once with Delete my data.
• Widgets, placements and view counts: kept while the widget exists. Deleting a widget deletes them.
• Sign-in links: single use, valid 15 minutes (2 minutes for the links Webflow and the Designer app hand over).
• Account: kept while you use any Vanssay product. Billing records are kept as long as the law requires (up to 10 years for accounting).

Delete my data, in the web app's Account page, removes our script from your linked sites, revokes our Google access and deletes your widgets, businesses, imported reviews, view counts and Webflow tokens straight away. To delete your Vanssay account itself, or if you already uninstalled, email support@vanssay.net: we do it within 30 days, except records we must keep by law. Backups roll over within 30 days.

9. Your rights

Under the GDPR and similar laws you can ask to access, correct, erase, restrict or port your data, and object to processing. Email support@vanssay.net. You can also complain to a supervisory authority; in France, the CNIL. If you visited a site that uses the App, the site's owner is the controller: contact them first, and they can instruct us. If you wrote a Google review shown by a widget, Google is where your review lives: editing or deleting it there removes it from widgets at the next refresh.

10. Cookies, storage and security

The web app keeps your sign-in session in your browser's storage, and the install step sets one short-lived, strictly necessary cookie that ties the Webflow authorization to your browser. Nothing else, and no analytics or advertising cookies. The script on your published site sets no cookies and uses no browser storage on your visitors. Data travels over HTTPS, Google and Webflow tokens are encrypted at rest, and access to our servers is restricted. If a breach affects you, we will tell you and the relevant authority as the law requires.

11. Changes and contact

We may update this policy as the App changes. Material changes are announced on this page with a new date and, where significant, by email. Questions: support@vanssay.net.

The App is not affiliated with, endorsed by, or sponsored by Google LLC or Webflow, Inc. Google and Google Business Profile are trademarks of Google LLC.