Privacy Policy: Google Reviews 2027 for Wix
Last updated: November 14, 2026
This policy covers Google Reviews 2027, our app for Wix sites: its page in your Wix dashboard, its settings panel in the Wix editor, the reviews widget on your published site, and the tools it gives Aria, Wix's AI assistant. It explains what we store, why, how we protect it, and how to delete it. Our plugins for other platforms (Framer, Webflow) are covered by our general privacy policy.
- No Vanssay account and no password: Wix tells us which site is using the app.
- The personal data we keep (the site owner's email, your site's name and address, Google account emails, and the access Google grants us) is stored encrypted (AES-256-GCM).
- Google access is used read-only: we never reply, post or change anything on your Business Profile.
- No cookies, no tracking of your visitors, no ads. We never sell data.
- Remove the app and we delete your site's data.
Two roles. For the data about your site and your use of the app, we are the controller. For what the widget does on your published site (showing reviews to your visitors and counting views), you are the controller and we act as your processor.
1. What we store and why
| Data | Comes from | Why | Encrypted |
|---|---|---|---|
| App instance ID (a random identifier Wix gives the app on your site) | Wix | Tell your site apart from others and link it to its settings | No (not personal) |
| Your site's ID | Wix | Open your site's editor from the app | No |
| Your site's name and address (URL) | Wix | Show your site's name in the app and on the client-link page; check that widget views come from your site | Yes |
| The site owner's email address | Wix | Show it to you in the app and answer you when you contact support. We send no newsletters or marketing to it. | Yes |
| Your plan | Wix Billing | Apply your plan's features | No |
| The email address of the Google account you sign in with | Show which account is connected, avoid connecting it twice | Yes | |
| The access Google grants us (a refresh token) | Keep your reviews in sync automatically | Yes | |
| Your business details: name, address, Google Maps and "write a review" links, average rating, review count | Display them in your widgets | No (public on Google) | |
| Your reviews: star rating, text (and Google's translation), date, the reviewer's public name, profile photo and profile link, photos attached to the review, your replies | Display them in your widgets and let you hide or pin them | No (public on Google) | |
| Widget settings: layout, colours, wording, filters, hidden and pinned reviews | You | Show the widget the way you set it up | No |
| Client links: the link itself and, once used, the email address of the Google account that signed in through it | You, then Google | Let the person who manages your Google profile connect it, and show you who did | Yes |
| Where each widget is live (page path and title, e.g. "/about", "About us") and daily view counts | The widget on your site | Show you where the widget is live and how often it is seen | No (not personal) |
| Your emails to support | You | Answer you | No |
We use this data only to run the app for your site. We never sell or rent it, and we never use it for advertising.
2. Google data
Sign in with Google (all your reviews)
If you sign in with the Google account that manages your Business Profile, we ask Google for one permission, https://www.googleapis.com/auth/business.manage. Google offers no read-only version of it, so we limit ourselves in our own code: we only read. We read the list of businesses your account manages (name, address, Maps and review links) so you can pick one, and, for the businesses you pick, their reviews, your replies, the average rating and the review count.
We never reply to reviews, edit your business information, post, upload photos, manage users or change anything on your Business Profile. We don't read your Gmail, contacts, calendar, Drive or any other Google data. Google data is used only to show your reviews in your widgets and in the app, and is never used for advertising, sold, used to train AI or machine-learning models, or used to assess creditworthiness. No one at Vanssay reads it, except with your permission (for example when you ask for support), for security or abuse investigations, or when the law requires it.
Search your business (no sign-in)
If you find your business with Search your business instead, we fetch its public details and the up to 5 reviews Google shares publicly, through the Google Places API. No Google account is involved.
Client links
On paid plans you can send a link to the person who manages your Google profile. The link works once and expires after 7 days. When they use it, they sign in with Google on our page as described above, and we keep the email address of the Google account they used, encrypted, so you can see who connected it.
Stopping Google access
Clicking Remove next to a location in the app deletes that location and its stored reviews straight away. To stop our Google access altogether, remove the app from your site (we then revoke it at Google, see §7), or remove our access from your Google account (myaccount.google.com/connections): we then delete the token and the stored reviews at the next automatic sync, within a day on paid plans and within a week on the Free plan. You can also ask us at support@vanssay.net.
3. Your site visitors
The widget on your published site gets your reviews from our server at api.vanssay.net. When a page with the widget is viewed, it sends us the widget's ID and, once per page, the page's path and title. We use them to send back the reviews to show, to add one to that widget's view count for the day, and to list the pages where the widget is live in your dashboard.
That's all we keep from a visit. We set no cookie, use no browser storage, don't fingerprint the device and keep no record of individual visitors: view counts are daily totals per widget. Our server necessarily sees the IP address of the browser that calls it, in order to answer; we use it only for that and for anti-abuse rate limits, and never store it with your widget or use it for statistics. Like any web server, ours keeps standard access logs (IP address, time, page requested, browser type) for security and troubleshooting, deleted after 14 days.
Photos come from Google. Reviewers' profile pictures and the photos attached to reviews are loaded by the visitor's browser directly from Google's image servers (googleusercontent.com), as with any image embedded from another site. Google can see those image requests, under Google's privacy policy. The review text and ratings come from our server. The "Write a review" and "Posted on Google" links open Google only when a visitor clicks them.
You are the controller for your published site and we act as your processor when we serve your widget. A data processing addendum is available on request at support@vanssay.net.
4. Aria, Wix's AI assistant
The app gives Aria tools for your site. When you, the site owner, ask Aria a question about your reviews, Wix calls our server for your site only, and we answer with what the question needs: your rating summary, recent reviews (reviewer's public name, rating, date and text), your widgets' view counts, your "write a review" link or a client link. At your request through Aria we can also hide or pin a review or start a sync. We send nothing to Aria on our own, and only for the site you are signed in to. Your conversation with Aria is handled by Wix under Wix's privacy policy.
5. Encryption and security
- Encrypted at rest: the site owner's email address, your site's name and address, Google account email addresses (yours and those used through client links), the access tokens Google grants us, and client links. Each value is encrypted with AES-256-GCM using its own random initialisation vector; the key is kept outside the database. Reviews and business details are public on Google and are not encrypted.
- In transit: every connection, from the app, the widget, Wix and Google, uses HTTPS.
- Checked requests: each request from the app is verified with Wix before we act on it, and Wix's notifications (install, removal, plan changes) are checked against Wix's signature.
- Never in the browser: Google access tokens and our API keys stay on our server. Nothing secret is placed in your published page.
- Restricted access: only we can reach the production server and database.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority as the law requires.
6. Who else handles data
| Who | What for | Where |
|---|---|---|
| Wix | Runs the app's dashboard page and settings panel, tells us which site is using the app, and handles billing | EU / USA / Israel |
| Google (Business Profile API, Places API, image servers) | Your business details, reviews and photos | USA |
| Our server | Runs our backend and database | EU |
Where data leaves the EU/EEA, the transfer is covered by safeguards under the GDPR (Standard Contractual Clauses and/or an adequacy decision).
7. How long we keep it
- While the app is installed: your settings and connected businesses stay. Reviews are refreshed automatically (daily on paid plans, weekly on the Free plan); a review deleted on Google disappears from our copy at the next refresh.
- When you remove a location in the app: it and its stored reviews are deleted straight away (see §2).
- Client links that aren't used expire after 7 days.
- When you remove the app from your site: Wix tells us, and we revoke any Google access and delete your site's widgets, the pages where they were live, view counts, businesses, reviews, Google connections, client links, the owner's email address and your site's ID, name and address. We keep only the anonymous instance ID, the plan and the removal date, as billing records.
- Server access logs: 14 days. Backups: roll over within 30 days.
8. Legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Running the app for your site: showing your reviews, keeping them in sync, applying your plan | Performance of a contract |
| Security, abuse prevention, view counts, support | Legitimate interest |
| Keeping billing records | Legal obligation |
9. Your rights
Under the GDPR and similar laws you can ask to access, correct or delete your data, restrict or object to its use, and receive it in a portable format. Email support@vanssay.net; we answer within 30 days. You can also complain to a supervisory authority; in France, the CNIL. If you visited a site that uses this app, contact that site's owner, who can instruct us as their processor.
10. Cookies
The app sets no cookies. The widget on your published site sets no cookie and stores nothing in your visitors' browsers. Wix's own pages and your Wix site may use cookies under Wix's policies and your site's settings.
11. Changes and contact
We may update this policy as the app evolves; changes appear here with a new date. Questions or requests: support@vanssay.net.