Privacy Policy

Lunar Trading sp. z o.o. is the controller of personal data processed for WebVouch’s own purposes.

Lunar Trading sp. z o.o. (registered name: LUNAR TRADING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ) is a limited liability company incorporated under Polish law, with its registered office at Rondo Ignacego Daszyńskiego 2B, 00-843 Warsaw, Poland. It is entered in the Register of Entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under KRS number 0000905317, registered on 9 June 2021. Tax identification number (NIP): 8943169053. Statistical identification number (REGON): 389186115. Share capital: PLN 5,000.

Privacy questions and requests may be sent to hello@webvouch.com or by post to the registered office address above.

Lunar Trading sp. z o.o. acts as a controller when it operates accounts and public review services, publishes and moderates reviews and company profiles, protects platform integrity and security, administers subscriptions, provides support, complies with law and manages its direct relationship with reviewers and business users.

When a business supplies customer information to send review invitations or connects Shopify for that purpose, the business normally determines why that information is used and Lunar Trading sp. z o.o. processes it on the business’s documented instructions. In that situation, the business is the controller and Lunar Trading sp. z o.o. is its processor under the applicable Data Processing Agreement.

Lunar Trading sp. z o.o. remains an independent controller for information needed to secure WebVouch, comply with law, and operate any account or review an invited person submits directly.

Account information may include your name, email address, profile image, authentication provider, account status, organisation membership and role, preferences, login history and security information.

Review information may include the public author name or initial, avatar, location, rating, title, text, reviewed company, source, external-review URL, photographs, dates, verification or invitation status, edits, helpful votes, reports, appeals, moderation outcomes and business replies.

Business information may include company name, website, domain, description, logo, address, country, telephone number, email, social profiles, categories, organisation members, roles, verification status and correspondence. A verification submission may include a legal name, registration number, message and uploaded identity or registration evidence.

Invitation and integration information may include a recipient email address and name, invitation status, sending, opening and response dates, an invitation code, merchant order or event identifiers, Shopify shop and order identifiers, a customer display name and integration configuration. The current Shopify invitation flow does not require order line-item details.

Billing information may include subscription, customer and invoice identifiers, billing address, tax information, payment status, card brand, last four digits and expiry information, plan, trial and cancellation details. Stripe handles full payment-card information rather than WebVouch storing it directly.

Support information may include your name, email, topic, subject, message, attachments, support history and information supplied while resolving a request.

Technical and security information may include IP address, user agent, browser and device information, session and cookie identifiers, timestamps, request metadata, security events, rate-limit events and suspected-abuse indicators.

We receive information directly from you, from a business using WebVouch, from your browser or device, and from services you or a business connect to WebVouch.

Depending on the feature, sources may include Google or Meta authentication, Shopify, Google Business Profile, external review providers, Stripe, email-delivery providers and publicly available sources. Where information was not obtained directly from you, you may ask us about its source.

We process information to create accounts and provide requested services; accept, publish, edit and manage reviews; operate company profiles, dashboards, subscriptions, invitations and integrations; process payments; provide support; communicate service messages; moderate content; prevent fraud and manipulation; secure WebVouch; improve reliability; comply with law; and establish or defend legal claims.

• Contract: providing an account, review-submission service, business service, subscription, integration or support requested by you.
• Legitimate interests: operating a trustworthy public review platform, displaying reviews and profiles, preventing abuse, securing systems, improving reliability, communicating about the Service and protecting legal claims, after considering the impact on individuals.
• Legal obligation: tax, accounting, regulatory, court and law-enforcement requirements.
• Consent: optional marketing and terminal-device technologies where consent is required. Consent may be withdrawn at any time without affecting earlier lawful processing.
• Processor activity: sending invitations or processing connected customer data on a business customer’s documented instructions and under its chosen legal basis.

A published review may display the author name or initial, avatar, location, rating, title, text, photographs, source, dates, verification label, helpful-vote count and a related business reply.

Company profiles and reviews are visible without an account. They may be indexed by search engines, displayed through WebVouch widgets, shared through supported integrations or APIs, quoted when presenting WebVouch or the reviewed business, and cached by third parties.

Deleting an account does not automatically remove the public review or displayed author name. Review deletion is a separate action. Search engines and third parties may need additional time to refresh cached copies.

Do not include confidential information, special-category data or unnecessary information about another person in a review.

A business may give us a customer name, email address and limited order or event information so we can send and track a review invitation on its behalf. Invitation tracking can record delivery, opening, response and suppression events.

The business is responsible for giving recipients the required privacy information and for having a lawful basis and any consent required for the contact details and message. A recipient may use the unsubscribe or objection route in the message, contact the business, or contact us at hello@webvouch.com.

Disconnecting Shopify or another integration stops future synchronisation but does not necessarily remove reviews already submitted or imported.

WebVouch processes limited network, browser, session and submission information to prevent fraudulent reviews, coordinated campaigns, account abuse and attempts to evade restrictions. Standard protections include session security, rate limiting, request logs and moderation evidence.

The review flow stores a randomly generated anonymous-reviewer identifier in local browser storage to maintain submission continuity and reduce duplicate submissions. It remains until WebVouch removes or replaces it or the user clears browser storage.

Enhanced anti-abuse controls use a first-party wv_did continuity cookie lasting up to 400 days, coarse browser or device characteristics, and network or user-agent signals. These characteristics can include timezone, language, platform, screen and hardware categories, touch and memory characteristics, device pixel ratio, and bounded canvas, WebGL, audio or font measurements during review submission. Some raw attributes are used transiently to create pseudonymous identifiers or keyed hashes. Pseudonymised information remains personal data.

Enhanced signals are used for platform integrity rather than advertising or personalisation. They may inform a temporary hold or human moderation decision. Available submission-status and appeal controls may be used to contest a relevant decision.

Where WebVouch displays an AI-generated company summary or frequently asked questions, it uses OpenAI to create that content. The feature may process company information and portions of review or reply text, ratings, source information and dates.

Direct author-profile fields are excluded from the request and common email addresses, URLs and telephone numbers are redacted where detected, but free-form review text may still contain personal information. Requests are configured not to be stored by the Responses API. Shopify customer and order information is not sent to this feature.

WebVouch uses an authentication session cookie, normally lasting up to 30 days, and short-lived OAuth and security-state cookies, normally lasting about 10 minutes. Separate administrator session and CSRF cookies normally last up to 72 hours.

If the enhanced anti-abuse feature is activated, the wv_did cookie may last up to 400 days. Anonymous review submission also uses a local-storage identifier that remains until it is cleared by the browser or the application.

Stripe, Google, Meta, Shopify or another connected provider may use its own cookies or storage when its feature is used. Cookie lifetime does not necessarily equal the retention period of related server-side records.

For storage or access on a user’s device, WebVouch relies on a strictly-necessary or requested-service exception only where its legal conditions are met. Where that exception does not apply, the technology requires consent. You can clear cookies and local storage through browser controls, although a required feature may then stop working correctly.

We disclose information only where necessary to operate WebVouch, follow a business customer’s instructions, comply with law or protect rights.

• Hosting, database, storage, backup, content-delivery and security providers.
• Stripe for billing and payment processing.
• Postmark for transactional and review-invitation email delivery.
• Google and Meta when their authentication or integration features are used.
• Shopify when a merchant connects the Shopify integration.
• OpenAI where an AI-assisted feature is enabled.
• External review providers selected by a business.
• A business customer that requested an invitation or manages the reviewed profile.
• A customer-configured webhook recipient when that customer directs WebVouch to send an applicable event.
• Professional advisers, auditors, insurers, courts, regulators and public authorities.
• A buyer or successor in a corporate transaction, subject to appropriate confidentiality safeguards.

WebVouch currently requests font files from Google infrastructure when pages or emails use externally hosted Google Fonts. This can disclose connection information such as an IP address and user agent to Google.

Some providers may process information outside Poland or the European Economic Area. Where required, we rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and apply supplementary safeguards where appropriate.

You may contact hello@webvouch.com for information about the transfer safeguards relevant to your data.

We keep personal data only for as long as needed for the purpose described in this Policy, to comply with law, resolve disputes, prevent abuse and establish or defend legal claims. The period depends on the type of record and the relationship.

• Account and organisation records are kept while the relevant relationship is active and afterward only as required for security, legal obligations and claims.
• A published review is kept while it remains published. It may remain after account or organisation deletion until it is separately deleted, removed through moderation or no longer needed. Limited deletion and moderation evidence may be retained for abuse prevention and claims.
• Approved review photographs may be retained for up to 365 days. Account deletion removes associated review photographs.
• Business-verification evidence is kept while needed to complete and document verification, prevent repeated abuse, resolve disputes and meet legal obligations. Access is restricted.
• Invitation, Shopify and integration records are kept while needed to deliver the feature, document customer instructions, operate suppressions, resolve delivery issues and meet legal or contractual obligations.
• External-review staging data is normally removed within 24 hours, import diagnostics within 14 days and customer-webhook delivery records within 90 days.
• If enhanced anti-abuse processing is activated, sightings are normally kept for 180 days. A limited record may be kept longer while a documented restriction or dispute remains active. The wv_did browser cookie may last up to 400 days.
• Support records are kept while a request is open and afterward for a limited period based on its subject, sensitivity and potential claims. Attachments are removed earlier where they are no longer needed.
• Billing and accounting records are kept for the period required by tax and accounting law.
• Rolling backups are kept for a limited recovery period before replacement. Data may remain in an inaccessible backup until that backup expires.

Deleting an account unlinks it from previously published reviews and removes associated review photographs, but the review text and displayed author name remain unless the review is separately deleted or removed.

Deleting a business organisation removes its private workspace data according to the deletion process, but does not automatically remove its public company profile, reviews or replies.

Disconnecting an integration ends future access but may not delete information already imported, published, retained for suppression or security, or required by law. You may contact us about a specific record.

Subject to applicable law, you may request access to and a copy of your personal data, correction, deletion, restriction, portability, and information about data sources. You may object to processing based on legitimate interests, withdraw consent and object to direct marketing.

Send a request to hello@webvouch.com. We may ask for information needed to verify your identity. We normally respond within one month, subject to an extension permitted by law.

If we process invitation information only on behalf of a business, we may refer your request to that business or assist it in responding. People whose reviews were imported from another source may contact us to request correction, objection or removal.

You may complain to your local data-protection authority. In Poland, this is the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl.

Security and integrity systems may assign signals, apply rate limits or temporarily hold activity for review. WebVouch does not use those signals to make a solely automated decision that produces legal or similarly significant effects.

Where a moderation or restriction decision materially affects you, use the submission-status, decision reference, reporting route or hello@webvouch.com to request human review.

Information marked as required is needed to provide the requested feature, create an account, publish a review, verify a business or complete a transaction. If you do not provide it, we may be unable to provide that feature.

WebVouch is not designed specifically for children. A person under 18 may use the Service only where permitted by applicable law and with the involvement of a parent or legal guardian. If you believe a child has provided personal data unlawfully or without required authorisation, contact hello@webvouch.com.

We use organisational and technical safeguards designed to protect information, including access controls, encryption in transit, restricted private storage, session protections, rate limiting, monitoring and backups. No online system is completely secure, and users remain responsible for securing their credentials, devices, email and connected accounts.

We may update this Policy when our services, providers, laws or processing activities change. Material changes will be communicated through WebVouch, email or another appropriate channel before they take effect where required. The current version and effective date remain available on this page.

Privacy questions and rights requests may be sent to hello@webvouch.com.