Privacy Policy — TrustFusion

Last Updated: 7th August 2026

Web City Lab (“we”, “our”, “us”) operates the TrustFusion service at this site (reviews.webcitylab.com — the “Relay”), including license management, the review-fetching relay, the customer dashboard, and the embeddable widget, alongside the TrustFusion WordPress plugin. This policy explains what data we access, process, and store, whether you use TrustFusion as a WordPress plugin, an embedded widget (Shopify, Wix, Squarespace, custom HTML/PHP), or through this site’s dashboard.

1. Google API Services User Data Policy Compliance (Limited Use)

TrustFusion’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell, trade, or transfer your Google user data to third-party tools, platforms, or advertising networks.

2. How TrustFusion Works — Two Data Paths

TrustFusion can display your business’s Google reviews in two ways, and this policy covers both:

  • Public review lookup (default, no Google login required). You search for your business and select it; TrustFusion, through this Relay, retrieves your business’s publicly visible Google review data by its Place ID. No Google account access is requested or granted for this path.
  • Official Google Business Profile connection (optional). You may choose to connect your GBP account via Google OAuth, or add our Relay’s Google account as a Manager on your own Business Profile, either of which grants read access to reviews and profile data you manage. This is entirely optional and is described in Section 3 below.

3. Data We Access via Google OAuth (Optional Connection)

  • Scope: https://www.googleapis.com/auth/business.manage (single scope).
  • Purpose: To read your own GBP reviews and business profile data so you can display them on your website.
  • Data accessed: Business profile metadata (name, place identifier, rating summary) and public review content (reviewer name, reviewer profile photo, rating value, comment text, timestamps, and review IDs).
  • Restrictions: TrustFusion does not read, access, or interact with Gmail, Drive, Contacts, or any other unrelated Google account data.

4. Data Processed via This Site (the Relay)

Whether you use the WordPress plugin or the embeddable widget, this site processes:

  • License verification: your license key and website domain, sent whenever your plugin/widget checks license status, activates, or deactivates a site.
  • Review/search requests: the Google Place ID(s) you look up or display reviews for, and your website’s domain (used to enforce your plan’s site limit).
  • Abuse-prevention data: the requesting server’s IP address may be briefly recorded (up to one hour) purely to rate-limit anonymous requests. Not linked to your identity beyond that hour.
  • Dashboard data: if you use the widget dashboard at reviews.webcitylab.com/manage-your-reviews/, the businesses you save and any reviews you choose to hide are stored here, tied to your license key.

We do not use this data for advertising, and do not share it with third parties except where necessary to operate this service (e.g., our hosting provider) or as required by law.

5. Payment Processing

Purchases are processed by Paddle (Paddle.com Market Ltd / Paddle Payments Limited), who act as the Merchant of Record for all sales made through this site. This means Paddle — not Web City Lab — is the seller you are transacting with for billing, tax, and payment purposes. Paddle collects your payment details, billing address, and email directly; we do not receive or store your card details. Paddle’s handling of your payment data is governed by Paddle’s own privacy policy, available at paddle.com. We receive only your email address, the plan purchased, and a transaction reference from Paddle, used solely to generate and deliver your license key.

6. Google Business Profile OAuth Tokens — Storage

If you use the optional official OAuth connection (Section 3), your Google access and refresh tokens are encrypted and stored on this server — not in a WordPress plugin’s own database — tied to your license, your website’s domain, and the specific business location you connected.

7. Local WordPress Database Storage (Plugin Users)

If you use the TrustFusion WordPress plugin, your own WordPress installation additionally stores your synced reviews and business profile data locally, entirely within your own database. The number of reviews stored depends on your plan: up to 10 per business on the free tier, or your full available review history on a paid plan. Your site’s public frontend never calls Google APIs directly, and no API keys, license keys, or tokens are exposed to a visitor’s browser.

8. Places API Use

The Google Places API is used, via this Relay’s shared key or your own configured key, to resolve a business name or Google Maps URL into a standard Place ID and to retrieve business/review data. We do not collect, stream, or store end-user location history, background tracking, or device GPS data.

9. License and Account Data

To provide and support your subscription, we retain: your license key, the email address associated with your purchase, your order/transaction reference, your plan/site-limit tier, and which website domain(s) have activated the license. Retained for the duration of your license plus a reasonable period afterward for support, billing, and fraud-prevention purposes.

10. Legal Basis for Processing

  • Where you connect your Google Business Profile via OAuth, processing is based on your explicit consent, given when you initiate the connection.
  • Where we process your license key, website domain, and account data, this is based on the necessity of performing the contract formed when you purchased and activated a TrustFusion license.

11. Data Retention

  • OAuth tokens: retained on this server until you revoke access directly from your Google Account’s Security settings or your Google Business Profile’s “People and access” list (see Section 3 and Section 12) — this is currently the only way to fully remove a stored token. Canceling a paid subscription stops billing and access but does not, by itself, delete a previously stored OAuth token.
  • Reviews and profile data: locally-stored WordPress data remains until removed via full plugin uninstall with data removal; widget-dashboard-stored data (saved businesses, hidden-review preferences) remains until you remove it at reviews.webcitylab.com/manage-your-reviews/ or request deletion per our Data Deletion Policy. Canceling a subscription does not automatically delete this data.
  • License/account data: retained per Section 9.
  • Rate-limiting IP data: auto-expires within one hour.

12. Your Choices and Data Deletion

  • Disconnecting: Remove a business connection from your WordPress plugin’s dashboard or from reviews.webcitylab.com/manage-your-reviews/.
  • Revoking Google access directly: Revoke TrustFusion’s OAuth access from your Google Account’s Security settings, or remove our Relay account as a Manager from your Google Business Profile’s “People and access” settings.
  • Deletion requests: Email support@webcitylab.com for deletion assistance, including license/account data. See our Data Deletion Policy for full details and timelines.

13. Your Privacy Rights

Depending on your location, you may have rights to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. Contact support@webcitylab.com to exercise any of these rights.

14. Security

All sensitive credentials — Google OAuth tokens, license keys — are encrypted and handled server-side. No client secrets or tokens are exposed in frontend scripts. You remain responsible for securing your own WordPress site’s administrative access, hosting environment, and database backups where applicable.

15. International Data Transfers

This site’s hosting infrastructure, and Paddle as our payment processor, may process data in a country different from your own. Where this occurs, we take reasonable steps to ensure your data continues to receive an appropriate level of protection consistent with this policy.

16. Children’s Data

TrustFusion is intended for businesses and web developers. It is not directed to children under the age of 13, and we do not knowingly process children’s personal data.

17. Policy Changes

We may update this policy periodically. The latest version will always be published at this URL with a revised “Last Updated” date.

18. Contact & Corporate Details

  • Company Name: Web City Lab
  • Support Email: support@webcitylab.com
  • Address: MM Tower, Rajjak Khan Shorok, Nothulladbad, Barisal Sodor, Bangladesh
    Scroll to Top