GDPR and your data

Laudiance runs on Supabase in an EU region: the Postgres database, uploaded files (videos, avatars, logos) and authentication all live there. The application itself is served by Vercel.

A visitor cannot submit a testimonial without ticking the consent checkbox. With every collected testimonial we store the moment of consent (timestamp) and a reference to the exact version of the consent text the visitor saw. Consent texts are versioned append-only: when you edit the wording, a new version is created, and each testimonial keeps pointing at the version its author actually agreed to. Testimonials you import yourself are labeled honestly as imported by the owner, with no visitor consent record, because there is none.

Settings, Privacy and data, Export downloads a JSON file with your workspace, forms, all testimonials in every status (including original and edited text and the consent records), tags, and links to media files. No support ticket needed.

Deleting a testimonial removes its database row and its stored files (video, avatar) in the same routine. Deleting your account removes the account, all workspaces, all testimonials and all files, and cancels any subscription first. There is no soft-delete copy kept anywhere.

One honest detail: media is served through short-lived signed URLs that expire after at most one hour. A URL that was issued just before a deletion can therefore keep working until its signature expires, up to one hour. The wall and widget stop showing deleted content immediately, because their caches are revalidated on every change.

The collection form, the Wall of Love and the embed widget set zero cookies and write nothing to localStorage or sessionStorage. They load no external fonts, because our typefaces are served from our own domain, and no third-party script, analytics tag or advertising tag. The dashboard uses strictly necessary authentication cookies only. There are no analytics or tracking cookies anywhere.

One request does leave our domain, and it is worth knowing about before a visitor's data protection officer asks. Photos and videos are held in our file storage, which Supabase runs for us in Frankfurt, and the visitor's browser fetches them from there directly, from a host of the form <project-ref>.supabase.co. So a page of yours that embeds the widget, and shows a testimonial with a photo or a video, does make the visitor's browser connect to that host, which sees their IP address and user agent like any other web request. The signed link identifies the file and expires within an hour; it carries nothing about the visitor, and the host sets no cookie.

Two practical consequences. If you run a Content Security Policy on your site, allow <project-ref>.supabase.co in img-src and media-src, and this site's domain in script-src and connect-src. And if your own privacy policy lists the hosts your pages contact, that one belongs on the list. It is not a tracker, but it is a request, and calling it nothing would be an overclaim.

We use four sub-processors, and this is the honest version of that list:

All four are US companies operating EU infrastructure. If your compliance bar requires EU-owned vendors end to end, Laudiance is not there yet, and we would rather tell you that than pretend otherwise.

Laudianceitself never stores raw IP addresses: for rate limiting we keep only HMAC digests computed with a key that rotates daily. However, Vercel (our hosting provider) and Supabase retain client IP addresses in their own infrastructure logs for their operational purposes, under their retention policies. We state this plainly because "no IPs anywhere" would be an overclaim.

We tell workspace owners how many people opened their form, so they can tell the difference between nobody seeing it and nobody filling it in. That count is a single running total per form per day. There is no row per visitor, no visitor identifier, no profile and nothing that can be linked back to a person — so a form view is not personal data, and it is not part of the export or the deletion routine because there is nothing personal in it to export or delete.

The counting happens on our own server while the page is being served. It sets no cookie and writes nothing to the visitor's browser, so the section above stays true exactly as written. To avoid counting one person five times, we use the same daily-rotating HMAC of the IP described above as a short-lived marker in the rate-limiting table: it says "this form was already counted for this digest in the last 30 minutes", it expires by itself, and it is never written into the counter. Requests from bots, from link previews (the request a chat app makes when someone pastes a link) and from the owner's own browser are recognised from request headers and left out.

Email contact@laudiance.com and a human will answer. It is the same address as the imprint, the privacy policy and the DPA: one address for the whole site.