Your dashboard is yours.

Widgy Start ("Widgy", "we", "us") is operated by De Wilde ICT Solutions, based in Ede, the Netherlands, registered with the Dutch Chamber of Commerce under number 98600311. De Wilde ICT Solutions is the data controller for the personal data described in this policy.

For privacy questions or requests, open Widgy and use Support → Privacy or data request. This creates a private service ticket so we can verify and handle your request safely.

When you choose to connect Search Console Insights, Widgy uses Google OAuth and requests only the read-only Search Console scope. The connection lets Widgy read the Search Console properties available to your Google account and historical Search Analytics information for the property you choose.

The Google data Widgy may access and display consists of the property address and permission level, date range, search queries, clicks, impressions, click-through rate and average position. Widgy does not receive your Google password, cannot change Search Console properties or settings, and does not request access to Gmail, Google Drive, Google Analytics or unrelated Google account data.

We use this information only to provide the Search Console Insights feature to the connected Widgy account. We do not sell it, use it for advertising, build advertising profiles from it or share it with other customers. Google receives the OAuth and API requests needed to authorize and provide the data under Google's own terms and privacy practices.

We keep personal data only for as long as needed for the purpose for which it was collected, for security, or to meet legal obligations. In practice:

• Local dashboard data: remains in your browser until you delete it, reset Widgy or clear browser storage.
• Accounts and cloud layouts: remain while your account is active. Following a valid deletion request, active records are removed unless retention is legally required; residual backup copies may remain for a limited backup cycle.
• Activation links: expire after 48 hours. Password-reset links expire after one hour and are deleted after use.
• Remembered-login tokens: normally expire after 30 days or sooner when you log out or change your password.
• Google Search Console connection: encrypted OAuth tokens remain until you disconnect Google, delete your Widgy account or the connection becomes unusable. Cached Search Console responses normally expire after six hours and never remain longer than 24 hours; disconnecting clears them immediately.
• Marine-life photos: are processed transiently for the requested analysis and are not retained in Widgy widget, layout, log, cache or backup storage. Saved text identifications remain with the local or cloud layout until you clear them.
• Food photos and portion context: are processed transiently for the requested analysis and are not retained in Widgy widget, layout, log, cache or backup storage. Only explicitly saved structured text estimates remain with the local or cloud layout until you clear them.
• Support tickets and ratings: are retained as needed to handle the request, improve support and document agreements. You may ask us to delete or anonymise them where no legal reason requires retention.
• Financial records after payments launch: will generally be retained for the period required by Dutch tax and accounting law.
• Security and audit records: are retained only as long as reasonably needed to investigate abuse, maintain integrity and demonstrate security actions.

We do not sell personal data. We share data only where needed to operate Widgy, comply with law or protect the service. This may include our hosting provider, email-delivery provider, future payment provider, Google when you connect Search Console Insights, Father & Son TCG when you use its card widget, and other API providers used by widgets you choose to activate.

Each provider receives only the information reasonably needed for its task. Where a provider processes personal data for us, we seek appropriate contractual and security safeguards. Some API providers may act as independent controllers under their own privacy terms, especially when you connect your own external account or service.

If personal data is transferred outside the European Economic Area, we will use an approved transfer mechanism where required, such as an adequacy decision or standard contractual clauses.

Widgy uses measures designed to protect personal data, including password hashing, secure and HttpOnly cookies, session renewal, access controls, CSRF protection, rate limiting, server-side API credentials, AES-256-GCM encryption for supported connection tokens, audit logging, protected storage paths and encrypted HTTPS transport. No internet service can guarantee absolute security, but we review and improve these measures as Widgy develops.

If we discover a personal-data breach that creates a risk to people, we will assess it and notify the Dutch supervisory authority and affected users when legally required.

Depending on the circumstances, you may ask us to:

Submit a request through Support → Privacy or data request in Widgy. We may ask for reasonable information to verify your identity. We aim to respond within the period required by applicable law.

You also have the right to complain to the Autoriteit Persoonsgegevens, the Dutch data-protection authority.

Widgy is not directed at children under 16 and we do not knowingly collect their personal data. A parent or guardian who believes a child has provided personal data should contact us through the Service Desk.

We may update this policy when Widgy changes, when new providers or paid features are introduced, or when legal requirements change. We will publish the updated date on this page and provide an additional notice when a change materially affects registered users.