Privacy and GDPR
Range Trust is self-hosted by design: reviews live in your database, widgets render from your server, and your visitors' browsers never contact a review platform, a widget CDN, or Rangefront Labs. That makes the GDPR story short.
Where data lives
Four tables in your WordPress database: sources, reviews, widgets and invitations. Review data arrives either from platform APIs (requested server-side with your credentials), from files you import, or from your own funnel.
Avatar caching
Platform reviews come with avatar URLs pointing at the platform's CDN. With Settings → Privacy → Cache reviewer avatars locally (on by default), avatars are copied into your uploads directory and served from your domain; visitors never make third-party requests, so no consent banner entry is needed for displaying reviews.
Personal data in the funnel
Funnel submissions store the reviewer's name, rating, text and (optionally) email; the email is never displayed, only used for moderation context. Invitations store the recipient's email, name and delivery status.
Both are wired into WordPress's built-in tools under Tools → Export Personal Data and Erase Personal Data: searching by email exports or erases that person's invitations and funnel submissions.
What phones home
- Licence activation/validation: your licence key and site host go to the Lemon Squeezy licence API.
- Update checks: your plugin version and site host go to the Range Trust update server.
That is the complete list. No analytics, no telemetry, no tracking pixels in invitation emails (opens are counted by funnel visits).
AI features
Off unless you add your own API key; see AI for exactly what is sent and when.
Uninstall
Deleting the plugin removes its settings. The review tables are only dropped if Delete all Range Trust data when the plugin is uninstalled was ticked in Settings first.