Privacy policy

Version of 14.10.2026

Who processes the data

The Widgemate website and Kommo widgets belong to sole proprietor (FOP) Dmytro Oleksandrovych Kariev (ФОП Карєв Дмитро Олександрович) ("we"). For data questions write to [email protected].

What data we receive

On the website

• Form data: a contact (phone, Telegram or email), name, company, Kommo account ID and task description – only what you enter.
• Technical visit data: a random visitor identifier in a cookie, pages you viewed, the landing page, the traffic source (referrer, UTM tags, ad click identifier), the page language.
• If you accepted analytics and ad cookies – data collected by Google Analytics, Google Tag Manager, Meta Pixel or Microsoft Clarity under their own rules.

In the widgets

• Kommo account data: account ID and address, Kommo plan and licence term, the user list with roles, names, emails and phones of administrators.
• Widget settings and the Kommo API access token you pasted into the settings.
• Data a specific widget needs to work. For example, UA Payments receives statements of connected accounts and payer data, and links payments to leads.
• Widget payment data: amount, period, status. We never receive card data – monobank processes the payment.

Why

• To run the widget in your account and manage access, the trial and payments.
• To answer your request or support message.
• To understand where visitors and clients come from and to improve the website and widgets.
• To inform you about access status, payments and widget changes.

Cookies

Necessary website cookies (session, form protection, your cookie choice) and our own visit records (visitor identifier, landing page, source) always work: without them we cannot link a request to its source. Third-party analytics and ad tags load only after your consent. You can change your choice by clearing the website's cookies in your browser.

Data from your Google account

The "Google Docs by Widgemate" widget (its private version is called "Google Docs") asks Google for three permissions only: openid, email and drive.file. With them we see the email address of the connected Google account and only the Google Drive files and folders you picked yourself in Google's file picker or the widget created. The widget does not see the rest of your Drive, your mail, contacts or calendar.

• What we receive: the Google account email address; Google access tokens; IDs and names of the templates, folders and documents you picked or the widget created.
• How we use it: only to do what you set up in the widget – copy a template, fill in Kommo lead data, put the document into the right folder, add a seal, give you a PDF or another format to view and download, and share a document or folder with the people you allowed. We do not keep document contents: files pass through our server only while you view or download them.
• How we store it: Google tokens are encrypted in our database and never reach the browser; only the widget's server can use them.
• Who we share it with: no one. Data from Google is not sold, not used for advertising and not transferred to third parties, unless the law requires it.
• How long we keep it and how to delete it: tokens are deleted as soon as you click "Disconnect Google" in the widget or remove the widget; document records (IDs and names) are kept while the widget is installed. You can also revoke access at Google: myaccount.google.com/permissions. The documents themselves stay in your Google Drive.

Widgemate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data from Facebook, Instagram and your Meta ad account

The "Facebook Conversions" widget asks you to log in with Facebook (the Meta app "Widgemate") to: send Kommo lead events to the Meta pixel you choose through the Conversions API; list and create the pixels of your ad account; tell whether a person's first message to your Page in Direct or Messenger came from an ad; count the cost per lead from your ad account's spend.

• What we receive: the name and profile picture of the person who logged in and the list of permissions given; a Meta access token; the names and IDs of the Facebook Pages, Instagram accounts, ad accounts and pixels you chose; spend per ad; for Direct and Messenger messages – only the sender's page-scoped ID, the time, the "from an ad" flag and the ad ID; the sender's profile name is read only to check it against the Kommo lead's contact and to show it in the list of conversations when you reply from the widget, and is not stored. The widget sends messages as your Page only when you turned the auto-reply on or wrote a reply in the widget yourself. We do not store message text.
• What we send to Meta: lead events (event name, time, value and currency) with the contact data Meta needs for matching – email, phone, name, city, country – hashed with SHA-256 only, and Meta's click and lead IDs when the lead has them.
• How we use it: only for what you set up in the widget: events to the pixel, the "Ad / Organic" mark, campaign and ad in the Kommo lead, cost-per-lead analytics on the widget page.
• How we store it: Meta access tokens and Page tokens are encrypted in our database and never reach the browser.
• Who we share it with: no one. Data from Meta is not sold or passed to third parties, except where the law requires it.
• How long we keep it and how to delete it: the journal of sent events – 90 days; records of Direct and Messenger conversation starts – up to 12 months; access tokens, Pages and their tokens are deleted as soon as you click "Disconnect" on the widget's Meta tab or remove the widget. How to ask for deletion – see Data deletion.

Who we share data with

• Kommo – the widget works inside your account through the Kommo API.
• monobank – accepting payments for widgets.
• Banks and services you connected in a widget yourself (for example, monobank, PrivatBank, NovaPay in UA Payments).
• Telegram – we receive a notice about a new request without your contact details.
• Google – the "Google Docs by Widgemate" widget works with your Google Drive through Google APIs on your behalf.
• Meta – the "Facebook Conversions" widget sends events to your pixel and reads your Page and ad account data through the Meta APIs on your behalf.
• Google, Meta, Microsoft – only with your consent to the related cookies.
• The hosting provider whose servers run the service.

We do not sell personal data.

How long we keep it

Account data and settings – while the widget is installed, and afterwards as long as needed for payment records. Bank payments in UA Payments, payer data included, are deleted after 12 months, payment links after 60 days. Visit data – up to 3 years after the last visit. Requests – while needed to work with you.

Your rights

You may ask for access to your data, its correction or deletion, withdraw your cookie consent or object to processing – write to [email protected]. You may also contact the Ukrainian Parliament Commissioner for Human Rights.

Changes

A new version is published on this page with its date.