How it works
Automatic collection, step by step
You give the feed, we read it
The address of a feed the platform itself publishes for this purpose. Nothing is discovered, guessed, or crawled around.
It arrives in Pending
Automatic collection is automatic arrival, not automatic publication. Every one still waits for you.
Duplicates are not brought twice
A review already held is recognized and skipped.
Orders straight from your store
Stripe, Shopify, WooCommerce and Lemon Squeezy can each send every paid order to a receiving address of your own, from the store's own webhook settings — no server and no Zap. The dashboard makes the address, shows it once, and says step by step where it goes in that store and which events to check; you paste back the store's signing secret. Each order then goes through your rules for asking after a purchase, exactly as one sent through the API does.
Checked before it is read
Every delivery is checked against the store's own signature on the message as it arrived, compared in constant time; a Stripe message more than five minutes old is refused. A message that fails is read no further, and the dashboard says when the last one arrived and what came of it — including a signature that did not match.
The lift test, and refunds
An order that carries the reference your lift test handed the buyer's browser is counted as a purchase in its group. A refund of the whole order takes it back out; a partial refund leaves it counted. An order in another currency than your lift test's figures is counted with its amount left out, because nothing is converted.
Safe by design
The rule that makes it safe to have
Clear boundaries
What it will not do
Every capability page ends with this list. It is the part that says what you are actually buying.
- It will not crawl a website.
- It will not publish anything without you.
- It will not connect to an account you have on somebody else's service.
- It will not enter your Stripe, Shopify, WooCommerce or Lemon Squeezy account, ask for its API key, or call it. The store sends; only its signing secret is kept, never shown again, and of each order only the email address, the name, the amount and its currency, the order's id and the lift test's reference are used.
- It will not act on a message whose signature does not match, or on events other than paid orders and refunds. Anything else a store sends is answered and set aside, so the store does not retry it.
- It will not add up several partial refunds on Shopify, which reports each refund on its own: a refund takes a purchase out of the lift test only when it covers the whole order.
Where it lives in the code: lib/feeds.ts · components/FeedsPanel.tsx · lib/store-hooks-rules.ts · lib/store-hooks.ts · lib/store-hooks-terms.ts · lib/order-intake.ts · app/api/in/[id]/route.ts · app/api/store-hooks/route.ts · components/StoreConnect.tsx · scripts/store-hooks.mjs
Questions
Asked about this
From Help, where every answer is written from the product as it runs.
Where is the consent kept?
Beside the testimonial: its recorded permission sentence, scopes, date and source. For a customer submission, the sentence records what the person agreed to here. Imports, connected feeds and API additions carry an account holder statement instead; they do not claim the writer agreed here. These records are included in your CSV export.
Which permissions does Hazelsong actually enforce?
There are four separate choices: your website, public pages hosted by Hazelsong, social media, and ads or printed material. Website widgets and the testimonial API require website permission; public hosted walls require hosted permission, plus publication enabled by a verified project owner. Social images and clips require social permission. Approval alone grants none of these, and missing scopes grant no permission. Ads and printed material are made outside Hazelsong, so that answer is recorded for you to honor rather than enforced by an advertising channel here.
They checked off website but not ads. What happens if I use it in an ad?
Nothing here stops you, because nothing here places ads. What the product does is keep the answer where you can find it: the consent sentence on the card names only the places that person allowed, and your CSV export lists what they checked off — which is the form you would want it in if they, or anybody else, ever asked what they had agreed to. The decision, and the responsibility for it, are yours. Hazelsong checks the recorded website, hosted-page and social permissions when serving those respective channels.
Does the API respect the website permission too?
Yes, and that is on purpose: an integration reading your testimonials is a publishing pipe. /api/v1/testimonials filters on website permission and says in its own answer that it did.
This is running now
Open a project and use it. Nothing on this page is a roadmap.