Proofloop - Google Review & Testimonial Funnel

Reviews do not arrive on their own. They are asked for.

Every business owner knows the good customers stay quiet and the angry one writes 400 words the same evening. The fix is not another form on a contact page — it is a loop: ask, collect, route, display, and let the display pull in the next request.

Proofloop is that loop, end to end. Upload a customer list or put a QR code on the table. The customer opens one page, no account needed, gives a star rating, then writes a few lines or records a video straight from the browser. From there a routing engine decides where it goes: happy customers are offered the Google review form, customers who would rather not use Google still leave a testimonial you own, and unhappy customers get a private channel plus an instant alert to the owner. Everything collected is moderated, tagged, and shown through embeddable widgets on any website.

It works on day one, with no Google credentials at all

This matters more than it sounds. Sending a customer to a Google review form is a public deep link built from a Place ID — no API, no OAuth, no approval, nothing to apply for. Connect a Google Places key later and you can import your existing rating; connect Business Profile OAuth later still and you can sync and reply from the dashboard. Every tier above the first is optional, and nothing is blocked while you wait for Google to answer.

Video testimonials without ffmpeg

Video is compressed in the customer's browser while they record. Recording, upload, playback, moderation and publishing all work with no ffmpeg anywhere on the server, which is why this runs on ordinary shared hosting. If your host happens to have ffmpeg, Proofloop uses it for one extra normalisation pass. If it never does, you lose nothing you can see.

Who buys this

• Agencies doing reputation management — one installation, one workspace per client, client-viewer accounts that see their own data and nothing else, white-label branding and a monthly PDF report you can send under your own logo.
• Local businesses — clinics, garages, restaurants, salons, law firms, dealerships, contractors. Anyone whose next customer reads the rating before they call.
• Anyone building a SaaS without writing it — multi-tenant, plans and quotas, Stripe, PayPal and manual bank transfer are already in the box.

What it does not do

Stated up front, because an honest boundary is worth more than a surprise after purchase.

• It does not scrape Google, G2 or anyone else. No third-party scraper API, no headless browser against Google properties. Imports use official endpoints or structured manual entry.
• It is not a public review directory. It collects proof for your own business, it does not host a Trustpilot-style marketplace.
• Owners cannot edit a customer's words — only hide, tag, or pull a highlight quote. That is deliberate: it is what keeps the testimonials worth showing.
• Review-gating is available but off by default and behind an explicit warning, because it conflicts with Google's policy and with review regulation in several countries. The default mode offers everyone the public route.
• Schema.org review markup is emitted only for first-party proof you collected, never for imported Google reviews — that would break Google's own guidelines.

Built with

Laravel 12, Vue 3 with Inertia, MySQL, Tailwind CSS. Full source code, a complete offline HTML manual in five languages, and a documented upgrade procedure. The embeddable widget is a single async script with an iframe fallback for clients whose CMS or Content-Security-Policy forbids third-party JavaScript.

Live demo

The demo is seeded with a small agency running three clients, and it resets every few hours. Four roles are available on the sign-in screen — agency owner, account manager, client viewer, and platform administrator — so you can see exactly what each one is allowed to see. Outgoing email and SMS are disabled in the demo; everything else is live.

Changelog

Version 1.0.0 — Initial release.

Features

• Request campaigns — import contacts from CSV or XLSX with column mapping, tag and segment them, then send by email (your own SMTP or ESP), SMS and WhatsApp (your own Twilio), or a link you copy yourself. One-off sends or multi-step sequences that stop automatically the moment the customer leaves proof.
• Sending that does not get you blocked — per-hour and per-day throttles, quiet-hours windows in the recipient's own time, a cost estimator before you send, a hard monthly cap per tenant, an emergency stop, and a permanent suppression list for unsubscribes, bounces and complaints that no later import can overwrite. A domain verification wizard (SPF/DKIM) and a passing test send are required before the first campaign can run.
• Collection page — no account, no login, mobile first. Big one-tap star rating, then 2-4 guided questions so you get a structured testimonial instead of "great, thanks". Written, video, audio, file upload and supporting photos. Reachable by unique per-contact link, a public per-location link, a downloadable QR code (PNG/SVG for tables, receipts and cards), or an NFC tag.
• Routing engine — rules on score, segment, location, language and campaign source decide the destination. The default "ask everyone" mode never blocks anyone from the public route; it simply offers a private channel first to the customer who is unhappy. If a destination fails or the customer declines it, the proof is still kept as your own testimonial — there is no dead end. A simulator shows what a 3-star customer at a given location will actually see.
• Destinations — Google via the official review deep link (no API needed), Facebook, Trustpilot, G2, Capterra and any custom URL, the App Store and Play Store, your own testimonial library, or a private feedback form that alerts the owner instantly.
• Import what you already have — your Google rating and reviews (Places API key, or full sync through Business Profile OAuth), plus CSV import and structured manual entry with source attribution for G2, Trustpilot, Facebook and store reviews. No scraping anywhere.
• Moderation and proof library — approve, hide or request a revision with a reason; tag by product, service, location, team and sentiment; pull a highlight quote out of a long testimonial; search by any combination of score, format, tag, source and date; act in bulk. Consent to publish is stored with a timestamp and IP in an audit log.
• Widgets for any site — masonry grid wall, carousel, compact rating badge, popup, floating bar, and a hosted testimonial page. One async <script> tag, an iframe fallback that resizes itself, and a WordPress shortcode. Light, dark or automatic theme, brand colours, and filters so a widget shows only the ratings, tags, formats or locations you choose. Built to a strict performance budget: lazy loaded, no remote fonts, no CDN.
• Export testimonials as social images — turn any approved quote into a ready-to-post graphic for Instagram, LinkedIn or X.
• Reply and monitor (optional, needs Google Business Profile access) — get notified when a new Google review lands, reply from the dashboard, draft replies with your own OpenAI or Anthropic key, and work every location from one queue. Until Google approves you, the interface shows a "waiting for approval" guide rather than an error.
• Agency mode — organisation to workspace (client) to location to collection page. Roles for owner, admin, member and client-viewer, where a client sees only their own data and the agency's other clients are invisible. White-label logo, colours, custom domain and custom sending address.
• Plans, quotas and billing — limits on workspaces, locations, contacts, monthly sends, monthly videos and widget views, enforced inside a locked transaction so quota cannot be raced. Stripe, PayPal and a full manual bank-transfer flow for markets where cards are not the norm, plus coupons and audited impersonation for support.
• White-label monthly reports — new proof, average rating, trend, campaign response rate and highlighted testimonials, sent automatically to the client's inbox under your branding, with an option to skip a month in which nothing changed. CSV export for proof, contacts and send logs.
• REST API and webhooks — read proof, create contacts and trigger campaigns; subscribe to proof.created, proof.approved, review.received and campaign.completed.
• Five languages including RTL — English, Arabic, Hindi, Indonesian and Brazilian Portuguese, across the app, the collection page and the documentation. Arabic mirrors the layout properly.
• Ready to run — a web installer that checks the server, creates the schema and your first account, prints the exact cron line for your control panel, then locks itself permanently. Light and dark themes, GDPR-minded consent and audit logging, and an offline manual covering installation, messaging, routing, widgets, the Google tiers and upgrading.

Requirements

• PHP 8.2 or newer
• MySQL 8.0+ or MariaDB 10.6+
• PHP extensions: openssl, pdo, pdo_mysql, mbstring, tokenizer, ctype, json, xml, dom, filter, hash, curl — all standard on shared hosting
• Write access to storage/, bootstrap/cache/ and the application folder
• One cron entry running once a minute (everything scheduled depends on it)
• ffmpeg is not required. Video testimonials are compressed in the customer's browser, so recording, upload, playback and publishing all work without it
• Optional, only for the features that use them: your own SMTP or email provider for campaigns, a Twilio account for SMS and WhatsApp, a Google Places API key to import your rating, Google Business Profile OAuth to sync and reply
• Composer dependencies and the compiled front-end assets are bundled. Node.js is only needed if you want to rebuild the assets yourself

Instructions

1. Create a database. In cPanel open MySQL Databases, create a database and a user, then — the step people miss — scroll to "Add User To Database" and grant ALL PRIVILEGES.
2. Upload the files. Extract the archive and upload the contents of Main Files to the folder your domain serves. If your host lets you point the domain at a subfolder, point it at public/. If it does not, the included .htaccess handles it.
3. Open the installer at https://yourdomain.com/install. The first screen checks the server and says exactly where to fix anything that is red.
4. Enter the database details. The host is almost always localhost or 127.0.0.1, not your domain name. The connection is tested before anything is written.
5. Create the tables and your account — one button each. The schema step is safe to repeat if the page times out.
6. Add the cron job using the command the installer generates for your panel, then press Finish installation. The installer locks itself permanently at that point. * * * * * cd /home/acct/public_html && php artisan schedule:run >> /dev/null 2>&1
7. Back up your .env file. It holds the APP_KEY that encrypts every credential you will later store. If that key is lost, every integration has to be reconnected by hand.
8. Connect your sending channel. Settings → Messaging: your SMTP or email provider, and Twilio if you want SMS or WhatsApp. Run the test send and the domain verification wizard before your first campaign.
9. Add a client and a location, paste the Google Place ID (the manual explains how to find it in two minutes), and your collection page is live. Print the QR code or send your first campaign.
10. Embed the proof. Build a widget, copy the script tag — or the iframe fallback, or the WordPress shortcode — and paste it where the testimonials should appear.

The full offline manual is in Documentation/index.html: installation, messaging and deliverability, the routing engine, widgets, the three Google tiers, compliance notes and the upgrade procedure — in five languages.