Privacy policy
How plogins.com handles contact, checkout, analytics, support and scanner data.
Last updated:
Controller
WPPoland, a sole proprietorship of Mariusz Szatkowski, ul. Starowiejska 16/2, 81-356 Gdynia, Poland, NIP 7393037445, is the controller for personal data collected on plogins.com. Contact for any data protection matter: [email protected]. We are not required to appoint a data protection officer and have not appointed one; requests go to the address above.
What we process, why, and on what legal basis
Correspondence you send us (email address, message content, any support context) is processed to answer you, on the basis of our legitimate interest in responding to enquiries, Art. 6(1)(f) GDPR, or to perform a contract where you are a customer, Art. 6(1)(b). PRO licence data (name, licence email, licence key, site domain, country, licence status) is processed to deliver updates and support under the licence, Art. 6(1)(b), and, where we invoice you ourselves, to meet accounting duties, Art. 6(1)(c). URLs submitted to public tools such as the tracking scanner are processed to produce the requested result, Art. 6(1)(b). Server logs kept by our hosting provider are processed for security and availability, Art. 6(1)(f).
What we measure on this site
We count clicks on plugin cards, PRO buy buttons and service enquiry links, to see which plugins people look at and which pages lead to a purchase. We do this with our own click counter. It sets no cookie, writes nothing to your browser storage and assigns you no identifier. On a click, the page sends the event name, the plugin and plan or the service type, the page path (for plugin and buy clicks only its language prefix) and, if you arrived from a link inside one of our plugins in wp-admin, the source wp-admin and that plugin's name to wppoland.com/api/track, an endpoint we operate. It records the event without your IP address or browser details in a Cloudflare Analytics Engine dataset, where Cloudflare keeps it for three months. If your browser sends Do Not Track or Global Privacy Control, the counter sends nothing and the endpoint discards anything that still arrives.
Click counting, legal basis and how to object
The legal basis for the click counter is our legitimate interest in knowing which pages and plugins are used, Art. 6(1)(f) GDPR. You may object at any time under Art. 21(1) GDPR by writing to [email protected], or switch on Do Not Track or Global Privacy Control in your browser. We do not sell or share personal data, use no advertising identifiers and do not track you across sites.
Data we receive from Freemius and WP Desk
Freemius, Inc. sells PRO licences as reseller and merchant of record. For checkout, payment, tax and invoice data it is a separate controller, not our processor, and its own privacy policy applies. After a purchase Freemius passes us your name, email address, licence, site domain and country. We do not collect these from you directly. We use them to deliver updates and support under the licence, Art. 6(1)(b) GDPR, and keep them as described below. WP Desk is in the same position for the products it sells, Sieve PRO and Customs PRO: it is a separate controller for its checkout and passes us only what we need to provide updates and support.
Tracking scanner
When you run the tracking scanner, Cloudflare Turnstile first checks that the request comes from a person; for that check Cloudflare receives your IP address. For rate limiting the scanner stores a hash of your IP address, never the address itself, uses it for one hour and deletes older hashes with the next scan request. It keeps the scanned hostname, the grade and the findings, with no link to you, to publish aggregate statistics. The legal basis is our legitimate interest in preventing abuse and in publishing those statistics, Art. 6(1)(f) GDPR.
How long we keep it
Correspondence is kept while the matter is open and for up to 24 months afterwards, so we can follow up on a recurring issue. Data on invoices and other accounting records is kept until the tax liability becomes time-barred, which under Polish law is 5 years from the end of the calendar year in which the tax payment fell due (Art. 86 § 1 and Art. 70 § 1 of the Polish Tax Ordinance). Licence records are kept for the life of the licence and for as long as a claim under it can be made. Vulnerability reports are kept indefinitely in an internal log, because the history of a fix is itself a security record.
Who else sees the data
We use a small number of processors, each named with its role in the subprocessors document: our hosting and network provider, the platform hosting our public source repositories and issue trackers, and our mail provider Smarthost sp. z o.o. Freemius and WP Desk are not our processors: they sell PRO licences as separate controllers, as described above. Payment card data is handled by the seller and its payment partners and never reaches us. If you choose to post on a WordPress.org support forum, WordPress.org, run by the WordPress Foundation, is an independent controller of your forum account and posts under its own privacy policy. We disclose data to public authorities only where the law obliges us to.
Transfers outside the EEA
Some of these providers are established outside the European Economic Area or process data there. Where that happens, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision, together with the provider's own supplementary measures. You can ask us at [email protected] which mechanism applies to a specific provider and we will tell you.
Your rights
You have the right of access, rectification, erasure, restriction, data portability, and objection to processing based on our legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of what happened before. Write to [email protected]; we answer without undue delay and within one month, and we will say so if a complex request needs the extension the GDPR allows. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority where you live or work.
No automated decision-making
We take no decisions about you by automated means alone and we do not profile you. Providing data is voluntary, but without an email address we cannot answer a message, and without licence data we cannot deliver PRO updates or support.
This document is product information and does not replace individual legal advice.