Privacy Policy

This Privacy Policy ("Policy") describes how the operator of this platform ("Company", "we", "us", or "our") collects, uses, discloses, retains, and safeguards information when you access or use the web-based dashboard, WordPress agent plugin, application programming interfaces (APIs), command-line tools, mobile applications (if any), documentation, websites, and all related software, features, and functionality (collectively, the "Services"). This Policy applies to all users of the Services, including account holders, team members, and visitors to our public-facing pages. By accessing or using the Services, you acknowledge that you have read, understood, and consent to the practices described in this Policy. If you do not agree with any part of this Policy, you must immediately cease all use of the Services.

1. Definitions

"Personal Data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable natural person or household. "Controller" means the entity that determines the purposes and means of processing Personal Data. "Processor" means an entity that processes Personal Data on behalf of a Controller. "Account Data" means information associated with your user account, workspace, team, and subscription. "Site Data" means technical, configuration, and operational data collected from or about your Connected Sites through the agent plugin or API. "Connected Site" means any WordPress website or application connected to the Services through the agent plugin or API. "Usage Data" means information about how you interact with and use the Services. "Aggregate Data" means data that has been combined, de-identified, or anonymized such that it can no longer reasonably be used to identify a specific individual. "Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

2. Our Role as Controller and Processor

With respect to Account Data, Usage Data, and data we collect directly from you, we act as the Controller. With respect to data stored on or transmitted from your Connected Sites (including data about your end users, customers, or visitors), you are the Controller and we act as a Processor, processing such data solely on your behalf and in accordance with your instructions as expressed through your use of the Services. You are solely responsible for ensuring that you have all necessary legal bases, consents, and authorizations to transmit data from your Connected Sites to the Services, and for the lawfulness of all processing you direct us to perform. We shall not be liable for any failure by you to obtain required consents or comply with applicable data protection laws with respect to your Connected Sites.

3. Information We Collect

We collect the following categories of information:

• Account and Registration Data: Full name, email address, password (stored as a cryptographic hash; we never store plaintext passwords), two-factor authentication enrollment data and recovery codes, user role and permissions within teams, account preferences, notification settings, workspace name, and team membership information.
• Billing and Payment Data: Subscription plan, billing cycle, invoice history, payment method type, last four digits of payment card, card expiration date, billing address, and transaction history. Full payment card numbers and sensitive payment credentials are processed directly by our third-party payment processor (currently Stripe, Inc.) and are never stored on our servers.
• Site Data: Domain names, site URLs, server IP addresses, hosting provider information, WordPress core version, PHP version and configuration, web server type and version, database version, installed plugin names and versions, installed theme names and versions, plugin and theme update availability, active/inactive status of plugins and themes, site health scores, uptime monitoring data, response time metrics, SSL/TLS certificate status and expiration, file integrity check results (core file verification), database optimization metrics, scheduled cron job information, maintenance mode status, security configuration toggles, debug log contents, site screenshots, backup metadata (size, date, status), user accounts on Connected Sites (usernames, email addresses, roles), and any other technical or configuration data transmitted by the agent plugin.
• Usage Data: IP addresses, browser type and version, device type and identifiers, operating system and version, screen resolution, referral URLs, landing pages, pages and features accessed within the Services, actions performed (including site management actions such as updates, backups, and configuration changes), timestamps and session duration, click patterns, navigation paths, error messages and crash reports, API request logs, feature usage frequency, and performance metrics.
• Log and Audit Data: Server access logs, application error logs, authentication logs (login attempts, successes, and failures), action audit trails (recording which user performed which action on which site and when), security event logs, and administrative activity logs.
• Communication and Support Data: Support ticket content, email correspondence, chat messages, feedback submissions, survey responses, attachments, and associated metadata including timestamps and resolution status.
• Device and Network Data: Hardware identifiers, network connection type, ISP information, time zone, language preferences, and geolocation data derived from IP address (city/region level; we do not collect precise GPS coordinates).

4. Sources of Data Collection

We collect data from the following sources: (a) directly from you when you register an account, configure your profile, set up a team, manage your subscription, contact support, or otherwise interact with the Services; (b) automatically from your Connected Sites through the WordPress agent plugin, which periodically transmits site configuration, health, and status data to the Services via authenticated, signed REST API requests; (c) automatically through cookies, session identifiers, web beacons, pixels, and similar tracking technologies embedded in the Services; (d) automatically from server logs and application monitoring systems that record requests, errors, performance metrics, and security events; (e) from third-party service providers that support payment processing, email delivery, hosting, infrastructure, analytics, error tracking, and security monitoring; and (f) from publicly available sources where such information supplements or verifies data you have provided.

5. How We Use Your Data

We use collected data for the following purposes:

• Service Delivery: To provide, operate, maintain, and deliver the core functionality of the Services, including site management, monitoring, updates, backups, security scans, user management on Connected Sites, and all other features accessible through the dashboard or API.
• Authentication and Security: To verify your identity, manage user sessions, enforce two-factor authentication, detect and prevent unauthorized access, monitor for suspicious activity, enforce rate limits, validate signed API requests, protect against fraud and abuse, and maintain the security and integrity of the Services.
• Account Management: To manage your account, team memberships, role assignments, permissions, preferences, and subscription status.
• Billing and Payments: To process subscriptions, generate invoices, collect payments, manage plan upgrades and downgrades, handle refund requests, and communicate about billing matters.
• Communications: To send transactional emails (account verification, password resets, billing receipts, security alerts), service notifications (downtime alerts, update notifications, backup completion notices), and, where permitted, promotional communications about new features or service improvements.
• Audit and Compliance: To generate and maintain audit logs, activity records, and compliance documentation that track actions performed through the Services for accountability, troubleshooting, and regulatory purposes.
• Improvement and Development: To analyze usage patterns, identify bugs, diagnose technical issues, measure feature adoption, conduct A/B testing, develop new features, and improve the overall reliability, performance, security, and user experience of the Services.
• Analytics: To generate aggregate, anonymized, or de-identified analytics and reports for internal business purposes, including capacity planning, infrastructure optimization, and business intelligence.
• Legal and Regulatory: To comply with applicable laws, regulations, legal processes, and governmental requests; to enforce our Terms of Service, Acceptable Use Policy, and other agreements; to establish, exercise, or defend legal claims; and to protect our rights, property, and safety, and that of our users and the public.
• Safety and Abuse Prevention: To detect, investigate, and prevent violations of our Terms of Service and Acceptable Use Policy, including but not limited to unauthorized access, malicious activity, spam, and abuse of the Services.

6. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

Where applicable data protection law requires a legal basis for processing Personal Data, we rely on one or more of the following grounds: (a) Consent: Where you have given clear, informed, and unambiguous consent to the processing of your Personal Data for one or more specific purposes. You may withdraw consent at any time, though withdrawal does not affect the lawfulness of processing performed prior to withdrawal. (b) Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party (including our Terms of Service) or to take steps at your request prior to entering into a contract. (c) Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject, including tax, accounting, anti-money laundering, and regulatory reporting obligations. (d) Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include operating and improving the Services, ensuring security, preventing fraud, and conducting analytics. (e) Vital Interests: Where processing is necessary to protect the vital interests of any natural person. (f) Public Interest: Where processing is necessary for the performance of a task carried out in the public interest, to the extent applicable.

7. Cookies, Tracking Technologies, and Automated Data Collection

We use the following types of cookies and similar technologies:

• Strictly Necessary Cookies: Essential for the operation of the Services, including authentication session cookies, CSRF protection tokens, and security cookies. These cannot be disabled without impairing core functionality.
• Functional Cookies: Used to remember your preferences, settings, language, and display options to provide a personalized experience.
• Analytics Cookies: Used to collect information about how you use the Services, including pages visited, features used, and errors encountered, to help us improve the Services. This data may be collected by third-party analytics providers.
• Performance Cookies: Used to monitor and measure the performance and reliability of the Services, including page load times, error rates, and server response times.

You may manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, but doing so may impair your ability to use certain features of the Services, particularly authentication and session management. We honor Do Not Track (DNT) signals where technically feasible, but note that there is no universally accepted standard for DNT signal interpretation. The Services do not use cookies or tracking technologies for third-party advertising purposes.

8. Disclosure of Data

We do not sell, rent, or trade your Personal Data to third parties for their marketing purposes. We may disclose your data in the following circumstances:

• Service Providers and Processors: We engage third-party service providers who perform functions on our behalf, including but not limited to: cloud hosting and infrastructure providers, payment processors (Stripe, Inc.), email delivery services, error monitoring and logging services, analytics providers, customer support platforms, backup storage providers, and security monitoring services. These providers are contractually obligated to process your data only as necessary to perform services on our behalf, to maintain confidentiality, and to implement appropriate security measures.
• Legal Requirements: We may disclose your data when required to do so by applicable law, regulation, legal process, subpoena, court order, governmental request, or regulatory inquiry. We will attempt to notify you of such requests where legally permitted and practically feasible, unless notification would jeopardize an investigation or is prohibited by law.
• Business Transfers: In connection with any merger, acquisition, reorganization, sale of all or substantially all assets, bankruptcy, receivership, or similar corporate transaction, your data may be transferred as a business asset. We will use reasonable efforts to ensure that the acquiring entity is bound by terms no less protective than this Policy.
• Rights and Safety Protection: We may disclose data to protect and defend the rights, property, or safety of the Company, our users, or the public, including to enforce our Terms of Service, investigate potential violations, detect and prevent fraud, respond to security incidents, and cooperate with law enforcement.
• With Your Consent: We may disclose data for any other purpose with your explicit consent.
• Team Members: Within the Services, certain data (such as site information, activity logs, and user actions) is visible to other members of your Team in accordance with the role-based access controls configured by the Team owner. You acknowledge that inviting users to your Team grants them access to shared data within that workspace.

9. Data Retention

We retain Personal Data for as long as your account is active or as reasonably necessary to fulfill the purposes for which it was collected. Specific retention periods include:

• Account Data: Retained for the duration of your active account plus 30 days after account deletion to allow for account recovery, after which it is permanently deleted or anonymized.
• Billing Data: Retained for the duration required by applicable tax, accounting, and financial reporting laws (typically 7 years from the date of the transaction).
• Audit and Activity Logs: Retained for up to 24 months from the date of the logged event, or longer where required by law or for the resolution of disputes.
• Usage and Analytics Data: Retained in identifiable form for up to 12 months, after which it is aggregated or anonymized for long-term analytical use.
• Support Communications: Retained for the duration of your account plus 12 months after account deletion.
• Backups Created Through the Services: Retained in accordance with your plan limits and retention settings. Upon account termination, backups may be deleted after the post-termination retention period (typically 30 days).
• Security Logs: Retained for up to 24 months for security monitoring, incident investigation, and compliance purposes.

We may retain Aggregate Data and fully anonymized data indefinitely for analytical, research, and operational purposes. Upon expiration of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized using commercially reasonable methods.

10. Data Security

We implement and maintain a comprehensive information security program that includes the following administrative, technical, and physical safeguards:

• Encryption: Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to systems containing Personal Data is restricted to authorized personnel on a need-to-know basis, using role-based access controls, unique credentials, and multi-factor authentication.
• Authentication Security: User passwords are hashed using modern, computationally expensive hashing algorithms (bcrypt). API communications between the dashboard and agent plugin use cryptographic request signing with nonce-based replay protection and time-window validation.
• Infrastructure Security: Production systems are hosted in professionally managed data centers with physical security controls. Network security includes firewalls, intrusion detection, and regular vulnerability assessments.
• Monitoring and Logging: Security events, access attempts, and system activities are logged and monitored for anomalous behavior.
• Incident Response: We maintain an incident response plan for promptly detecting, containing, investigating, and remediating security incidents.

NOTWITHSTANDING THE ABOVE, NO METHOD OF ELECTRONIC TRANSMISSION, STORAGE, OR PROCESSING IS COMPLETELY SECURE, AND WE CANNOT AND DO NOT GUARANTEE ABSOLUTE SECURITY. You acknowledge that you transmit data to and through the Services at your own risk. You are solely responsible for maintaining the security of your own account credentials, devices, Connected Sites, and hosting environments. We shall not be liable for any unauthorized access, data breach, data loss, or data corruption except to the extent directly and proximately caused by our gross negligence or willful misconduct.

11. International Data Transfers

The Services are operated from, and data is primarily stored in, infrastructure located in the United States (or other jurisdictions where our hosting providers maintain data centers). If you are located outside the United States, your Personal Data will be transferred to, stored, and processed in the United States or other countries that may have data protection laws that differ from those in your jurisdiction. By using the Services, you explicitly consent to such transfers. Where required by applicable law (including the GDPR, UK GDPR, or similar frameworks), we implement appropriate safeguards for cross-border data transfers, including: (a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) the UK International Data Transfer Addendum; (c) adequacy decisions where applicable; or (d) other legally recognized transfer mechanisms. You may request a copy of the applicable transfer safeguards by contacting us through the channels described in this Policy.

12. Your Privacy Rights

Subject to applicable law, you may have the following rights regarding your Personal Data:

• Right of Access: You have the right to request confirmation of whether we process your Personal Data and, if so, to obtain a copy of the Personal Data we hold about you, along with supplementary information about the processing.
• Right to Rectification: You have the right to request correction of inaccurate Personal Data and completion of incomplete Personal Data.
• Right to Erasure (Right to Be Forgotten): You have the right to request deletion of your Personal Data where: (i) the data is no longer necessary for the purposes for which it was collected; (ii) you withdraw consent and no other legal basis exists; (iii) you object to processing and no overriding legitimate grounds exist; (iv) the data has been unlawfully processed; or (v) erasure is required for compliance with a legal obligation. This right is subject to exceptions, including where retention is necessary for legal compliance, exercise of legal claims, or archiving in the public interest.
• Right to Restriction of Processing: You have the right to request restriction of processing where: (i) you contest the accuracy of the data (for a period enabling verification); (ii) processing is unlawful and you oppose erasure; (iii) we no longer need the data but you require it for legal claims; or (iv) you have objected to processing pending verification of overriding grounds.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where processing is based on consent or contract and is carried out by automated means.
• Right to Object: You have the right to object to processing based on legitimate interests or public interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for legal claims.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed prior to withdrawal.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects. We do not currently engage in solely automated decision-making that produces legal or similarly significant effects.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your Personal Data violates applicable law.

To exercise any of these rights, please contact us through the support channels provided within the Services or at the contact information listed in this Policy. We will verify your identity before processing your request and will respond within the timeframe required by applicable law (typically 30 days, extendable by an additional 60 days for complex requests). We will not discriminate against you for exercising your privacy rights.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA") provide you with additional rights regarding your Personal Information (as defined under California law). In the preceding 12 months, we have collected the categories of Personal Information described in Section 3 of this Policy. We do not sell or share (as those terms are defined under the CCPA/CPRA) your Personal Information for cross-context behavioral advertising purposes. California residents have the right to: (a) know what Personal Information we collect, use, and disclose; (b) request deletion of Personal Information; (c) request correction of inaccurate Personal Information; (d) opt out of the sale or sharing of Personal Information (though we do not engage in such activities); and (e) not be discriminated against for exercising their CCPA/CPRA rights. To exercise these rights, contact us through the channels described in this Policy. We will verify your identity using information associated with your account.

14. Additional State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy legislation may have rights similar to those described in Sections 12 and 13, including rights of access, correction, deletion, data portability, and the right to opt out of targeted advertising, profiling, and the sale of personal data. We do not engage in the sale of personal data or targeted advertising. To exercise rights under your state's privacy law, please contact us through the channels described in this Policy.

15. European Economic Area, United Kingdom, and Swiss Data Subjects

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have the rights described in Section 12 under the General Data Protection Regulation (GDPR), UK GDPR, or Swiss Federal Act on Data Protection (FADP), as applicable. You may also contact your local supervisory authority to lodge a complaint. The data protection supervisory authority for the UK is the Information Commissioner's Office (ICO). For EEA residents, the competent supervisory authority depends on your country of residence. Where we rely on legitimate interests as a legal basis, you may request details of the balancing test we have conducted.

16. Agent Plugin Data Collection

The WordPress agent plugin installed on your Connected Sites collects and transmits data to the Services as necessary to provide the site management, monitoring, and maintenance features you have enabled. The types of data collected by the agent plugin include, but are not limited to: WordPress core version and update status; PHP version and configuration; web server information; database version and size; installed plugin names, versions, slugs, active/inactive status, and update availability; installed theme names, versions, active/inactive status, and update availability; site health metrics; cron job schedules; user account data (usernames, email addresses, roles, last login dates) as needed for user management features; debug log contents when debug log viewing is enabled; file integrity checksums for core file verification; backup file metadata; and site configuration toggles. Data is transmitted via authenticated, cryptographically signed REST API requests over HTTPS. You are responsible for informing your end users, visitors, and any other individuals whose data may be present on your Connected Sites about the data collection and transmission performed by the agent plugin, and for obtaining any consents required by applicable law.

17. Cookies and Tracking Technologies (Detailed)

The following table describes the primary cookies and tracking technologies we use:

• Session Cookie (e.g., laravel_session): Strictly necessary. Maintains your authenticated session. Expires when the browser is closed or after the configured session timeout.
• XSRF Token (e.g., XSRF-TOKEN): Strictly necessary. Provides cross-site request forgery protection. Expires with the session.
• Remember Me Cookie: Functional. Enables persistent login across browser sessions when you select the "remember me" option. Expires after the configured duration (typically 30 days).
• Preference Cookies: Functional. Store your display preferences, dashboard layout, and notification settings.

We do not use third-party advertising cookies. You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent you from using the Services.

18. Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signals. We honor GPC signals as legally required in applicable jurisdictions. For DNT signals, there is no universally accepted standard, and our response to DNT may vary. We do not engage in cross-site tracking or targeted advertising.

19. Data About Children

The Services are not directed to individuals under the age of 18 (or the age of majority in the applicable jurisdiction). We do not knowingly collect Personal Data from children under the age of 13 (or the applicable age under local law, such as 16 under the GDPR). If we become aware that we have inadvertently collected Personal Data from a child without appropriate parental or guardian consent, we will take reasonable steps to promptly delete that data. If you believe we have collected data from a child, please contact us immediately through the channels described in this Policy.

20. Third-Party Websites and Services

The Services may contain links to, or integrations with, third-party websites, applications, or services that are not owned or controlled by us, including but not limited to the WordPress.org plugin and theme directory, payment processor portals, and documentation sites. This Privacy Policy does not apply to any third-party websites or services. We are not responsible for the privacy practices, content, security, or data collection activities of any third party. We strongly encourage you to review the privacy policies and terms of service of any third-party websites or services before providing them with any Personal Data or granting them access to your information.

21. Data Processing Agreement

If you require a Data Processing Agreement (DPA) for compliance with the GDPR, UK GDPR, or other applicable data protection legislation, please contact us through the channels described in this Policy. We will provide a DPA that addresses the requirements of Article 28 of the GDPR, including provisions regarding the subject matter and duration of processing, the nature and purpose of processing, the types of Personal Data processed, the categories of data subjects, and the obligations and rights of the Controller.

22. Data Breach Notification

In the event of a security breach that results in unauthorized access to, or disclosure of, Personal Data that is likely to result in a risk to your rights and freedoms, we will notify affected users and applicable supervisory authorities in accordance with the timeframes and procedures required by applicable law (including, where applicable, the 72-hour notification requirement under Article 33 of the GDPR). Notification may be provided via email to the address associated with your account, through in-app notifications, or by posting a notice on the Services. We shall not be liable for any delays in notification caused by law enforcement requests, forensic investigation requirements, or the need to implement containment measures.

23. Automated Decision-Making and Profiling

The Services may use automated systems for purposes such as fraud detection, abuse prevention, rate limiting, and security threat assessment. These systems may analyze usage patterns, IP addresses, request frequencies, and behavioral signals to identify and block suspicious activity. We do not use automated decision-making that produces legal effects or similarly significant effects on individuals without human review. If you believe you have been adversely affected by an automated decision, you may contact us to request human review.

24. Data Minimization and Purpose Limitation

We collect and process only the Personal Data that is reasonably necessary for the purposes described in this Policy. We do not collect excessive data or use Personal Data for purposes materially different from those for which it was collected, unless we have obtained your consent or have another valid legal basis. We periodically review the data we hold to ensure compliance with this principle.

25. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time at our sole discretion. When we make material changes, we will update the "Last Updated" date at the top of this page and may provide additional notice through email, in-app notifications, or a prominent notice on the Services. We are not obligated to provide individual notice of non-material changes. Your continued use of the Services after any changes are posted constitutes your acceptance of the updated Policy. If you do not agree with any changes, you must stop using the Services and may request deletion of your account and data. We recommend reviewing this Policy periodically to stay informed about our data practices.

26. Contact Information

For questions, concerns, or requests regarding this Privacy Policy, your Personal Data, or our privacy practices, please contact us through the support channels provided within the Services or at the contact information posted on our website. If you are located in the EEA or UK and wish to raise a concern about our data processing practices, you have the right to lodge a complaint with your local data protection supervisory authority.