Privacy Policy

Version 2026-08-02.5 · effective 2026-08-02

Awaren is the controller for the personal data described here. We collect as little as we can get away with, and we say what we do with it.

What we hold about you

For an account:

your email address, and your name if you gave one
a hash of your password — never the password itself
your sessions, so you can be signed out everywhere if an account is compromised
your orders, what you paid, and your credit balance and ledger
your licence keys, encrypted, so you can read yours back
a salted hash of the IP address a session or checkout came from, not the address

What we do with it

We use it to run your account, issue and check your licence, take payment, deliver the metered services you spend credits on, answer your support requests, and meet our legal obligations.

We do not sell it and we do not use it to build a profile of you. We do advertise, and if you agreed to it we measure which advert led to a purchase — described under Cookies below. Nothing in your account, your licence, your support cases or your telemetry is used for that, and no list of our customers is ever uploaded to an advertising network.

Operational telemetry

Separately from the above, we record a small set of operational events about whether your site connected and whether the service worked. That is described in full in the next section.

Cookies

One cookie keeps you signed in. It is strictly necessary for something you asked us for, so it does not require your consent — there is no way to refuse it and still have an account.

Others, only if you agree to them. First, a marker recording that someone recommended WPHandover to you, kept for 90 days so that they can be credited for it. That is not necessary for anything you asked us for. In the EEA, the UK and Switzerland we therefore ask before storing anything, and store nothing unless you say yes. Elsewhere we store it and tell you plainly, with the same one-click way to turn it off. Either way, refusing costs you nothing: the site, the checkout and your account behave identically.

If your browser sends a Global Privacy Control signal, we treat that as a refusal and do not ask — wherever in the world you are.

If you do agree, that marker and a referral identifier are shared with the affiliate platform that works out which recommendation led to which sale, and used for that alone.

Advertising measurement, again only if you agree to it. If you arrived from one of our adverts, Google's tag records that the click ended in a purchase, so we can stop paying for adverts that do not work. The tag is loaded on every page but starts with no permission at all, and in that state it stores nothing on your device, reads nothing from it, and has your click identifier stripped before anything is sent. It is what we say yes to on your behalf that changes when you press the button, and nothing else.

What Google receives either way is that a purchase of a certain value happened, not who you are: no email address, no name, no account, no licence key. We do not use Google's enhanced conversions, we do not upload customer lists, and we do not run remarketing — so nothing here follows you to another website.

You can change your answer whenever you like, using the cookie choices link at the foot of this page. Withdrawing deletes the marker and withdraws the advertising permission in the same click.

How we credit a recommendation

Separately from the cookie, and worth being clear about: if you arrive through someone's recommendation link and go on to create an account, we record which link it was against your account. That is a note in our own database about how you came to us, not something stored on your device, and it is what lets us pay the person who recommended us even if you refused every cookie.

We rely on our legitimate interest in running a referral programme and paying people what they are owed. It is not used to advertise to you, and it is not shared with anyone beyond the affiliate platform that calculates the commission. If you would rather it were not recorded, ask us and we will remove it — your account and your licence are unaffected.

How long we keep it

Account and order records for as long as you have an account, and afterwards for as long as we are required to keep commercial records — currently 7 years.

Support cases for 3 years. Diagnostic reports for 1 years.

Your rights

Access, correction, deletion, portability, restriction and objection. Open a case at https://www.wphandover.app/support and we will act on it.

You may also complain to the Autoriteit Persoonsgegevens.

Operational telemetry

Version 2026-08-02.5 · effective 2026-08-02

When your website uses your licence, we record a small number of operational events. This is not analytics and it is not marketing measurement — it is the record of whether the service you paid for actually worked.

What we record

For each licence and connected site:

that a licence was issued
that the plugin was installed and that activation was attempted
whether activation succeeded or failed, and with which error code
the first successful connection, the first API request, and the first completed operation
how many requests were made, and how many failed
the last time the site was active, and its current connection status
the plugin, WordPress and PHP versions
a pseudonymous identifier for the site, alongside its hostname
whether a failure appears to originate on your side, with a third party, or with us
cancellation, access revocation and refunds

What we never record

The following are excluded by design, not by policy:

your WordPress passwords
API secrets in readable form
the content of your pages
the prompts you write or the content the AI generates
your server configuration
personal data we do not need

Why we need it

To deliver the service you bought, to bill it correctly, to keep it secure and detect abuse, and to be able to investigate honestly when you tell us something is broken.

It is also what protects you: without it, a refund review would be a matter of opinion about whether the service ever worked.

Legal basis

Performance of our contract with you (Article 6(1)(b) GDPR) for delivery, billing and support, and our legitimate interests (Article 6(1)(f) GDPR) in the security and integrity of the service.

This telemetry is necessary for the service and is therefore not subject to consent. Marketing and website analytics are separate, are consent-based, and are never mixed with this data.

How long we keep it

Operational telemetry: 2 years.

Diagnostic reports: 1 years.

Support cases: 3 years.

Checkout consent records, order confirmations and refund decisions: 7 years, because they form part of our commercial records and we are required to keep them.

Who else is involved

Our hosting and database providers, our payment provider (Stripe Payments Europe, Limited, Ireland), the data provider behind the SEO and AI-visibility services, and our email provider where one is configured.

Our infrastructure is hosted in the EEA. Where a subprocessor processes data outside the EEA, that transfer is covered by the appropriate safeguards, and we will tell you which on request.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it, by opening a case at https://www.wphandover.app/support.

Some records — consent evidence, invoices, refund decisions — we are legally required to keep for a set period even after you close your account. We will tell you which those are rather than quietly keeping them.

You also have the right to complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.