GoUpWP is the controller of personal information described in this notice. We are based at London, United Kingdom. Privacy questions and rights requests can be sent to privacy@goupwp.com.
1. Information we collect
- Account information: name, email address, password hash, email-verification status and account preferences.
- Orders and billing: product, licence term, price, currency, PayPal customer and transaction references, payment status, refunds and subscription events. PayPal keeps your full payment credentials.
- Licensing and downloads: licence status, site URL, installation identifier, production or staging classification, WordPress/PHP/plugin versions, activation dates, download records and a one-way hash of the requesting IP address.
- Support and requests: messages, troubleshooting details and files or information you choose to provide.
- Security and service records: sign-in events, audit records, error and security logs, device/browser information and one-way IP hashes where used.
- Search information: searches performed on our catalogue, result counts and a pseudonymous session reference. Search records are normally removed after 180 days.
Our plugins do not send your store orders, customers, passwords, database contents or website content to GoUpWP. A specific plugin’s documentation will identify any different network behaviour before purchase.
2. Why we use it and our lawful bases
| Purpose | UK GDPR basis |
|---|---|
| Create accounts, take payment, issue licences, provide downloads and support | Performance of our contract with you |
| Accounting, tax, fraud prevention, sanctions checks and responding to lawful requests | Legal obligation |
| Protect the service, investigate abuse, improve reliability and understand aggregate catalogue demand | Our legitimate interests in operating and securing a proportionate commercial service |
| Send optional marketing or use non-essential cookies | Consent, where requested; you may withdraw it at any time |
3. Where information comes from
Most information comes directly from you or your WordPress installation. We also receive payment and subscription status from PayPal and technical/security information from our hosting and communications providers.
4. Who receives it
We share only what is needed with service providers acting for us, including hosting, private file storage, email delivery, error monitoring and customer support providers; with PayPal as an independent payment provider; with professional advisers; and with authorities where legally required. We do not sell personal information.
5. International transfers
Some providers may process information outside the UK. Where required, we use an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, and assess relevant transfer risks. Contact us for information about the safeguard used for a particular provider.
6. Retention
We keep account data while the account is active. Core contract, payment, entitlement and tax records (purchases, transactions, subscriptions, licences and the audit entries that document them) are kept for at least six years after the relevant transaction or relationship ends, as tax and accounting law requires. These records are not deleted automatically: after that period they are reviewed and deleted or anonymised manually, and personal details attached to them are anonymised when you close your account. Support records are normally kept for three years after a ticket closes; catalogue searches for 180 days; and operational/security logs for up to 12 months unless an incident, legal claim or law requires longer. Backups expire on their normal protected rotation.
7. Your rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or to object to processing. You may withdraw consent without affecting earlier lawful processing. We may need to verify your identity and may retain information that the law requires us to keep. We do not make solely automated decisions with legal or similarly significant effects.
8. Complaints and security
Contact us first at privacy@goupwp.com so we can investigate. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We use access controls, encryption in transit, private release storage, signed downloads, hashed licence lookup and audit logging, but no system can be guaranteed perfectly secure.
9. Children and changes
GoUpWP is a business software service and is not directed at children. We do not knowingly collect information from anyone under 18. We will post material changes here and update the date above; where a change significantly affects you, we will use a reasonable additional notice.
Further information: ICO privacy notice guidance.