Privacy Policy

This policy describes what the hosted TidyConsent service collects and why. It covers our website and the paid service. It does not cover your website's visitors: the free plugin stores consent records in your WordPress database, under your control, and you are the data controller for your visitors' data.

1. What we collect

Scan data. When you run a scan, the service receives a public page address and fetches that one public page to look for known tools. A scan run from inside the plugin is answered and not stored. A scan you ask for by email is kept so its result page can be opened: the site's address (host only), the tools found, the plain-English report, and the time. We do not collect your visitors' personal data through a scan. To improve detection, every scan also adds to a count of third-party script hosts our scanner did not recognise (the script's host, such as cdn.example.com; never the address of the site that was scanned).

License and account data. When you buy Pro, we store your email address, your license key, the site URL(s) you activate it on, your plan, and your subscription status. Payments are processed by Stripe; Stripe gives us a customer reference and payment status, not your full card details. To offer Pro updates, the add-on asks us for the latest version at most every 12 hours, sending the license key, the site URL and the installed Pro version. We use them to answer; the download link we issue for an active license works for one hour.

Consent-log backups (only if you turn the feature on). If you enable log backup in the Pro add-on, your plugin sends copies of its consent-log entries to the service. Each entry contains the time of the choice, a consent ID, the category choices, and a salted hash of the visitor's IP address — the plugin never stores or sends the raw IP address for this log.

Your email address, when you give it to us. If you ask for the free plugin, a scan report, or the consent checklist inside the plugin, we store the email address you entered, which of those you asked for, the site address if you gave one, and whether you opened the link we sent. Asking for the free plugin (once you open the link we send) or for the checklist also adds your address to our email list; each form says so next to its button. Asking for a scan report does not: the report invites you to join, and you are added only if you say yes. We do not store your IP address with it.

Basic technical data. Like most web services, our servers keep short-lived logs of requests (time, address, and technical details) to operate and secure the service.

2. How we use it

We use this data only to run the service for you: performing scans, checking licenses, sending change notifications you asked for, storing the backups you enabled, sending the download link, report or checklist you asked for, providing support, and keeping the service secure. We email the people on our list consent tips and product news. Every message has an unsubscribe link that works with one press, and once you use it we do not add you again unless you ask us to. We do not sell personal data, and we do not use your scan data, license data, or log backups for advertising.

3. Who else processes it

• Stripe — payment processing (their privacy policy applies to payment data).
• Email delivery provider — delivers the messages you asked for to the address you gave.
• Hosting provider — the service runs on cloud infrastructure that stores and transmits the data above on our behalf.
• We disclose data only when required by law, or to the processors above as needed to run the service.

4. Retention

• Scan results asked for by email: deleted 90 days after the scan.
• License/account data: kept while your license is active and deleted 12 months after it ends (kept that long for accounting and fraud prevention).
• Log backups: kept while your license is active; deleted 30 days after your license ends, or sooner if you ask us.
• Email addresses you gave us: kept until you ask us to remove them. After you unsubscribe we keep the address only to make sure we do not email it again.
• Server logs: kept for up to 30 days.

5. Deletion on request

Email heemo521@gmail.com from the address on your license and ask us to delete your service data. We will delete your scan reports, license records, and log backups within 30 days, except records we must keep for legal or accounting reasons (for example, payment records held by Stripe). Deleting service data does not delete anything in your own WordPress database — that stays under your control.

6. Your visitors

If you use TidyConsent on your site, you decide what your site collects from visitors and you are responsible for your own privacy policy. The plugin's consent log (including the salted IP hashes) lives in your WordPress database. The only visitor-related data that can reach our service is the log backups described above, and only if you enable that Pro feature.

7. Changes and contact

We will post changes to this policy on this page with a new effective date. Questions or deletion requests: heemo521@gmail.com.

Effective date: November 12, 2026