Scope — the site and your store are different things
This policy explains how the wooaccount.com platform ("we") handles personal data of its own customers: the data you give us when you create an account, buy a license, activate the Software and contact support.
It also covers the data our Software sends us during normal operation. The WooAccount plugin runs on your WordPress site. Your store — including your customers' personal data — lives in your WordPress/WooCommerce installation and is controlled by you. The Software processes your store's data on your own server; it does not send your store's customer data to us, and it makes no third-party tracking calls. When a merchant uses WooAccount on their store, the merchant remains the controller of their store's customer data and should reflect that in their own privacy documentation.
Who is responsible
The data controller for the platform described here is [LEGAL ENTITY NAME — TO BE PROVIDED], [REGISTERED ADDRESS — TO BE PROVIDED]. Contact: hello@wooaccount.com.
Data we collect
Account data. When you register or sign in: your email address and name; a password stored only as a salted scrypt hash (we never see or store your actual password); optional profile fields you choose to add (such as company or country); and, if you use social sign-in, the identity-provider account identifier plus the email address and name that the provider (currently Google or GitHub) shares with us after you approve it.
Order and billing data. For each order: the plan, amounts, currency, coupon used, status and timestamps; and the billing details you enter at checkout (such as name, company, address and VAT number) stored as a billing snapshot attached to the order.
Payment references. For each order we store the payment provider's reference (a PayPal order identifier, a TRON reference code, or a BTCPay invoice identifier) so your payment can be verified and reconciled. Card numbers and wallet credentials are never collected or stored — payments are handled entirely by the providers described under "Payment providers" below.
Licensing and update telemetry. When your site activates a license or checks for updates, we receive the license key, the site address (domain) of the activation, an installation identifier, and the plugin, WordPress, PHP and WooCommerce versions of that site. We store this to enforce activation limits, deliver updates and support you. We do not receive the content of your store — no customer records, no order contents, no analytics from your store.
Support and contact. If you contact us through the contact form or support channels, we keep your message, your email address and our reply.
Security events. We keep records of security-relevant account events — successful and failed sign-ins, registrations, social sign-in attempts and similar — including the IP address involved, to detect and investigate abuse.
Aggregate article views. Blog articles count anonymous, aggregate views (a simple counter with no cookies, no identifiers and no profiling).
What we deliberately do not do
We do not run third-party analytics or advertising trackers on the Site. We do not build behavioral profiles. We do not sell personal data. The Software does not send your store's customer data, order contents or store activity to us or to any third party. There is no hidden telemetry beyond the licensing and update data listed above.
Why we use the data (legal bases)
We use account, order and licensing data to provide the service you bought — creating your account, processing your purchase, delivering the license and updates, and providing support (performance of a contract). We use security-event data to protect the platform and our customers from abuse (legitimate interest). Where we ask for optional information, we use it with your consent, which you can withdraw. Where billing records must be kept, we keep them because of legal obligations [APPLICABLE TAX/ACCOUNTING OBLIGATIONS — TO BE CONFIRMED].
[LEGAL BASES LIST — TO BE REVIEWED AGAINST THE FINAL JURISDICTION (E.G. GDPR ARTICLE 6 IF APPLICABLE)]
Cookies and browser storage
We use a small number of strictly necessary cookies: a session cookie (wa_session) that keeps you signed in, and a short-lived nonce cookie used during social sign-in. We also store your light/dark theme preference in your browser's local storage. Details are in the Cookie Policy.
Payment providers and other third parties
PayPal. If you pay with PayPal, PayPal handles the payment under its own terms and privacy policy. We receive confirmation of the payment and the payment reference.
TRON network explorers. For USDT (TRC-20) payments, our servers query public TRON blockchain explorers (TronGrid/TronScan) to detect your transfer. These are public blockchain queries about the merchant wallet and the transaction; they are made server-side and are not tied to your browsing.
BTCPay Server. Bitcoin payments are processed through our own self-hosted BTCPay Server instance. Invoice data is stored there; no third-party payment intermediary is involved in the payment itself.
Identity providers. If you use social sign-in, Google or GitHub authenticates you and shares your email address and name with us after your approval.
Hosting. The platform runs on hosting operated by/for us [HOSTING PROVIDER AND LOCATION — TO BE PROVIDED].
How long we keep data
Account data is kept while your account is open. Order, billing and licensing records are kept for the duration of your license and afterwards as needed for accounting, tax and dispute purposes [RETENTION PERIODS — TO BE CONFIRMED]. Security-event records are kept for [SECURITY LOG RETENTION PERIOD — TO BE CONFIRMED]. Support conversations are kept while useful for the ongoing support relationship. Aggregate view counts carry no personal data and are kept indefinitely.
Your rights
You can access and update your account information and see your orders and licenses in your account area at any time. You can request a copy of your personal data, ask for corrections, ask us to delete your account and personal data, or object to or restrict certain processing — by writing to hello@wooaccount.com from the email address on the account. We respond within [RESPONSE DEADLINE — TO BE CONFIRMED] and verify ownership of the address before acting. Deleting an account ends access to licenses and downloads that are still active, so we will tell you what deletion means for any active license before we act.
[STATUTORY RIGHTS LIST (ACCESS, PORTABILITY, COMPLAINT TO SUPERVISORY AUTHORITY, ETC.) — TO BE COMPLETED PER JURISDICTION]
Security
We protect personal data with: HTTPS on all traffic; passwords stored as salted scrypt hashes; session tokens stored only as SHA-256 hashes; signed licensing responses so the Software can verify authentic answers; short-lived, single-use download tokens; rate limiting on authentication, licensing and payment endpoints; and least-privilege handling of provider secrets. More detail is on the security page. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant authorities as required by applicable law.
Children
The Site and the Software are not directed to children, and we do not knowingly collect their personal data.
International data transfers
Your data is stored on our hosting infrastructure [HOSTING LOCATION(S) — TO BE PROVIDED]. Where data protection law restricts transfers of your data to other countries, we will put the required safeguards in place [TRANSFER MECHANISM (E.G. SCCS) — TO BE CONFIRMED].
Changes to this policy
We publish the current version on this page with a "last updated" date and announce material changes on the Site.