1. Data controller

The data controller is:
Xseox Marketing
ul. Lipowa 27, 55-040 Królikowice, Poland
NIP: PL9730825516
Contact: support@wpbar.app

2. What we collect and why

We keep the data footprint minimal. The following is processed:

• E-mail address (received from Stripe at checkout) — to deliver the license key, the download link, invoices and transactional support messages. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
• Billing details and tax number (if provided during Stripe checkout) — to issue an invoice and comply with Polish tax law. Legal basis: legal obligation (GDPR art. 6(1)(c)).
• License key and activated site hostnames — to enforce the 5-site activation limit and to let legitimate customers move between sites. Legal basis: legitimate interest (GDPR art. 6(1)(f)) — preventing license abuse.
• Click counters inside the plugin — stored only on your own WordPress site, never transmitted to us.
• Web server logs — IP address and request path — kept for up to 30 days for abuse and incident investigation. Legal basis: legitimate interest.

3. What we do NOT collect

• No analytics on your site's end-users. The plugin does not phone home with visitor data.
• No advertising cookies on wpbar.app.
• No card details — payments are processed by Stripe and we receive only the order metadata.

4. Sharing with third parties

Your data is shared only with processors that are necessary to deliver the service:

• Stripe Payments Europe, Ltd. (Ireland) — payment processing. stripe.com/privacy
• Our hosting provider — stores the wpbar.app website and license database inside the EEA.
• E-mail provider — delivers transactional messages (license + support).

We do not sell your data and do not share it for marketing purposes.

5. Retention

Active licenses and their activation history are retained for as long as your license is active. Invoices and related accounting records are retained for the period required by Polish tax law (currently five (5) years from the end of the tax year). Inactive / revoked license records may be kept up to twelve (12) months after the last activity, then anonymised.

6. Your rights (GDPR)

You have the right to:

• access your personal data and receive a copy (art. 15 GDPR);
• rectify inaccurate data (art. 16);
• request deletion (art. 17), subject to our legal retention obligations;
• restrict processing (art. 18);
• data portability (art. 20);
• object to processing based on legitimate interest (art. 21).

To exercise any of these rights, write to support@wpbar.app. You may also lodge a complaint with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl.

7. International transfers

All personal data is stored within the European Economic Area. Stripe may transfer data to the United States under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

8. Security

The license database is protected by server-level access controls and encrypted backups. Webhook payloads are verified with HMAC-SHA256 signatures. Download links are signed and time-limited. The admin panel uses bcrypt password hashing and CSRF tokens.

9. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced on this page.

10. Contact

Xseox Marketing
ul. Lipowa 27, 55-040 Królikowice, Poland
NIP: PL9730825516
support@wpbar.app