1. Data Controller
For the purposes of the General Data Protection Regulation (“GDPR”), the data controller responsible for your personal data is:
- Company name: Limon Software Solutions
- Registered address: Istanbul, Türkiye
- Contact email: info@wpsafer.com
- Phone: +90 543 209 5970
- Data Protection Officer: Not formally designated given the company’s current size; privacy requests are handled via the contact email above.
WP Safer (“we,” “us,” “our”) operates wpsafer.com, a subscription SaaS that lets you remotely manage and back up multiple WordPress sites from a single dashboard.
2. What We Collect
2.1 Account Information
When you register and use the service, we process account data such as your name, email address, password (stored irreversibly using bcrypt), and billing/contact details.
2.2 Managed Site Data and Access Information
Because the core function of the service is remote WordPress management, we store and process, for each site you connect:
- A site access key: when you connect a site, we generate and store a site-specific access key used to sign management commands. This key grants administrator-level access to your site (we do not store your WordPress admin password itself).
- WordPress admin username (if provided),
- FTP/SFTP details (only if you enter them): username and password,
- Backups of your sites (database and file/plugin/theme backups — these backups may contain any content stored on your site, including personal data of your own site’s visitors or users).
This data is necessary to perform the actions you request, such as backups, restores, and plugin/theme installation.
2.3 Payment Information
Subscription payments are processed through Polar.sh. We do not store your card details on our servers; Polar shares with us only limited transaction data (e.g. transaction ID, subscription status, amount).
2.4 Transactional Communications
Service notifications, billing emails, password resets, and support correspondence are sent through OVH SAS, our email infrastructure provider. Your email address and the content of these emails are shared with OVH for this purpose.
After you complete a purchase, a copy of your order confirmation email (your name, email address, purchased plan and amount, and order reference) is shared with Trustpilot so that Trustpilot can send you a single invitation to review WP Safer. Leaving a review is optional.
2.5 Cookies and Analytics
In addition to essential cookies (e.g. login/session), we use Google Analytics to measure site usage and Google Ads (via Google Tag Manager) to measure the performance of our advertising — both only with your consent. See our separate Cookie Policy for details.
2.6 Automatically Collected Technical Data
We process server log data such as IP address, browser type, operating system, and access timestamps, for security, debugging, and fraud-prevention purposes.
2.7 Advertising Measurement Data
If you reach wpsafer.com by clicking one of our Google ads and you have consented to advertising / marketing cookies, we collect the ad click identifier (gclid) and the campaign parameters in the page address (utm_source, utm_medium, utm_campaign). When you register, we store these values together with your account record and the time of the ad visit. We use them only to attribute your sign-up and subscription to the right campaign and to report that conversion (the conversion event, its time and value, and the click identifier) back to Google Ads, so that we can measure and improve our advertising.
If you have not consented, we do not collect or store these identifiers, and no advertising cookies are set. We do not use them to make decisions that produce legal or similarly significant effects on you, and we do not sell your personal data.
3. How We Use Your Data
- To provide and operate the service and manage your account;
- To perform backups, restores, and plugin/theme installation/updates on the WordPress sites you connect;
- To process subscription payments and billing;
- To send service notifications, alerts, and support emails;
- To analyze and improve the service (Google Analytics — only with your consent);
- To measure the effectiveness of our advertising (Google Ads) — only with your consent;
- To secure the service and prevent abuse or fraud;
- To comply with legal obligations.
Legal basis for processing (GDPR Art. 6):
| Purpose | Legal Basis |
|---|---|
| Providing the service, managing your account | Performance of a contract |
| Backups/restores of connected sites | Performance of a contract |
| Billing and payment processing | Performance of a contract / legal obligation |
| Security and fraud prevention | Legitimate interest |
| Post-purchase review invitation (Trustpilot) | Legitimate interest |
| Google Analytics | Consent |
| Advertising measurement, Google Ads click identifier and campaign parameters | Consent (GDPR Art. 6(1)(a); for cookies and similar technologies also UK PECR / ePrivacy rules) |
4. Who We Share Data With
| Recipient | Purpose | Data Shared |
|---|---|---|
| Polar.sh | Payment/subscription processing | Transaction data (card data stays with Polar) |
| OVH SAS | Transactional email delivery | Email address, email content |
| Trustpilot A/S — Denmark | Sending a review invitation after a completed purchase | Copy of the order confirmation email: name, email address, plan and amount, order/subscription reference |
| Google Analytics | Usage analytics | Truncated IP, device/browser info, page-view data |
| Google Tag Manager and Google Ads — Google Ireland Limited / Google LLC | Advertising measurement and reporting conversions (sign-ups, subscriptions) to Google Ads | Ad click identifier (gclid), conversion event with time and value, device/browser information and IP address received when advertising tags load |
| Hetzner | Hosting infrastructure (application servers, database) — Germany | Account data, site access keys, FTP/SFTP details, server logs, screenshots |
| DigitalOcean, LLC — DigitalOcean Spaces | Object storage of site backups (files + database) — in the backup region you select for each site; new sites default to Amsterdam, Netherlands (ams3). The regions you can select are listed in your panel. | Full backups of your connected WordPress sites — may include any content on your site, including personal data of your site’s own visitors/users |
We do not sell your personal data. Data may be disclosed to public authorities where required by law.
International Transfers
Your site backups are stored with DigitalOcean Spaces in the backup region you select for each site; new sites default to Amsterdam, Netherlands, and the regions available to you are listed in your panel. If you select a region outside the EEA/UK, your backups are stored in that country. Trustpilot is based in Denmark — within the EEA. Other providers (Polar.sh, OVH, Google Analytics, Google Tag Manager and Google Ads) may also process data outside the EEA/UK. Where data leaves the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | For as long as the account is active; deleted within 30 days of a closure request (except data subject to legal retention) |
| Site backups (DigitalOcean Spaces) | For as long as the site connection is active. Deleting a backup, or deleting a site, moves its archives to the Trash in your panel, where you can delete them permanently straight away. Archives left in the Trash are deleted automatically three months after we email you that your subscription ended without renewal (renewing cancels that deletion), and within 30 days of a request to close your account. |
| Site access key | For as long as the site connection is active. When you remove a site, its record — including the key — is kept in the Trash in your panel so that the site can be restored, and you can delete it permanently straight away. If you don't, the record and its key are deleted automatically 90 days after you removed the site, and within 30 days of a request to close your account. You can also rotate the key from the panel at any time, which invalidates the old one immediately. The access itself ends as soon as you change the key on the site (WP Safer settings in wp-admin) or remove the plugin. |
| FTP/SFTP details | For as long as the site connection is active; deleted immediately when the site is removed |
| Payment records | Retained as required by applicable Turkish commercial/tax law (currently 10 years) |
| Server logs | 90 days |
| Google Analytics data | Per Google’s standard retention settings (see Cookie Policy) |
Ad click identifier (gclid) | Deleted 90 days after the ad visit |
Campaign parameters (utm_*) | 12 months after the ad visit, or until you ask us to delete them |
| Google Ads data | Per Google’s retention settings |
6. Data Security
We apply appropriate technical and organizational measures, including:
- Encrypted transport (TLS) between server and client; backups are also transferred to DigitalOcean Spaces over TLS into an access-restricted (private ACL) bucket.
- Panel account passwords are stored irreversibly (bcrypt); no one, including WP Safer, can read them.
- We do not store your managed WordPress site’s admin password. The connection is established via a site-specific access key used to sign management commands; this key is stored in our database and grants administrator-level access to your site.
- If you provide FTP/SFTP details, your username is stored in plain text and your password using reversible encryption.
- Our application servers are hosted with Hetzner; your backups can only be accessed through your authenticated account, via a time-limited, signed link.
7. Your Rights Under GDPR
If you are located in the EEA/UK, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate data;
- Request erasure (“right to be forgotten”);
- Restrict or object to processing;
- Data portability;
- Withdraw consent at any time (where processing is based on consent, e.g. Google Analytics and advertising measurement);
- Lodge a complaint with your local supervisory authority.
To exercise these rights, contact us at info@wpsafer.com. We will respond within one month as required by GDPR.
Additional information for visitors in the United States, Canada and Australia
We do not sell your personal data. We use advertising and analytics cookies and the Google Ads click identifier only if you opt in through our cookie banner, and you can withdraw that choice at any time via “Cookie preferences”. To ask about, access, correct or delete the personal data we hold about you, contact us at info@wpsafer.com. We respond within the time required by applicable law.
8. Children’s Privacy
Our service is not directed at individuals under 16 and we do not knowingly collect data from them.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page, and for material changes we will notify you at your registered email address.
10. Contact
Limon Software SolutionsIstanbul, Türkiye
Email: info@wpsafer.com
Phone: +90 543 209 5970
Questions about this document? Write to us.