Privacy Policy
This document was last updated on October 26, 2026.
This privacy policy explains what personal data WPCore.com collects, why it collects it, who receives it and what rights you have. It applies to the website at wpcore.com and the companion WordPress plugin at wordpress.org/plugins/wpcore.
Who we are
WPCore.com is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR. Contact us about this policy or your data at [email protected].
Data we collect
| Data | When we collect it |
|---|---|
| Username, email address and password. We store the password as a one-way hash. | When you register |
| Your Google account ID and email address | When you sign in with Google |
| The IP address you registered from | When you register |
| The user who referred you | When you register after following another user's referral link |
| Whether you want to receive marketing email | When you register or change your account settings |
| Your collections, favourites, custom plugins and uploaded plugin files | When you create them |
| Your teams, and the email addresses of people you invite to a team | When you create a team or send an invitation |
| Your Stripe customer ID, card brand, the last four digits of your card, and your subscription and invoice history. Your full card number goes to Stripe and never reaches our server. | When you subscribe to WPCore Pro |
| The notifications we send you about updated plugins in your collections | When a plugin in one of your collections is updated |
| Your message, the page you were on, your IP address, your username and your email address | When you send us a report with the report form |
| Your IP address, browser type and the pages you request | When you visit the site. Our server logs, error reports and analytics record this data. |
Why we use your data
| Purpose | Legal basis under the GDPR |
|---|---|
| Create and run your account, and store your collections, custom plugins and teams | Performance of our contract with you, Article 6(1)(b) |
| Take payment for WPCore Pro and issue invoices | Performance of our contract with you, Article 6(1)(b) |
| Keep invoice and payment records | Legal obligation under tax and accounting law, Article 6(1)(c) |
| Send account email: email confirmation, password resets, team invitations, receipts and plugin update notifications | Performance of our contract with you, Article 6(1)(b) |
| Send marketing email about WPCore.com | Your consent, Article 6(1)(a). We send it only if you tick the box at registration or in your account settings. |
| Block automated sign-ups with reCAPTCHA, record sign-up IP addresses and keep server logs | Our legitimate interest in protecting the site from abuse, Article 6(1)(f) |
| Find and fix errors | Our legitimate interest in running a working service, Article 6(1)(f) |
| Measure how visitors use the site with Google Analytics | Our legitimate interest in improving the site, Article 6(1)(f) |
| Answer reports and support requests | Our legitimate interest in answering you, Article 6(1)(f) |
| Record which user referred you | Our legitimate interest in counting referrals, Article 6(1)(f) |
We do not sell your personal data. We do not show advertising. We do not make automated decisions that have legal or similar effects on you.
Data that other people can see
- Your username and your public collections appear on your profile page.
- Your profile page and your public collections show your Gravatar image. The image address contains a hash of your email address.
- Anyone with the key of one of your collections can read its plugin list and download its custom plugin files. You choose who receives the key.
- Members of your teams see your account in the team's member list.
You can make a collection private in its settings.
Who receives your data
We use the following service providers. Each one processes personal data for us under a data processing agreement.
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Our hosting provider | Runs the application server and database | All data listed in this policy | Canada |
| Amazon Web Services | Stores uploaded plugin files and database backups | Uploaded files, and all account data in backups | United States |
| Stripe | Processes payments and stores cards | Email address, card details, billing details and payment history | United States |
| Mailgun | Sends our email | Email address and the content of each email | United States |
| Google Analytics | Measures site usage | IP address, device and browser details, pages visited, and an identifier stored in a cookie | United States |
| Google reCAPTCHA | Blocks automated sign-ups on the registration page | IP address, device and browser details, and how you use the registration page | United States |
| Google Sign-In | Signs you in with your Google account, if you choose to | Google sends us your Google account ID and email address | United States |
| Bugsnag | Collects error reports | The request that caused the error, your IP address, and your account details if you were signed in | United States |
| Gravatar, run by Automattic | Shows profile images | A hash of your email address, and the IP address of each visitor who loads the image | United States |
We also disclose personal data when the law requires us to.
Transfers outside the EU and UK
The European Commission has decided that Canada provides an adequate level of data protection. Transfers to Canada rely on that decision.
Transfers to the United States rely on the provider's certification under the EU-US Data Privacy Framework and its UK Extension, or on the European Commission's Standard Contractual Clauses in the provider's data processing agreement. Email us for a copy of the safeguards for a provider.
Cookies
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
wpcore-session |
WPCore.com | Keeps you signed in and stores your settings for this visit | 2 hours after your last request |
XSRF-TOKEN |
WPCore.com | Protects forms against cross-site request forgery | 2 hours after your last request |
remember_web_* |
WPCore.com | Keeps you signed in after you tick "Remember me" or sign in with Google | Until you sign out |
_ga, _ga_* |
Google Analytics | Tells visits from different browsers apart | 2 years |
_GRECAPTCHA |
Google reCAPTCHA | Tells people and automated programs apart on the registration page | 6 months |
You can block or delete cookies in your browser settings. You cannot sign in without the WPCore.com cookies. You can stop Google Analytics from collecting your data with the Google Analytics opt-out browser add-on.
How long we keep your data
| Data | Retention period |
|---|---|
| Account data, collections, custom plugins, uploads, teams and notifications | Until you delete your account |
| Database backups | Up to 2 years. Deleted data stays in older backups until those backups are deleted. |
| Invoices and payment records | As long as tax and accounting law requires |
| Reports sent with the report form | Until the report is resolved |
| Google Analytics data | Up to 14 months |
You can delete your account in your account settings. This deletes your account, your collections, your custom plugins and your uploads, and cancels your subscription. Some records remain after that, such as your Stripe customer record and the files of your uploaded plugins. Email us to have them erased.
Marketing email
We send marketing email only to users who ask for it. Every marketing email has an unsubscribe link at the bottom. You can also turn marketing email off in your account settings. Account email, such as receipts and password resets, does not depend on this setting.
Your rights
If the GDPR or the UK GDPR applies to you, you have the right to:
- Get a copy of the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased
- Have the processing of your data restricted
- Receive your data in a machine-readable format, or have it sent to another provider
- Object to processing that relies on our legitimate interests
- Withdraw your consent at any time, where processing relies on consent. Withdrawing consent does not affect processing that took place before.
Email [email protected] to use any of these rights. We answer within one month. We may ask you to prove that you own the account.
You also have the right to complain to the data protection authority in the country where you live or work. A list of EU authorities is on the European Data Protection Board website. In the UK the authority is the Information Commissioner's Office.
Security
The site uses HTTPS. We store passwords as one-way hashes. Stripe handles card numbers. Only WPCore.com administrators can access the admin panel.
Children
WPCore.com is not intended for anyone under 16. We do not knowingly collect data from children under 16. Email us if you believe a child has given us personal data, and we will delete it.
Changes to this policy
We publish every change to this policy on this page and update the date at the top. If a change affects how we use the data you have already given us, we email registered users before the change takes effect.
Please make sure you also understand and agree to the terms of service.