1. Data Controller
The data controller for personal data processed through this website and the Webhook Actions licensing service is:
Flow Systems Mateusz Skorupa, Poland
For privacy-related inquiries: [email protected]
2. Data We Collect
Account & billing data
- Name and email address (provided at checkout)
- Billing details — processed and tokenized by Stripe; we do not store full card numbers
- License key, activated site URLs, and activation timestamps
Usage data
- Website analytics (page views, referrers, approximate country, browser and device type, and page performance timings) — collected by Cloudflare Web Analytics without cookies and without any identifier that follows you between visits or across other sites
- The plugin itself does not send any data back to our servers; activation checks communicate only the license key and site URL
Site chat
- The messages you type into the chat on this website, and the replies to them
- Your email address, only if you choose to give it in the chat so that we can reply after you have left
- The page you started the chat from, your browser type, and a one-way hash derived from your IP address (used to limit abuse; the address itself is not stored)
The chat is optional and collects nothing until you send a message. Replies come from an AI assistant unless the chat says a person has joined. The site owner can read conversations as they happen, in a private console that only he can sign in to, and join any of them in person. Please do not send passwords, license keys, or other secrets through it.
3. Legal Basis for Processing (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)) — processing your name, email, billing data, and license activations is necessary to deliver the service you purchased.
- Legitimate interest (Art. 6(1)(f)) — fraud prevention, license abuse detection, and improving the service.
- Legitimate interest (Art. 6(1)(f)) — aggregated website analytics. Our analytics are cookieless and store nothing on your device, so no consent is required; you may object to this processing at any time using the contact details below.
- Legitimate interest (Art. 6(1)(f)) — answering the questions you send through the site chat, and protecting the chat against automated abuse.
- Legal obligation (Art. 6(1)(c)) — retention of billing records for tax and accounting purposes under Polish law.
4. How We Use Your Data
- Deliver and maintain the Pro licensing service
- Process payments and issue receipts via Stripe
- Send transactional emails (license keys, renewal notices, support replies)
- Validate license activations from WordPress sites
- Provide customer support
- Answer questions sent through the site chat, and learn which questions the documentation fails to answer
We do not use your data for advertising, profiling, or sale to third parties.
5. Payments & Stripe
Payments are processed by Stripe, Inc. (United States). Stripe acts as a data processor under our agreement and independently as a data controller for fraud-prevention purposes. We do not store full payment card details.
See Stripe's privacy policy: stripe.com/privacy
Data transfers to Stripe in the US are governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Chapter V.
6. Cookies
This website sets no analytics cookies. We use Cloudflare Web Analytics, which is cookieless — it stores nothing on your device, does not fingerprint your browser, and cannot follow you to other websites — which is why you are not asked to accept a cookie banner here. No advertising or tracking cookies are used. Cloudflare may set strictly necessary cookies to protect the site against automated abuse; these carry no analytics or advertising function. You can disable cookies at any time via your browser settings — this will not affect your ability to use the plugin or licensing service.
If you start a conversation in the site chat, your browser's local storage keeps an identifier for that conversation so that it is still there when you change page or come back later. It is set only once you send a message, is used for nothing else, and is removed when you clear your browser's site data.
7. Data Sharing
We do not sell your personal data. Data is shared only with:
- Stripe — payment processing
- Email service providers — for transactional emails (license keys, support), to alert the site owner when a site chat conversation asks for him, and to send him a daily summary of the previous day's chat conversations
- Cloudflare — content delivery, DDoS protection, cookieless website analytics, and the browser check (Turnstile) that runs when you start a site chat
- Anthropic — site chat messages are sent to Anthropic's Claude API to generate the AI assistant's replies
All processors are bound by data processing agreements and are required to protect your data in accordance with GDPR.
Site chat conversations are stored on our own server, and the live connection that delivers replies to your browser runs there too. When you write in the chat, the site owner's own devices may receive a notification showing an excerpt of your message. These notifications travel through the push service of his browser's vendor (such as Google or Apple) end-to-end encrypted, so the push service relays them without being able to read them.
8. Data Retention
- Subscription & license data — retained for the duration of your subscription plus 5 years, as required by Polish accounting and tax regulations.
- Support correspondence — retained for 2 years after the last contact.
- Site chat conversations — deleted 90 days after the last activity in the conversation.
- Analytics data — aggregated only; no personal identifiers are retained beyond the session.
9. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access — request a copy of personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data ("right to be forgotten"), subject to legal retention obligations
- Right to restriction — request that we limit how we process your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact: [email protected]. We will respond within 30 days.
10. International Data Transfers
Your data may be processed by Stripe, Inc. and Cloudflare, Inc. in the United States. Site chat messages are additionally processed by Anthropic, PBC in the United States. Such transfers are carried out under Standard Contractual Clauses (SCCs) adopted by the European Commission, ensuring an equivalent level of protection to that provided within the EEA.
11. Data Security
We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or disclosure. However, no transmission over the internet can be guaranteed to be completely secure.
12. No Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.
13. Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Polish supervisory authority:
Urząd Ochrony Danych Osobowych (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland
uodo.gov.plYou may also contact the supervisory authority in your country of residence within the EU.
14. Contact
For privacy-related questions or to exercise your rights: [email protected]
