Privacy Policy
This policy describes what the hosted TidyConsent service collects and why. It covers our website and the paid service. It does not cover your website's visitors: the free plugin stores consent records in your WordPress database, under your control, and you are the data controller for your visitors' data.
1. What we collect
Scan data. When you run a scan, the service receives your site's public home-page URL, fetches that public page, and stores the resulting report: the page URL, the known trackers found, the evidence snippets matched (script addresses and similar technical markers), the proposed configuration, and the time of the scan. We do not collect your visitors' personal data through a scan.
License and account data. When you buy Pro, we store your email address, your license key, the site URL(s) you activate it on, your plan, and your subscription status. Payments are processed by Stripe; Stripe gives us a customer reference and payment status, not your full card details.
Consent-log backups (only if you turn the feature on). If you enable log backup in the Pro add-on, your plugin sends copies of its consent-log entries to the service. Each entry contains the time of the choice, a consent ID, the category choices, and a salted hash of the visitor's IP address — the plugin never stores or sends the raw IP address for this log.
Basic technical data. Like most web services, our servers keep short-lived logs of requests (time, address, and technical details) to operate and secure the service.
2. How we use it
We use this data only to run the service for you: performing scans, checking licenses, sending change notifications you asked for, storing the backups you enabled, providing support, and keeping the service secure. We do not sell personal data, and we do not use your scan data, license data, or log backups for advertising.
3. Who else processes it
- Stripe — payment processing (their privacy policy applies to payment data).
- Hosting provider — the service runs on cloud infrastructure that stores and transmits the data above on our behalf.
- We disclose data only when required by law, or to the processors above as needed to run the service.
4. Retention
- Scan reports: kept while your license is active so you can see changes between scans; deleted within 90 days after your license ends, unless you ask us to delete sooner.
- License/account data: kept while your license is active and for up to 12 months afterwards for accounting and fraud prevention.
- Log backups: kept while the feature is on and your license is active; deleted within 30 days after the feature is turned off, your license ends, or you ask us to delete them — whichever comes first.
- Server logs: kept for up to 30 days.
5. Deletion on request
Email heemo521@gmail.com from the address on your license and ask us to delete your service data. We will delete your scan reports, license records, and log backups within 30 days, except records we must keep for legal or accounting reasons (for example, payment records held by Stripe). Deleting service data does not delete anything in your own WordPress database — that stays under your control.
6. Your visitors
If you use TidyConsent on your site, you decide what your site collects from visitors and you are responsible for your own privacy policy. The plugin's consent log (including the salted IP hashes) lives in your WordPress database. The only visitor-related data that can reach our service is the log backups described above, and only if you enable that Pro feature.
7. Changes and contact
We will post changes to this policy on this page with a new effective date. Questions or deletion requests: heemo521@gmail.com.
Effective date: November 12, 2026