Privacy Policy

1. What data we collect

• Account data — your name, email address, optional company name, and password (stored only as a secure hash).
• Billing data — your subscription plan, billing history and payment status. Card details are handled directly by Stripe; we receive only limited information such as the last four digits and card brand.
• Server & usage data — the server we provision for you, its IP address, performance and uptime statistics, and logs needed to operate and secure the service.
• Support & chat data — tickets you open and the messages you exchange with our AI assistant (the bot), so we can act on your requests and improve the service.
• Technical data — session cookies and basic log information (such as IP address and browser type) when you use the panel.

2. Why we use it & legal basis

Under UK GDPR we rely on the following legal bases:

• Performance of a contract — to create your account, provision and manage your server, process your requests via the bot, and provide support.
• Legal obligation — to keep billing and tax records as required by law.
• Legitimate interests — to secure and monitor our platform, prevent abuse, and improve the service. We balance these against your rights.
• Consent — where required, for example certain non-essential communications. You can withdraw consent at any time.

3. Service providers (processors)

We share data with carefully chosen providers who process it on our behalf under appropriate data-processing terms:

• Stripe — payment processing and subscription billing.
• Postmark — transactional email (account, billing and support notifications).
• Hetzner — the cloud infrastructure provider that hosts your dedicated server.
• Cloudflare — CDN, DNS and security/edge protection.

Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent. [Confirm processor list, locations and transfer mechanisms.]

4. Cookies & sessions

The panel uses a strictly necessary, encrypted session cookie to keep you signed in. We do not use advertising cookies. Any analytics, if added in future, will be disclosed here and consented to where required. [Update if analytics or other cookies are introduced.]

5. Data retention

We keep account and billing data for as long as you have an account and then for as long as needed to meet legal and accounting obligations. Server backups are retained for 30 days. After you cancel, your server data is deleted following a short grace period (see our Refund & Cancellation Policy). Logs are kept only as long as needed for security and operations.

6. Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability; and
• withdraw consent where we rely on it.

To exercise any of these, email privacy@wpenguin.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Security

We use industry-standard measures to protect your data, including encrypted sessions, hashed passwords, optional two-factor authentication, and hardened, monitored infrastructure. No system is perfectly secure, but we work to reduce risk and respond promptly to incidents.

8. Changes to this policy

We may update this policy from time to time. The current version always lives here with its "Last updated" date. Material changes will be notified by email or through the panel.

9. Contact

For any privacy question, email privacy@wpenguin.com or contact@wpenguin.com.