Privacy notice

Wrizu Page Builder Extensions is made and licensed by Wrizu Jakub Czuczwara, al. Rzeczypospolitej 6/74, 02-972 Warszawa, Poland (“Wrizu”, “we”, “us”). We are the controller of the personal data this notice describes.

The notice covers this website, the documentation, the licence server and the licence panel, our helpdesk and the demo store. It does not cover your shop: whatever your storefront collects stays in your Magento installation, we never receive it, and you are its controller.

For anything about your data, write to contact@wrizu.net.

We collect only what the licence, the downloads and support need — and how this website is used, within the limits of section 9.

• Your purchase. From Paddle, our merchant of record (section 4): the e-mail address you bought with, your name as you entered it at checkout, Paddle's customer and order references, the plan, the amount and currency, and the dates of the purchase and of any refund. We use them to issue your licence key and send it to you, to sign you in to the licence panel, to give support and to handle refunds and chargebacks. Legal basis: the contract with you (Article 6(1)(b) GDPR).
• Your licence and its activations. The licence key, the plan and the update window, and for every activation the domain, its role (production or staging), the installation identifier, the Magento and module versions and the dates of activation, release and the last check. We use them to run the licence — the contract with you — and to stop one key being shared between many shops, which is our legitimate interest (Article 6(1)(b) and (f) GDPR).
• Installations without a licence. A module that is installed but not activated reports its domain, its installation identifier and the versions at most once a day (section 3). We use this to know where the module runs without a licence, and we contact such a shop only through the public details of its domain. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• Use of the licence panel. When you sign in, download a release, create or revoke a Composer token, release a domain or ask for your key again, we record what happened, when, from which IP address and in which browser. This protects the panel and is our evidence if a dispute arises — our legitimate interest (Article 6(1)(f) GDPR).
• E-mails we send you. Only messages about your purchase and your licence: the licence key after the purchase, the key again when you ask for it in the panel or with “I lost my key” and, should it ever be needed, a notice about your licence — for example a new version of its agreement. No newsletters and no marketing; these e-mails carry nothing that tracks whether you opened them.
• Support messages. What you enter in the support form or write to us — section 5.
• Visits to this website. Like every web server, our hosting provider's server records each request — the IP address, the time, the address requested and the browser — in access logs kept for a limited period for security and troubleshooting, as set by the provider. We may also measure your visits with Google Analytics, to see which pages are read and where visitors come from (section 9): in the EEA, the UK and Switzerland only after you allow analytics in the cookie window, elsewhere from your first page view unless you refuse analytics there. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time; for the signals Google's tag sends without a cookie while analytics is not allowed, and for the measurement before your choice outside those countries, our legitimate interest in counting visits (Article 6(1)(f) GDPR).

The module contacts our licence server only when a person activates or releases a domain, about once every 24 hours while it is activated (from Magento's cron), when its licence screen is opened in the admin, and — while it is installed but not activated, outside development domains — at most once every 24 hours while the admin is in use. It sends only:

• the domain of your shop;
• an installation identifier — a one-way hash of your installation's encryption key, which tells installations apart without revealing anything about them;
• the Magento and module versions;
• the current licence token;
• on activation and release only, the licence key and the role (production or staging) or the reason for the release.

It never sends e-mail addresses, customer, order or product data, or page content. A visit to your storefront never makes a request, and on a development domain (such as .local, .test or localhost) the module sends nothing at all. Like any server, ours sees the IP address of the server that makes the request. We do not store it with your activation; only a request we turn down leaves a log line with a one-way hash of it.

The same in more detail, with the reasons: What your shop sends us.

Paddle (paddle.com) sells the licence as our reseller and merchant of record. Paddle collects your payment details, billing details and tax information, charges the price, calculates VAT and issues the invoice and the receipt — under its own privacy notice and its Buyer Terms. For that data Paddle is a separate controller, not our processor.

Paddle sends us what we need to issue your licence: the order (the plan, the amount, the currency and the dates), your customer reference and, in a separate notification, your e-mail address and name. We keep each of these notifications for 395 days — a year plus a margin for a dispute about a refund. Your card number never reaches us. Paddle's notification also names the payment method (the card type and its last four digits); we delete that part before we store the notification.

When Paddle refunds a purchase in full or reports a chargeback, it tells us, and the licence ends (the terms and refunds page).

The support form in the documentation sends your message to our licence server first. The server checks the licence key if you gave one, stores it only masked (WRZ-3K7M-****-****-7VB5) — a key pasted into the message itself is masked too, before anything is saved — and passes the message on to our helpdesk, FreeScout, which runs on our own hosting. E-mails to our support and sales addresses arrive in the same helpdesk.

• On the licence server a short record of each request stays for 395 days — its number, when it arrived, where it went, the masked key and one-way hashes of your e-mail address and your IP address — so we can prove it reached us and spot abuse. The message itself is deleted from there as soon as it is in the helpdesk, and after 30 days at the latest; the hash of your IP address after 30 days.
• In the helpdesk the conversation — your name, your e-mail address, your messages and our replies — stays so we can answer and follow up. Closed conversations are deleted 24 months after they are closed. Our replies carry nothing that tracks whether you opened them.
• To answer you, and for nothing else. Your message, name and e-mail address are never added to a mailing list. Legal basis: the contract with you if you are a customer (Article 6(1)(b) GDPR), otherwise our legitimate interest in answering a question put to us (Article 6(1)(f) GDPR).

This website, the documentation, the licence server, the helpdesk and our e-mail run on the servers of cyber_Folks S.A. in Poland; the demo store runs on a virtual server of OVH SAS in France. Both keep the data in the European Economic Area.

• Your licence and purchase records — the e-mail address, the name, the plan and the activations — stay for as long as the licence exists. A licence has no end date, so that is as long as we run the licence server. After a full refund or a chargeback we keep the record for 395 days, in case of a dispute, then remove the e-mail address, the name and the activations from it.
• Paddle's notifications about your order — 395 days.
• Records of panel use and downloads (the time, the IP address, the browser) are deleted after 12 months.
• Installations without a licence are deleted 12 months after the last report.
• Support requests — on the licence server and in the helpdesk as in section 5.
• What Google Analytics records — 2 months, then Google deletes it; only reports with totals (visits per page, per country) stay.

• Paddle, as a separate controller of the payment (section 4).
• Our hosting providers, who store the data on our behalf as our processors.
• Google (Google Ireland Limited, Dublin, Ireland), which runs Google Analytics for us as our processor when we use it (section 9).

Nobody else. We do not sell personal data, share it with advertisers or use it to build profiles.

Our hosting providers keep the data in the European Economic Area (section 6). Two recipients may process it outside: Paddle and Google. Paddle: Paddle.com Market Ltd, London, United Kingdom (an adequacy decision of the European Commission covers the UK); Paddle's own privacy notice says where else it processes payment data. Google may process analytics data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, which an adequacy decision of the European Commission covers.

Under the GDPR you may ask us for access to your data, for a copy of it in a portable format, to correct it, to delete it or to restrict its use, and you may object to the uses based on our legitimate interest. Where we rely on your consent — Google Analytics on this website — you may withdraw it at any time, as section 9 describes; that does not affect what was recorded before. Write to contact@wrizu.net; to protect your licence we may ask you to write from the e-mail address you bought with. We answer within one month.

Some of the data is needed for as long as you use the licence: without the e-mail address you bought with you cannot sign in to the licence panel, and without the licence record the module cannot be activated.

You may also complain to a data protection authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) — or to the authority of the country where you live or work.

• This website sets one cookie of its own, mfnConsent, when you answer its cookie window: it holds your answer and nothing else, and it expires after one year. It uses no marketing or advertising cookies and no tracking pixels, and even its fonts come from this website. The checkout on the Pricing page is Paddle's; its script loads only when you press a buy button and then sets the cookies Paddle needs to run the checkout and prevent fraud (Paddle's cookie policy lists them).
• Google Analytics, if we use it on this website (we add it through Google Site Kit), sets the cookies _ga and _ga_ followed by an identifier, kept for up to two years, which give your browser a random identifier. If you are in the EEA, the UK or Switzerland, it sets them only after you allow analytics in that window; elsewhere it may set them from your first page view, until you refuse analytics there. With them Google Analytics records the pages you view, how you reached them and how long you stay, your browser and device, and your approximate location, which it works out from your IP address — Google Analytics does not log or store the IP address itself. Google Ireland Limited processes this for us (section 7). While analytics is not allowed, Google's tag may still load, but it sets no cookie and sends Google only a signal without an identifier: the address of the page, the time, your browser and the choice you made (Google calls this consent mode).
• Changing your mind. To withdraw your permission, open the cookie window again with the round button in the bottom-left corner of any page and press Deny. Deleting this website's cookies in your browser brings the window back.
• The documentation sets no cookies. If you switch between its light and dark mode, your browser remembers the choice in its own storage.
• The licence panel sets two cookies it needs to work: a session cookie that keeps you signed in and a security cookie that protects its forms. Neither is used for tracking.
• The demo store sets the cookies and browser storage Magento uses to run a shop — the session, the cart and the recently viewed products. Its video examples load a YouTube or Vimeo player, or a sample video file, only after you press play; that player then follows the rules of YouTube or Vimeo.

We change this notice when what we do with data changes; the date at the top says when it last changed. Earlier versions are available on request.

Wrizu Jakub Czuczwara, al. Rzeczypospolitej 6/74, 02-972 Warszawa, Poland — contact@wrizu.net.

Questions about the module or your licence reach us fastest through the support form.