WPComfy Tell us about your site
  1. WPComfy
  2. Privacy Policy

Privacy Policy

This policy explains what personal data we collect when you use this website and our services, why we collect it and what rights you have.

1. Controller

The controller of your personal data is Esumo sp. z o.o., Gałczyńskiego 14, 05-091 Ząbki, VAT ID PL1251686662. For any privacy question, write to jay@wpcomfy.com.

2. What we collect and why

  • Contact form. Your name, email, company, website address and the details you write in the form — to answer your enquiry and, if you ask, prepare an offer. Legal basis: steps at your request before a contract and our legitimate interest in responding (Art. 6(1)(b) and (f) GDPR).
  • Orders and your account. Your name, email, company, billing address, VAT ID, the website you want us to look after, and details you give during site setup — to provide the service, manage your subscription and issue invoices. Legal basis: performance of a contract and legal obligations such as tax and accounting rules (Art. 6(1)(b) and (c) GDPR).
  • Payments. Payments are handled by Stripe. We receive confirmation of payment and limited card details such as the brand and last four digits; we never see or store full card numbers.
  • Communication. Emails you exchange with us, to provide support and keep a record of agreed work (contract and legitimate interest).
  • Analytics. We use Plausible Analytics to understand how the website is used. Plausible does not use cookies and does not collect personal data; statistics are aggregated. Legal basis: legitimate interest.
  • Video. The short video on our homepage is streamed by Bunny.net (BunnyWay d.o.o., Slovenia, EU) only after you press play. Bunny processes your IP address and technical data needed to deliver the video; we do not use it to track you. Legal basis: legitimate interest.
  • Free site check. The website address you check, your email address and whether you agree to a follow-up — to run the check, email you a copy of the report and, only if you tick the box, follow up about it. To limit abuse we briefly keep a one-way hash of your IP address. The website address, not your email, is sent to Google PageSpeed Insights to measure its speed. Legal basis: steps taken at your request (Art. 6(1)(b) GDPR), our legitimate interest in preventing abuse (Art. 6(1)(f)) and, for follow-ups, your consent (Art. 6(1)(a)), which you can withdraw at any time by replying to any of our emails.
  • Spam protection. The contact form uses Cloudflare Turnstile to tell people from automated spam. When the form loads, Cloudflare processes your IP address and technical details about your browser and device; it does not use them for advertising. Legal basis: our legitimate interest in keeping the form free of spam (Art. 6(1)(f) GDPR).
  • Server logs. Our hosting provider keeps technical logs, including IP addresses, for security and to keep the site running (legitimate interest).

3. Cookies and similar technologies

We use only the cookies needed for the website to work: cookies that keep your basket and checkout session (set by WooCommerce), keep you logged in to your account, and allow Stripe to process payments securely and prevent fraud. We do not use advertising or analytics cookies. If you dismiss an announcement on the site, your browser remembers that choice in local storage; it contains no personal data.

4. Who we share data with

We share personal data only with providers that help us run the service, under data processing agreements where required: our hosting provider, Stripe (payments), our email and invoicing providers, Bunny.net (video delivery, EU), Plausible Analytics (hosted in the EU) and Cloudflare (spam protection on the contact form). We may disclose data where the law requires it. We do not sell personal data.

Some providers, such as Stripe and Cloudflare, may process data outside the European Economic Area. In those cases transfers rely on safeguards recognised under the GDPR, such as the EU–US Data Privacy Framework or standard contractual clauses.

5. How long we keep data

  • Contact enquiries that do not lead to an order — up to 12 months after our last exchange.
  • Account and subscription data — for as long as you have an active account, and afterwards for as long as needed to resolve any claims.
  • Invoices and accounting records — for the period required by tax law, generally five years from the end of the year in which the tax obligation arose.
  • Free site checks — the report for 90 days. If you did not agree to a follow-up and we have not been in touch since, the whole request is deleted at that point too. Abuse-prevention counters expire within 24 hours.

6. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. To exercise your rights, write to jay@wpcomfy.com. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

7. Data on client websites

When we maintain your website, we may have access to personal data of your customers or users stored there. In that role we act as your processor, only on your instructions, and we will sign a data processing agreement on request.

8. Changes to this policy

We will update this policy when our practices change and show the date of the latest version below.

Last updated: 26 September 2026.