user friendlyPLUGINS Explore plugins
USER FRIENDLY PLUGINS

Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data User Friendly Plugins collects through ufplugins.com and our plugins’ licence checks, why we collect it, and what your rights are.

Who is responsible

The controller is BAKED ENTERTAINMENT S.R.L., Str. Lizierei nr. 15B, Sat Bâcu, Comuna Joița, Județul Giurgiu, Romania (Trade Register J2022010382408, fiscal code 46227355), trading as User Friendly Plugins. For privacy questions or requests, email support@ufplugins.com.

What we collect and why

Your account. We collect your username, email address and password (stored hashed by WordPress, never in plain text). If you turn on two-step sign-in, we also store your authenticator secret and hashed recovery codes. We use these to run your account. Legal basis: our contract with you.

Purchases and subscriptions. Payments are handled by Link, a Stripe service, which is the merchant of record. When you check out, we send Stripe your email address and your account ID. From Stripe we receive your customer and subscription IDs, your plan, and the payment and renewal status we need to keep your licence correct. We never receive or store your card details. Legal bases: our contract with you, and our legal obligations, for example accounting.

Licences and activated sites. We store your licence (the key itself is encrypted), its site limit and its dates. For each site where you activate a plugin, we store:

  • the site address, encrypted;
  • a random installation ID;
  • whether it is a local or staging site;
  • the plugin, WordPress, PHP and WooCommerce versions;
  • when it was first activated, last checked and deactivated.

Our plugins send this when they activate, when they check the licence (about every 15 minutes), and when they look for updates. They do not send your store’s customers, orders, plugin settings or other content. The licensing system does not store IP addresses or browser details. We use this data to enforce site limits, deliver updates, and protect licences from misuse. Legal bases: our contract with you, and our legitimate interest in security.

Emails. We email you about your account, purchases, renewals and licence status. For each email we keep the recipient, subject, product and plan, and delivery status for 90 days. We don’t keep the email body, and licence keys never appear in our email logs. We send our emails through SendGrid, a Twilio service, which receives each email’s recipient, subject and content in order to deliver it. Our licence and purchase emails are sent with open and click tracking switched off. Other emails, such as password resets and the welcome email for new accounts, use SendGrid’s open and click tracking: it records when the email is opened and which of its links are clicked, and those links pass through SendGrid on their way to our site. Legal bases: our contract with you, and for this tracking, our legitimate interest in knowing that our emails arrive.

Security and audit records. Important actions are recorded in a tamper-evident log, for example activations, deactivations, revealing a licence key, and administrator changes. The log records account and activation IDs, not IP addresses, browser details or payment data. Legal basis: our legitimate interest in security, preventing fraud, and being able to show what happened.

Support. When you email us, we keep the conversation to help you. Legal basis: our contract with you, or our legitimate interest in answering you.

Bot protection. Our sign-in, account, password-reset and support forms use Cloudflare Turnstile to tell people from automated bots. When one of these forms opens, your browser loads Turnstile from Cloudflare (challenges.cloudflare.com), which processes signals such as your IP address, browser details (user agent and TLS fingerprint) and which website you are on. When you send the form, our server passes Cloudflare the one-time token from the check, together with your IP address, to confirm it. We don’t store the token, the result or your IP address, and Turnstile doesn’t load on our other pages. Cloudflare acts as our processor for this check, and as a separate controller when it uses these signals to improve its bot detection: see the Turnstile Privacy Addendum. Legal basis: our legitimate interest in protecting accounts and the site from automated abuse.

Analytics and advertising, only if you allow them. When you first visit, a banner asks whether we may use Google Analytics and Google Ads. Nothing from Google loads until you choose, and it never loads on your account, sign-in or password pages. You can change your choice at any time with Cookie settings at the bottom of every page.

  • If you allow Analytics, Google Analytics records which of our pages you visit, how you arrived (for example the referring site or ad campaign), your browser and device type, screen size, language, and an approximate location that Google derives from your IP address without storing the IP address. It also records three events: when you start a checkout, when you create an account, and when a purchase is confirmed. For these events we send the plugin, the plan, its list price and a random checkout ID, never your name, email address, account, licence key or site address. Google signals and user-provided data collection are switched off.
  • If you allow Advertising, the Google Ads tag records whether you reached us from one of our Google ads and later bought a licence (a conversion, with the same plugin, plan, list price and checkout ID), and may add your browser to lists that let us show our ads to past visitors on Google and partner sites. Enhanced conversions are switched off, so no email address or other customer data is sent to Google.

Our Google Ads account is held and paid for by BAKED GAMES S.R.L. (Romania, fiscal code RO44780714), which runs our advertising. Our Google Analytics property is linked to that account, so the ad reports there can also show Analytics totals for visits that came from our ads, such as engagement and pages viewed. Analytics data is not used to choose who sees our ads. BAKED GAMES sees these reports, such as how many purchases came from an ad and their value, but not who you are. Legal basis: your consent. You can withdraw it at any time, which does not affect what was collected before.

Server logs. Like any website, our hosting provider’s servers record standard request logs for security: IP address, time, page requested and browser. They are kept for a short period set by our hosting provider and used only to keep the service secure. Legal basis: our legitimate interest in keeping the service secure.

Cookies

Our fonts are hosted on our own server. These cookies are needed for the site to work and are always on:

  • WordPress sign-in cookies (wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie, wp-settings-*) keep you signed in.
  • ufpt_registration_browser protects the sign-up form from forgery. It expires after 2 hours.
  • A download cookie on downloads.ufplugins.com authorises a single plugin download. It expires after 5 minutes.
  • ufpt_consent remembers your cookie choice. It expires after 6 months, and then we ask again.

These are set only if you allow them in the cookie banner:

  • Analytics: _ga and _ga_LKWQ9P95RT (Google Analytics: tell visits apart and keep the session; up to 2 years), and ufpt_signup_event (tells the next page to count a new account; 10 minutes). We also keep a small note in your browser’s session storage so that the same plan is not counted twice as a started checkout.
  • Advertising: _gcl_au, _gcl_aw and similar _gcl_* cookies (Google Ads: link a purchase to the ad you clicked; 90 days). Google may also set or read its own cookies on its domains, such as google.com and doubleclick.net, to measure ads and show them to past visitors. See how Google uses information from sites that use its services.

When a purchase is confirmed, we keep a note in your browser’s local storage so that it is reported to Google only once. If you withdraw your consent, we delete the Google cookies set on ufplugins.com.

Stripe and Link set their own cookies on their checkout and billing pages.

Cloudflare Turnstile, on our sign-in, account, password-reset and support forms, sets no cookies on ufplugins.com. Its check runs in a frame from challenges.cloudflare.com, which may keep a small amount of data in your browser that the check needs to work.

Who we share data with

  • Stripe and Link handle payments, tax, fraud prevention, receipts and subscription management. They act as a separate controller for payment data: see Stripe’s privacy policy and Link’s privacy policy.
  • cyber_Folks S.R.L., in Romania, hosts our website and licence server.
  • SendGrid (Twilio Inc.), in the United States, delivers our emails. It receives the recipient, subject and content of each email: see Twilio’s privacy notice.
  • Google (Google Ireland Limited, Dublin, Ireland, and Google LLC), only if you allow analytics or advertising. Google Analytics processes data for us as our processor. For Google Ads conversion measurement and showing our ads to past visitors, Google acts as a separate controller: see Google’s privacy policy and Google’s business data protection terms.
  • BAKED GAMES S.R.L., in Romania, holds and pays for our Google Ads account and sees its ad reports, including Analytics totals for visits from our ads (no names or email addresses).
  • Cloudflare stores and delivers plugin downloads, and keeps backups of our audit log, in EU storage. It also runs Turnstile, the bot check on our sign-in, account, password-reset and support forms.

We don’t sell your personal data. We share data with Google for advertising only if you allow advertising cookies.

International transfers

Stripe, Cloudflare, SendGrid (Twilio) and Google are international companies and may process some data outside the European Economic Area, for example in the United States. Where they do, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.

How long we keep data

  • Account, licence and activation records: while your account is open, then up to 5 years for accounting, tax and legal claims.
  • Email delivery log: 90 days.
  • Google Analytics data: 14 months, then Google deletes it. Analytics cookies last up to 2 years, advertising cookies 90 days, and your cookie choice 6 months.
  • Download links: a few minutes.
  • Audit log: as long as we run the licensing service. It is tamper-evident and contains only account and activation IDs.
  • Support emails: up to 2 years after the conversation ends.

Your rights

You can ask us to:

  • give you a copy of your data, including in a portable format;
  • correct it;
  • delete it;
  • restrict how we use it;
  • stop using it where we rely on legitimate interests.

Email support@ufplugins.com and we will reply within one month. We may need to keep some records where the law requires it.

If you ask Link to delete your data, Link also cancels the subscriptions you bought through it, so those licences will not renew.

You can also complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro). You can also contact the authority in the country where you live.

Children

ufplugins.com is meant for businesses and adults. It is not intended for anyone under 16.

Changes

If we change this policy, we’ll update the date above. If the changes are important, we’ll also email you.