Last updated: 2026-09-22. This policy describes what TillFoundry actually collects, in the order the system collects it.
Who is responsible
[LEGAL ENTITY NAME], trading as TillFoundry, [REGISTERED ADDRESS], Netherlands. Chamber of Commerce (KVK) number [KVK]. VAT number (BTW-id) [BTW]. Contact: [email protected].
We are the data controller for the information described below.
What we collect, and why
When you place an order
Your name, email address, billing address, and order history. Collected by WooCommerce on our own server. Why: to perform the contract — we cannot deliver a licence without knowing who bought it and where to send it. Basis: contract.
Your payment
Card details are entered directly with Stripe and never reach our server or our database. We receive only a payment confirmation and the last four digits. Basis: contract.
Your licence
The licence key, which plugin it is for, its tier, status and expiry date, and a reference to the order that created it. Why: to operate the licence. Basis: contract.
When you activate a licence
This is the part most plugins do not tell you about, so we will be specific. Every time a plugin validates its licence, our server records:
- the site URL and home URL of the installation;
- the WordPress version, PHP version and plugin version;
- whether the site is multisite, and its locale;
- the IP address the request came from, and when it was last seen.
Why: to count activations against your licence limit, so a licence cannot be used on more sites than it was sold for; to tell your WordPress installation when an update is available; and to diagnose faults. Basis: contract, and our legitimate interest in preventing licence abuse.
Server and security data
Our site is behind Cloudflare and our server keeps standard access logs, which include IP addresses and browser user-agent strings. We also count requests per IP to block abuse of the licence API. Basis: legitimate interest in keeping the service available and secure.
What we do not collect
We run no analytics, no advertising and no tracking on this site. There is no Google Analytics, no advertising pixel, and no third-party tag manager. We do not build profiles of your customers, and we never see the contents of your store — only the site URL and version numbers listed above.
Who we share it with
- Stripe — payment processing.
- Zoho — sending transactional email such as licence keys and receipts.
- Cloudflare — content delivery, DDoS protection and bot filtering; all traffic passes through them.
- Our hosting provider (Contabo) — the server the site runs on.
We do not sell your data, and we do not share it for advertising. Some of these providers are established in the United States; transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
How long we keep it
- Order and licence records: seven years. Dutch tax law requires us to retain financial records for this period, and we cannot delete them earlier even on request.
- Activation records: while the licence is active, plus twelve months.
- Server access logs: thirty days.
- Support email: three years, so we can see the history of an issue.
Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. Write to [email protected] and we will respond within one month. Where processing rests on consent you may withdraw it at any time.
We do not make automated decisions that have a legal effect on you. Our licence server makes an automated decision about whether a key is valid, which is the service you asked for; if it refuses a legitimate key, a human will fix it.
If you are unhappy with our handling, you may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security
Data is transmitted over encrypted connections and stored on a server that is not publicly reachable except through Cloudflare. Access is restricted to the operator. If a breach affects you, we will tell you and the supervisory authority as required.
Children
This service is for businesses and is not intended for anyone under 16.
Changes
If we change this policy in a way that affects you, we will note the date at the top and, for material changes, email licence holders.