1. Who we are
WP Citadel is a trade name of Mike Pluijlaar, a self-employed freelancer based in the Netherlands.
- Email: contact@wpcitadel.com
2. Data we collect
When creating an account
- Name
- Email address
- Password (hashed)
When using Google or GitHub Single Sign-On (SSO)
- Name
- Email address
- Provider-specific account ID
- Profile picture (if available)
Through the WP Citadel plugin
- Website URL and domain name
- Server IP address
- WordPress and PHP version
- Installed plugins and versions
- Uptime status
- Relevant technical error logs
Automatically when using the service
- IP address during login attempts
- Log data (timestamp, action type)
- Browser information for Cloudflare Turnstile
3. Why we process your data
- To provide and operate the WP Citadel service
- To ensure security and prevent abuse
- To communicate about your account
- To process billing via LemonSqueezy
4. Legal basis
- Performance of a contract
- Legitimate interest (security)
- Legal obligation (billing administration)
5. Retention periods
- Account and site data: retained while your account is active
- After deletion: permanently removed within 30 days
- Invoice data: retained for 7 years
6. Sharing with third parties
- LemonSqueezy — payment processing and license management
- Mailgun (Sinch) — transactional email delivery (EU–US Data Privacy Framework certified)
- Cloudflare Turnstile — bot detection (no personal data stored)
- Google Identity Services — SSO authentication
- GitHub (Microsoft) — SSO authentication
Data Processing Agreements are in place with all processors. Your data is never sold or rented.
7. Where data is stored
- Hetzner servers located in Finland and Germany
- All data remains within the European Union
- Umami analytics is hosted on our own EU infrastructure
8. Security
- HTTPS/TLS encryption
- Password hashing
- Login throttling
- SSRF protection
- Laravel Sanctum for API authentication
9. Your rights (GDPR)
- Access
- Rectification
- Erasure
- Objection
- Data portability
10. Cookies and analytics
- Only functional cookies are used (session cookies for authentication)
- No tracking or advertising cookies
- Umami uses no cookies and collects no personally identifiable information
11. Automated decision-making
We do not make decisions based on automated processing that have legal or significant effects.
12. Complaints
You may file a complaint with the Dutch Data Protection Authority or your local supervisory authority.
13. Data Processing Agreement
If you use WP Citadel to monitor WordPress installations that process personal data, we act as your data processor under GDPR. Our Data Processing Agreement (DPA) outlines the specific obligations and security measures we implement to protect the data you entrust to us.
14. Changes
This privacy policy may be updated. The latest version is always available on this page. For significant changes, we will notify you by email.