Privacy Policy

This Privacy Policy explains how StoreSuite (“StoreSuite”, “we”, “us”, or “our”) collects, uses, and shares personal information when you visit storesuite.dev (the “Site”) or install and use the StoreSuite plugin (the “Plugin”). StoreSuite is a product of PluginizeLab, an independent software studio founded and run by Md Aminur Islam.

Two things are worth stating up front, because they shape everything below. The Site has no accounts and no checkout, but it does run Google Analytics, which sets cookies and tells Google something about your visit - section 2 describes exactly what. The Plugin runs entirely on your own server and sends us nothing at all.

1. Information We Collect

Information you provide to us. There is no account system and no shopping cart. The contact form sends us what you type into it - name, email, subject, how you found us, and your message - by way of our own WordPress site, which runs Contact Form 7 and delivers it to us by email. Contact Form 7 may also record the submitting IP address and browser string.

The newsletter field in the footer takes your email address and nothing else. It goes to the same WordPress site, which passes it to Brevo, the email service that stores the list and sends the mail; Brevo processes it under its own privacy policy. Subscribing is the only thing that address is used for, and you can unsubscribe from any message we send.

Cloudflare Turnstile protects both forms; see section 2.

Information collected automatically. The Site is a static website hosted on Cloudflare Pages. As with any web host, our host processes standard request data - IP address, browser and device type, requested URL, referring URL, and timestamp - in server logs, in order to deliver pages and protect against abuse. We do not use log data for marketing or build visitor profiles from it. Recognising a returning browser is Google Analytics’ doing, not our host’s, and is covered next.

2. Cookies, Analytics, and Third-Party Scripts

Google Analytics. Every page loads Google Analytics 4 (G-3FXC2H2L90) from Google’s servers, so requesting a page here also contacts Google. It sets _ga and _ga_<id> cookies holding a randomly generated identifier - that is what counts your return visit as the same visitor rather than a new one. It is not your name or email, and we have no account system to link it to.

Google processes your IP address, an approximate location derived from it, your browser and device type, the pages you view, the referring URL, and time on page. We see only the aggregate: page counts, country and city, browser breakdowns, and where visitors arrived from. Our tag is the standard snippet - one config call, no custom events, no identifiers of our own, nothing else uploaded. Event-level retention follows the period configured on the Analytics property.

Opting out. Install Google’s opt-out add-on or block the tag with any content blocker. Nothing here depends on Analytics, so the Site works identically either way. Google’s own terms: Privacy Policy and how Google uses this data.

Cloudflare Turnstile. Both the contact form and the newsletter field are protected by Turnstile, loaded from challenges.cloudflare.com. Cloudflare receives your IP address and browser signals to decide whether you are a person, and may set a short-lived cookie. The widget is not loaded with the page: it appears only once you engage with one of those forms, so simply reading the Site never contacts Cloudflare for it. See its Privacy Policy.

Nothing else runs. No advertising tracker, pixel, session recorder, or A/B script. Fonts are self-hosted, so loading a page does not report your visit to a font vendor. Your appearance choice is saved locally under theme, and documentation search runs in your browser against a pre-built index - neither leaves your device.

3. Account and License Data

There is none. StoreSuite has no user accounts, no licence keys, no activation server, and no login on this Site. Nothing about your installation is registered with us.

4. Payments

We take no payments. StoreSuite is free and open source, distributed through WordPress.org, with no paid tier, subscription, or upsell. We operate no payment processor and hold no billing information whatsoever.

5. Plugin Data

Store and customer data. Everything the Plugin touches - products, orders, customers, coupons, and analytics - is read from and written to your own WordPress database, on your own hosting. It is processed locally within your store. We never receive it and have no technical means of accessing it.

Telemetry and usage data. The Plugin collects no telemetry. There is no usage reporting SDK, no version check, no install tracking, and no phone-home of any kind.

AI generation. This is the one place data leaves your server, so please read it carefully. StoreSuite’s AI features are built on the WordPress core AI Client and Connectors API, and you bring your own provider and your own API keys. When you use a generate action, the input involved - your hint, product title, selected categories, an existing description, or an image prompt - is sent from your server directly to the AI provider you configured in WordPress, authenticated with your credentials.

Consequently, that data is handled under your provider’s privacy policy and retention terms, not ours; review them before enabling AI on real customer or product data. Your API keys are stored by WordPress on your server, and StoreSuite transmits them only to the provider you selected. No AI request is routed through us, and we see none of it. If no provider is configured, no request is made and the AI controls hide themselves. Generated images are held server-side in a short-lived transient for preview, and are written to your media library only when you choose to insert them.

Access control. Dashboard access is gated on the WordPress manage_woocommerce capability - normally administrators and shop managers. Deciding who holds that capability on your site is your responsibility as the site operator.

6. Communications

If you write to us, we use your address to reply and for nothing else, and we never add it to the mailing list. Subscribing to release updates is a separate, deliberate act: the address you enter in the footer is used only to send those updates, every message carries an unsubscribe link, and unsubscribing removes you from the list. We do not sell or rent addresses from either route.

7. Support Access and Logs

Support happens in public on the WordPress.org support forum. We do not request, and will never ask for, your site credentials. If you voluntarily share screenshots, logs, or error output in a support thread, remove customer data and API keys first - those threads are publicly visible.

8. Sharing Your Information

We do not sell personal data. The third parties involved are Google, which receives the Analytics data described in section 2 on every page view; Cloudflare, both as our host and as the provider of the Turnstile check; Brevo, which stores newsletter subscribers and sends the mail; our own WordPress site and its email delivery, which carry form submissions to us; and legal authorities, where we are legally required to respond. Your AI provider is not on this list, because we never send anything to them - your server does, under your own account.

9. International Data Transfers

Our host, Google, and Cloudflare all operate globally and are US-based, so the data described above may be processed in the United States or elsewhere, under those providers’ own safeguards and transfer mechanisms.

10. Your Rights

Depending on where you live, you may have rights under the GDPR, UK GDPR, or CCPA/CPRA to access, correct, delete, or object to the processing of your personal data. Because we hold very little, most such requests resolve quickly. Contact us at the address below to exercise them - or, for Analytics specifically, use the opt-out in section 2, which needs no request to us.

For data inside your own store, you are the data controller and we are not a processor, because that data never reaches us. Requests from your customers are handled through WordPress and WooCommerce’s built-in privacy tools, exactly as they would be without StoreSuite installed.

11. Data Retention

Server logs are retained by our host for a short period under their standard policy. Analytics data is retained by Google for the period configured on the property. Contact-form submissions stay in our email for as long as the conversation is useful, and are deleted on request. Newsletter addresses stay in Brevo until you unsubscribe or ask us to delete them. Outside those there is nothing further to keep - no profiles, no account records, nothing from the Plugin.

12. Minors

StoreSuite is a business tool and is not intended for individuals under the age of 18. We do not knowingly collect their information.

13. Changes to This Policy

We may update this policy from time to time. Material changes are reflected in the effective date at the top of this page.

14. Contact Us

For questions about this policy, please contact us at [email protected]. For questions about the Plugin itself, the WordPress.org support forum is usually the better place - the answer there helps everyone.