Privacy Policy
Last updated: September 2026
This policy explains what personal data we process when you use wexofy.com, buy or use our plugins, or contact us, why we do it and what your rights are. We follow the EU General Data Protection Regulation (GDPR) and Lithuanian law.
1. Who is responsible
The controller is MB Fungusas, company code 306354172, Svyturio g. 28, Noreikiškės, Lithuania. For anything about your data write to info@wexofy.com.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account and order data — name, e-mail, billing address, company name and VAT number if you enter them, order history, licence keys | Take and fulfil your order, deliver licence keys and downloads, issue invoices, renewal reminders | Contract (Art. 6(1)(b)); legal obligation for invoices and accounting (Art. 6(1)(c)) |
| Payment data — handled by Stripe; we receive only the payment status, the last card digits and card brand, never the full card number | Take payment, prevent fraud, handle refunds | Contract; legitimate interest in fraud prevention (Art. 6(1)(f)) |
| Licence activation data — your site address, plugin name and version, WordPress and PHP version, sent by the plugin when you activate a key, check for updates or use the Hub | Enforce the site limit of the licence, deliver updates, provide support | Contract; legitimate interest in protecting our licences (Art. 6(1)(f)) |
| Sign-in with Google or Facebook — the provider tells us your name, e-mail address and a provider ID after you approve the sign-in | Create and recognise your account without a password | Contract; your request to use the sign-in method |
| Contact form, e-mails and support requests — name, e-mail, licence key and message | Answer your question and provide support | Contract or pre-contract steps; legitimate interest (Art. 6(1)(f)) |
| Waitlist and launch e-mails — e-mail address you give for a coming-soon plugin | Tell you when the plugin launches | Consent (Art. 6(1)(a)) — withdraw at any time |
| Newsletter — e-mail address you enter in the sign-up form, the date you confirmed it, and the page you signed up on | Send release notes and WooCommerce tips; you confirm through a link in an e-mail before anything is sent, and every mailing has an unsubscribe link | Consent (Art. 6(1)(a)) — withdraw at any time |
| Review request e-mail — the e-mail address and plugin of a purchase | Send one e-mail some weeks after a purchase asking how the plugin is working and inviting a review | Legitimate interest (Art. 6(1)(f)) in feedback from our own customers; one e-mail per licence, and you can object at any time |
| Affiliate applications — name, e-mail, website, payout details (bank or PayPal), referrals and commissions | Run the affiliate programme, pay and account for commissions | Contract; legal obligation for accounting |
| Analytics and advertising data — pages viewed, approximate location, device and browser, how you arrived, whether an ad led to a purchase; collected through cookies (see Cookie Policy) | Understand how the site is used, improve it, measure our advertising | Consent (Art. 6(1)(a) and the ePrivacy rules) — only after you accept in the cookie banner |
| Technical logs — IP address, request time, browser, security events | Keep the site secure and working | Legitimate interest (Art. 6(1)(f)) |
You are not obliged to give us personal data, but without the data marked as contract data we cannot sell you a licence or deliver updates. We do not make decisions about you by fully automated means and we do not sell your personal data.
3. Who receives your data
We share data only with service providers that help us run the store, under contracts that bind them to protect it:
- Hostinger — web hosting, database and e-mail delivery;
- Stripe — card and wallet payments (Stripe is also an independent controller for its own fraud and compliance duties);
- Google — Google Analytics and Google Ads measurement (only with your consent), Google Sign-In if you use it, and Google Fonts, which serve the typefaces used on this site and therefore receive your IP address when a page loads;
- Meta Platforms — Facebook Login, only if you choose it;
- Automattic / WooCommerce — WooCommerce Analytics (only with your consent) and Jetpack services;
- our accountants and advisers, and authorities where the law requires it.
Some of these providers are in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.
4. How long we keep it
- Invoices and accounting records: 10 years, as required by Lithuanian accounting law.
- Account, licence and activation records: while your account or licence exists, and afterwards for as long as needed to handle claims (generally up to 3 years).
- Contact and support messages: up to 2 years after the last message.
- Waitlist e-mails: until the plugin launches or you unsubscribe, whichever is earlier.
- Analytics data: as set in our analytics account, at most 14 months.
- Cookies: for the periods listed in the Cookie Policy.
5. Your rights
You can ask us at any time for access to your data, correction, erasure, restriction of processing, a portable copy, and you can object to processing based on our legitimate interests. Where we rely on consent (waitlist, analytics and advertising cookies) you can withdraw it at any time; withdrawing does not affect what happened before. Write to info@wexofy.com; we answer within one month. Some data (invoices) we must keep by law even after you ask for deletion.
You also have the right to complain to a supervisory authority. In Lithuania that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, Vilnius, vdai.lrv.lt, or the authority in your own country.
6. Security
The site is served over HTTPS, access to the admin area is limited and protected, licence downloads use signed, time-limited links, and card data never touches our servers. No system is perfectly secure; if a breach puts your rights at risk we will notify you and the authority as the law requires.
7. Children
Our products are for businesses and website owners. We do not knowingly collect data from anyone under 16.
8. Changes
We will update this page when what we do with data changes and change the date at the top.