Privacy Policy

1. Who We Are

dRM Plugins is a trading name of Rahul Muralidharan, a sole trader operating in the United Kingdom. We are the data controller for personal data collected through this website and our products.

We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we serve customers in the European Union, we also comply with the EU GDPR (2016/679).

2. Data We Collect

2.1 Account & Purchase Data

When you create an account or make a purchase, we collect:

• Name — to identify your account and personalise communications.
• Email address — for account authentication, license delivery, transactional emails, and support.
• Billing address — required for tax compliance and invoicing.
• Payment information — handled entirely by Stripe. We never see, store, or process your raw card details. Stripe provides us with a tokenised reference and limited card metadata (last 4 digits, expiry, card type) for display purposes only.

2.2 License & Activation Data

When you activate a product license on a WordPress site, our License API collects and stores:

• Site URL / hostname — to validate and enforce activation limits.
• WordPress version — for compatibility tracking.
• WooCommerce version — for compatibility tracking.
• PHP version — for compatibility tracking.
• Plugin version — to serve appropriate updates.
• Activation timestamp and deactivation timestamp — for license audit and abuse prevention.

We do not collect the content of your website, your customers' personal data, order data, product data, or any other WooCommerce store information. Our plugin only communicates with our License API for validation and update checks.

2.3 Support Communications

When you contact us by email, we retain the contents of that correspondence, including your name, email address, and any information you choose to share, for the purpose of resolving your enquiry and maintaining a support history.

2.4 Technical & Usage Data

When you visit our website, we automatically collect:

• Device and network information (including IP address processed by Google Analytics for geolocation and security purposes).
• Browser type and version
• Operating system
• Pages visited, referrer URL, and time on page — via Google Analytics.
• Approximate geographic location (country/city level) — derived from IP address by Google Analytics and Cloudflare.

3. How We Use Your Data

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not send marketing emails, newsletters, or promotional communications. All emails we send are transactional and directly related to your account or purchase.

4. Legal Basis for Processing (UK & EU GDPR)

We rely on the following lawful bases:

• Contract performance (Article 6(1)(b)): Processing necessary to fulfil your purchase, deliver your license, and provide support.
• Legal obligation (Article 6(1)(c)): Processing required to comply with tax law, financial record-keeping obligations, and other applicable regulations.
• Legitimate interests (Article 6(1)(f)): Fraud prevention, abuse detection, security, and website analytics — where these interests are not overridden by your rights and freedoms.
• Consent (Article 6(1)(a)): For non-essential cookies (Google Analytics). You may withdraw consent at any time.

5. Third Parties & Data Processors

We use a small number of carefully selected third-party services to operate our store. Each acts as a data processor on our behalf and is contractually bound to protect your data:

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertisers.

5.1 Business Transfers

If our business is sold, merged or reorganised, customer information may be transferred to the new owner as part of that transaction, subject to this Privacy Policy.

6. International Data Transfers

Some of our data processors are based in the United States. Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place:

• Adequacy decisions — where the destination country has been recognised as providing adequate data protection.
• Standard Contractual Clauses (SCCs) — the EU/UK-approved contractual mechanism for international transfers where no adequacy decision exists.
• EU-US Data Privacy Framework — for processors certified under this framework (Stripe, Google).

You may request details of the specific transfer mechanisms in place for any processor by contacting us at support@drmplugin.com.

7. Data Retention

Certain financial records may be retained for longer where required by tax or accounting legislation. When data is no longer required, it is securely deleted or anonymised. You may request earlier deletion subject to our legal obligations (see clause 8).

8. Your Rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@drmplugin.com. We will respond within 30 days. We may need to verify your identity before processing your request.

We will not charge a fee for reasonable requests. If a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or decline to act.

9. Cookies & Analytics

9.1 What Are Cookies

Cookies are small text files stored on your device by your browser. We use a minimal set of cookies to operate our store and understand how visitors use our website.

9.2 Cookies We Use

9.3 Google Analytics

We use Google Analytics 4 to understand how visitors interact with our website. We have configured Google Analytics with IP anonymisation enabled. Analytics cookies are only set with your consent. You can opt out at any time by installing the Google Analytics Opt-out Browser Add-on or by managing your preferences through your browser settings.

9.4 Managing Cookies

You can control and delete cookies through your browser settings. Note that disabling strictly necessary cookies (authentication) will prevent you from logging into your account. Disabling analytics cookies has no effect on your ability to use the store.

10. Children's Privacy

Our store and products are intended for use by adults only. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us at support@drmplugin.com and we will delete it promptly.

11. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted data transmission via HTTPS / TLS on all endpoints.
• Authentication credentials are managed by Clerk using industry-standard security practices. We do not store customer passwords.
• Payment card details are processed directly by Stripe. We do not store or have access to your full payment card details.
• Access to customer data restricted to authorised personnel only.
• We maintain regular backups as part of our operational security practices.
• Error monitoring via Sentry to detect and respond to technical issues promptly.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Where changes are material, we will notify you by email or by prominent notice on our website before the changes take effect. The "Last Updated" date at the top of this page indicates when the policy was last revised.

The updated Privacy Policy will apply from the stated effective date.

13. Contact & Complaints

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Supervisory Authority

If you are based in the UK and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

If you are based in the EU, you may lodge a complaint with your local data protection authority. A full list of EU supervisory authorities is available at edpb.europa.eu.