Privacy Policy
Last updated 20 October 2026
The short version: no tracking on this website, nothing sold, and the plugin sends us only what each feature needs to work. Here is exactly what that is, who else handles it and how long we keep it. Also see our Terms of Service.
1. Who is responsible
TheDevGarden, Bangladesh, runs this website and the WP SecureGate online services, and is responsible for the personal data described here. Contact us about privacy at [email protected].
2. What we collect on this website
Your account and purchases
Your email address and name, a password hash (we never store the password itself), your licences, plan and site limit, and the address of each site you activate. Payments are handled by our reseller Dodo Payments: we receive its customer, subscription and payment references and the amount paid, but never your card or bank details.
Signing in
To stop password guessing, we record failed sign-in attempts against the email address tried and the IP address they came from (for IPv6, the network rather than the full address). These records are removed when you sign in successfully, and otherwise after 30 days.
The contact form
Your name, email, optional site address, your message, how you reached the page (the referring page and any campaign tags in the link), and a one-way hash of your IP address that we use only to limit how many messages one sender can post. We email the message to our support inbox so we can reply.
Emails we send
For receipts, licence notices and sign-in links we keep a log entry with a masked address (such as ab***@example.com), the subject and whether it was delivered.
No tracking
This website uses no analytics, advertising or tracking scripts, and its fonts are served from our own server. Our hosting and our network provider (Cloudflare) process the technical data any website visit involves, such as your IP address, to deliver the page and protect the site from attacks.
3. What sites running the plugin send us
WP SecureGate runs on your own WordPress site. To provide its services, it contacts our servers as follows — and only our servers, except for the optional third-party features listed in section 7.
- Daily check-in (every install, with or without a licence): the site address, the plugin, WordPress and PHP versions, and the licence state.
- Licence and updates: the site address and its sign-in tokens (stored by us only as hashes) when the licence is activated, checked or renewed, and requests for signed updates.
- Cloud malware verdicts: when the plugin’s scanner flags a file, that file (up to 5 MB) and its path within the site, or the content of a flagged post, are sent for a verdict. The file is analysed and not kept. We keep its fingerprint (a SHA-256 hash) and the verdict, which may quote the suspicious lines, so the same file is not analysed twice. Files our rules cannot decide may be reviewed by an AI model through OpenRouter, which we instruct to use only model providers that do not collect or train on the content they are sent. The site owner can switch cloud verdicts off in the plugin.
- File feedback: when an owner marks a flagged file as safe or quarantines it, its fingerprint and that decision.
- IP location in alert emails: when an alert email names an IP address — for example an administrator signing in from a new network — that address is sent to us to look up its city and network. The address is not stored or logged; the site keeps the answer for a day.
- Downloads: the attacker IP list and the country database for country rules are downloaded with the site’s licence; nothing else is sent.
- Usage counts: how many requests each site made to each service per day, used for rate limits and capacity.
4. Why we use it
- To provide what you bought — your account, licence, updates and the online services (performing our contract with you).
- To keep the service secure and fair — stopping password guessing, abuse and licence sharing, and limiting load (our legitimate interest in running a safe service).
- To understand which versions are in use — from check-ins, so we know which WordPress and PHP versions to support (legitimate interest).
- To answer you — when you write to us.
- To meet legal duties — such as keeping purchase records.
7. Data your own site keeps, and its optional third parties
The plugin also stores data on your own site, in your WordPress database. That data never reaches us, and you, as the site owner, are responsible for it — you may want to mention it in your own site’s privacy policy:
- an activity log of sign-ins and changes, with usernames and IP addresses (kept 90 days by default);
- a firewall log of blocked requests, with IP addresses and browser details (30 days by default);
- a log of emails the site sent, including their content (30 days by default);
- live traffic records, if you switch that on (12 hours);
- temporary blocks of attacking addresses, and two-factor and device-recognition data for your users.
Some optional features contact third parties directly from your site: a CAPTCHA provider you choose (Google reCAPTCHA, hCaptcha or Cloudflare Turnstile), which receives the visitor’s IP address; the leaked-password check, which sends Have I Been Pwned only the first five characters of a password’s hash, never the password; and WordPress.org (and its GitHub mirror), for official files and checksums.
8. International transfers
We are based in Bangladesh, and our providers operate in several countries, including the United States and the European Union. Where data protection law requires it, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.
9. How long we keep it
| Data | Kept |
|---|---|
| Account, licences, purchase records | While your account exists, then as long as accounting and tax law requires |
| Failed sign-in records | 30 days, or until you sign in successfully |
| Contact messages | 24 months |
| Email and activity logs | 12 months |
| Install check-ins | Until 12 months after the site last checked in |
| File fingerprints and verdicts | 12 months |
| File feedback | 24 months |
| Daily usage counts | 13 months |
| IP addresses looked up for alert emails | Not stored |
| Expired sign-in links and tokens | Deleted soon after they expire |
10. How we protect it
Passwords are stored as bcrypt hashes and sign-in tokens as SHA-256 hashes; traffic is encrypted in transit; plugin updates and downloaded data are signed so they cannot be altered on the way. Access to our systems is limited to the people who run the service. If you find a weakness, please tell us — see our security policy.
11. Your rights
You can ask us to show you the personal data we hold about you, correct it, delete it, give you a copy, or stop or limit how we use it, and you can object to processing based on our legitimate interests. Email [email protected] from the address on your account; we answer within 30 days. Deleting your account ends your licences.
If you think we have handled your data wrongly, you can also complain to the data protection authority where you live.
12. Children
WP SecureGate is a product for website owners and businesses. It is not meant for anyone under 16, and we do not knowingly collect their data.
13. Changes to this policy
We will update this policy when what we collect or how we use it changes. The date at the top says when it last changed; if a change matters to you, we will email you before it takes effect.