Privacy Policy & Data Protection
Official legal terms, data privacy disclosures, and intellectual property protections governing https://arprostudio.com and all ARPRO Studio WordPress plugins.
ARPRO Studio Privacy Policy & Plugin Data Transparency
ARPRO Studio ("we," "our," or "us") is committed to protecting your privacy and maintaining complete transparency about how data is handled both on our website at https://arprostudio.com and inside the WordPress plugins we develop (including SafePilot Diagnostics & Session Sandbox). Please read this Privacy Policy alongside our Terms of Service and Cookie Policy.
1. Data Controller
The Data Controller responsible for personal data processed via https://arprostudio.com is:
ARPRO Studio
Official Privacy & Data Protection Contact: support@arprostudio.com
2. Information We Collect (Website vs. Installed WordPress Plugins)
Because ARPRO Studio operates both a Customer Portal website (arprostudio.com) and downloadable WordPress plugins that run on your own self-hosted server, we strictly separate the data we process:
2.1 Data You Provide Directly on arprostudio.com
| Data Category | What We Collect | Purpose of Processing |
|---|---|---|
| Customer Account Data | Name, username, email address, and cryptographically hashed password | Authenticating your Customer Portal login and linking your account to your ARPRO-... license keys. |
| License & Order Metadata | License key, plan tier (Solo/Business/Agency), expiration date, and external order reference | Issuing annual licenses, verifying update eligibility, and providing customer support. |
2.2 Opt-In Data Transmitted When You Use Our WordPress Plugins
Our WordPress plugins operate locally on your own WordPress server. Our plugins never track, profile, or collect data from your website's public visitors. External requests to https://arprostudio.com occur only when explicitly triggered by a site administrator for the following opt-in actions:
| Plugin Feature | Data Transmitted to ARPRO Studio | Purpose |
|---|---|---|
| Pro License Activation & Update Checks (Tab 4) | License key (ARPRO-...), activated site URL/domain, plugin version, WordPress version, and PHP version |
Enforcing plan site limits (1 / 5 / 25 sites) and delivering signed Pro Companion .zip updates. |
| Pro Legal Acknowledgment Proof Receipt (Tab 6) | Administrator email address, site URL, timestamp, and cryptographic Receipt ID (SP-ACK-...) |
Dispatching your signed legal proof receipt email and maintaining compliance verification logs. |
| Feature Requests & Bug Reports Form (Tab 5) | Your submitted subject, message, reply email, site URL, and (if enabled) basic environment versions (WP/PHP/SafePilot version) | Logging support tickets (#SP-xxxx) and bug reports in our engineering tracker so we can assist you. |
| WordPress Core Checksum Scanner (Tab 3) | Your WordPress core version number and locale (sent directly to the official api.wordpress.org checksum endpoint) |
Fetching official MD5 file hashes from WordPress.org to verify core file integrity locally. |
2.3 Information We Do NOT Collect
- No Public Visitor Tracking: Our plugins never inject analytics scripts, tracking pixels, or third-party cookies into your public-facing website pages, and we never collect IP addresses or personal data from your site's visitors.
- No Credit Card Numbers: All payment transactions are handled by our Merchant of Record / payment processor (such as Lemon Squeezy). We never see or store your credit card number, CVV, or bank details.
- No Database Content Harvesting: Your WordPress posts, pages, WooCommerce orders, user passwords, and local
debug.logfiles remain 100% on your own server and are never uploaded to ARPRO Studio. - No AI / Machine Learning Profiling: We do not feed your personal data, emails, or server telemetry into third-party AI training models or automated profiling engines.
3. Legal Basis for Processing (GDPR — EEA & UK Residents)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases pursuant to GDPR Article 6(1):
- Contractual Necessity (Art. 6(1)(b)): Processing required to create your Customer Portal account, issue and validate your annual Pro license keys, and deliver software updates.
- Explicit Consent (Art. 6(1)(a)): When you voluntarily submit a Tab 5 Bug Report / Feature Request or execute the Tab 6 Legal Acknowledgment Proof Receipt.
- Legitimate Interests (Art. 6(1)(f)): Protecting our licensing server against automated attacks, fraud, and software piracy.
- Legal Obligation (Art. 6(1)(c)): Retaining transaction and legal acknowledgment records required for tax, accounting, and legal compliance.
4. Third-Party Service Providers (Sub-Processors)
We do not sell, rent, or trade your personal information to any third party for marketing or advertising. We share minimal necessary data only with the following infrastructure providers to operate our service:
| Sub-Processor | Role & Purpose | Data Processed | Location |
|---|---|---|---|
| DigitalOcean & RunCloud | Cloud web server & database hosting for arprostudio.com |
Account database, license tables, and standard NGINX access logs (IP, user-agent) | United States / EU |
| Brevo (Sendinblue) | Transactional SMTP email delivery (via FluentSMTP) | Recipient email address and transactional email content (password resets, legal proof receipts) | European Union |
| Lemon Squeezy / Payment Processor | Merchant of Record & checkout billing | Buyer email address, name, and payment details (collected directly by processor during checkout) | United States |
| Namecheap | Domain DNS & support email routing (support@arprostudio.com) |
Emails sent directly by you to our support address | United States |
Note on SafePilot Pro Alert Channels: If you configure Telegram Bot, Discord Webhook, or Slack Webhook URLs inside SafePilot Pro (Tab 4), your own WordPress server sends crash notifications directly from your server to your chosen Telegram/Discord/Slack endpoint. Those messages never pass through ARPRO Studio's servers.
5. Data Retention
- Customer Portal Accounts & Licenses: Retained for as long as your account or annual license remains active. If you delete your account, your personal profile data is purged within 30 days (except where retention of license transaction or legal acknowledgment records is required for legal defense or tax compliance).
- Server Security Logs: Standard web server access and error logs are retained for up to 90 days for security and DDoS/abuse mitigation and then automatically rotated out.
- Encrypted Server Backups: Automated server snapshots may retain deleted records for up to 30 days before being overwritten.
6. Your Statutory Privacy Rights (GDPR, CCPA & Costa Rica Ley 8968)
6.1 Rights Under GDPR (EEA / UK Residents)
You have the right to: (a) Access a copy of the personal data we hold about you; (b) Rectify inaccurate or incomplete data; (c) request Erasure ("Right to be Forgotten"); (d) Restrict or Object to processing; and (e) request Data Portability in a machine-readable format.
6.2 Rights Under CCPA / CPRA (California Residents)
California residents have the: (a) Right to Know what personal information is collected; (b) Right to Delete personal information; (c) Right to Opt-Out of Sale/Sharing (ARPRO Studio does not sell or share personal information as defined by the CCPA); and (d) Right to Non-Discrimination.
6.3 Rights Under Costa Rican Law (Ley N° 8968)
If you are a resident of Costa Rica, you have the right to access, rectify, and cancel/delete your personal data (autodeterminación informativa) in accordance with the Ley de Protección de la Persona frente al tratamiento de sus datos personales (Ley N° 8968) and may contact the Agencia de Protección de Datos de los Habitantes (PRODHAB).
6.4 How to Exercise Your Privacy Rights
To exercise any of your privacy rights or request account/data deletion, email us at support@arprostudio.com. We will verify your identity and respond within 30 calendar days.
7. Data Security Measures
We implement strict technical and organizational security safeguards, including full TLS/HTTPS encryption in transit, bcrypt/Argon2 password hashing, HMAC-SHA256 cryptographic signing for Pro download links and Magic Debug URLs, prepared SQL statements across all database tables, and SSH key-only server administration. However, no method of internet transmission or electronic storage is 100% impenetrable, and we cannot guarantee absolute security.
8. Children's Privacy
Our Website and B2B WordPress diagnostic plugins are intended strictly for adult website administrators and developers (18+) and are never directed at children under 13. We do not knowingly collect personal data from children under 13.
9. Contact Us
For any questions regarding this Privacy Policy or our data practices, contact:
Email: support@arprostudio.com