Privacy policy

Data and sources

We receive information you provide when creating and using your account: name, email, language, workspace details, connected sites and support conversations. Authorised sites provide operational information, inventories and data needed for requested actions. Technical records may include IP address, time, request status and audit identifiers. Local passwords are hashed.

Information received from Google

If you choose Google, we receive its stable identifier, your name, email address and confirmation that the email is verified. The implementation keeps the identifier to recognise your account; it does not store your photo or Google access or refresh tokens. This information is used to identify you, create your account where appropriate, and provide the sign-in or linking you request. Accounts are not merged based on matching email addresses.

Purposes and legal bases

We process the information needed to provide the requested service: account management, authentication, authorised site operations and support. The legal basis is performance of the service relationship. Security and abuse-prevention records serve the legitimate interest of protecting the service and accounts; you may request information and object where applicable. Information needed to meet legal obligations is processed on that basis. Google authorisation is optional and may be withdrawn; it is not used for purposes unrelated to your requested access.

Optional permissions and recipients

Hosting and the services configured for email and backups may process data to provide those functions. Provider details are listed in the hosting and services section. Google processes its own authentication information under its policies; some screens may request web fonts from Google, disclosing the technical information needed to serve them. Authorised administrators may access data needed for support and operation. Connecting Google Drive for backups requires separate authorisation: signing in with Google does not grant access to your files. If you authorise an external MCP client, the operations and data it can access depend on its permissions and your authorisation.

Limited use of Google data

Google sign-in data is used only for the identification and access functions described here. It is not sold, used for personalised advertising or used to train artificial intelligence models. Information received from Google APIs is used in accordance with the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Retention and deletion

Account data is retained as needed for the service relationship and applicable obligations. The inactivity and log retention criteria are specified at the end of this page. Unlinking Google removes the linked identity but does not itself delete your account or sites. You may request deletion of your account and data; backups and records that must be retained will be limited to the applicable purpose and period.

Your rights and withdrawing access

Where applicable, you may request access, rectification, erasure, portability, restriction or objection using the contact on this page. You can withdraw Google permission in your Google account and unlink it in DashMyWP Settings after establishing an alternative sign-in method. Withdrawal does not affect the lawfulness of earlier processing. You may complain to the competent data protection authority; in Spain, the Spanish Data Protection Agency (aepd.es).

Your sites and security

You must be authorised to connect and manage each site. For personal data about others within your sites, you must determine your role and have the necessary legal basis and processing agreements. DashMyWP restricts operations by permissions and uses HTTPS and access controls; no measure removes every risk. Do not send passwords, tokens or keys in support conversations.

Cookies and preferences

The application uses cookies and storage needed for sessions, form protection and preferences such as language or appearance. Google sign-in involves visiting Google services governed by their own policies. This page does not authorise optional cookies or replace consent another service may require.

Hosting

The platform is hosted on Oracle Cloud Infrastructure in the Paris region (France), within the European Union. Transactional email is sent through Resend (Plus Five Five, Inc.). Google provides optional authentication, web fonts on some screens and operational platform backups in Drive. Site backups in Drive require a separate customer connection. Resend and Google may involve processing outside the European Economic Area: their policies and agreements identify applicable transfer mechanisms, including the Data Privacy Framework and Standard Contractual Clauses where applicable. You may request further information and a copy of applicable safeguards using the contact provided.

After one year of inactivity, we may process deletion of the account and its data, with prior notice to the account email address. Deletion is reviewed and carried out in a controlled manner; this period does not mean immediate automatic deletion. Records needed to investigate incidents, handle claims or comply with legal obligations are retained only for those purposes for the applicable period.