Privacy

1. Who is responsible?

2. Hosting

This website and our server for licenses, assessments, and plugin updates (api.updatehelper.com) are hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in data centers in Germany and the EU. We have a data processing agreement with Hetzner under Art. 28 GDPR. Details are available in Hetzner’s privacy policy.

3. Visiting this website

When you visit this website, our server automatically stores technical information: date and time, the page requested, browser and operating system, and your IP address in truncated (anonymized) form. This is necessary to deliver the website and defend against attacks.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

For download statistics, we store only the timestamp of a successfully delivered download, without an IP address or other personal information. Timestamps older than 14 days are automatically deleted when a download is successfully delivered.

4. Cookies, analytics, and fonts

The language of this website is determined by the URL. The contact form uses a short-lived session cookie.

The fonts used on this website are hosted on our own server. No data is sent to font providers when you visit.

5. Contact form

When you contact us through the form, we process your name, email address, number of websites, and, if provided, your website address and message. The details are sent to us by email. We use them only to respond to your request and, where appropriate, set up a trial account.

The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).

6. Data processed by the plugin

Updatehelper runs on your own WordPress website. Update checks without a license key take place entirely on your website. As WordPress itself does, the plugin retrieves update descriptions from WordPress.org or the relevant publisher.

Plugin update checks

Even without a license key, the plugin checks our server about twice a day for a new version of Updatehelper and downloads updates from there. Only the installed plugin version is transmitted; for technical reasons, our server also receives the IP address of the server hosting your website. Your website address is not transmitted.

The legal basis is our legitimate interest in providing the plugin securely and keeping it up to date (Art. 6(1)(f) GDPR).

Assessment with a license key

With a license key, each assessment sends our server: your license key and website address to verify the license; the extension names and versions; PHP and WordPress versions; your website language; your theme type; and, for plugins not distributed through WordPress.org, the publisher’s update description as well as technical identifiers (hook, function, and class names) and file names from your theme and your own plugin code.

Our server retrieves the update description from the publisher, compares the source code of both versions for plugins from WordPress.org, and then assesses the update (see “AI-assisted assessment”).

Your source code, website content, and visitor or customer data are not transmitted.

Please note: identifiers from your website code, such as function or file names, may in some cases reveal information about your website or business, for example if they contain your company name. You can disable sending these identifiers in the plugin settings. Our server and the AI service will then receive only the publisher’s public update information.

The legal basis is performance of the contract for using Updatehelper (Art. 6(1)(b) GDPR).

AI-assisted assessment

Updates are assessed using an open-source language model through the AI hosting service of Mittwald CM Service GmbH & Co. KG. Processing takes place on servers in Germany or the EU; no data is transferred to third countries. We send the AI service only the publisher’s update description, extension name and versions, PHP and WordPress versions, and, unless disabled in the plugin settings, technical identifiers and file names from your website code. We do not share your license key or website address with the AI service. A data processing agreement under Art. 28 GDPR is in place with the provider.

The traffic light is an assessment to help you decide. You decide whether and when to install an update; no automated decision within the meaning of Art. 22 GDPR is made.

The legal basis is performance of the contract for using Updatehelper (Art. 6(1)(b) GDPR).

Storage of assessments

We store your website address only alongside your license key to verify the license. Update assessments are stored separately, without any connection to your license key or address, for up to 60 days so the same request does not need to be assessed again.

Request logging

We log requests to our assessment service, including the transmitted data (license key truncated), the text shared with the AI service, and our response. This supports troubleshooting, security, and oversight of transmitted data. Entries are automatically deleted after 7 days.

The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

Daily checks

To make daily update checks reliable even on websites with few visitors, our server calls the WordPress file wp-cron.php once a day for websites with a valid license. No data is sent to or requested from your website during this call.

The legal basis is performance of the contract for using Updatehelper (Art. 6(1)(b) GDPR).

7. Licenses and contract data

For each license key, including a free trial, we store the address of the website it is linked to, your name or company, the validity period, last-use time, and number of requests. We process this data to provide and verify the license.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We store this data until the contract ends. Invoices and other tax-relevant records are retained for up to 10 years as required by law (Art. 6(1)(c) GDPR).

8. Recipients of your data

We share your data only with service providers processing it on our behalf:

• Hetzner Online GmbH, Germany - website and server hosting
• Mittwald CM Service GmbH & Co. KG, Germany - AI hosting (without your license key or website address)

We have a data processing agreement with each provider. Data is not transferred to countries outside the EU.

9. Your rights

You may request access to your stored personal data (Art. 15 GDPR), request correction (Art. 16) or erasure (Art. 17), restrict processing (Art. 18), and receive your data in a commonly used format (Art. 20). You may withdraw consent at any time with effect for the future.

Right to object: Where we process data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To do so, contact us at the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf.