Trust Privacy policy
A short version of our privacy policy in plain language, followed by the detail GDPR and the Indian DPDP Act require. No dark patterns and no hidden sharing.
Wbcom Designs operates wbcomdesigns.com, store.wbcomdesigns.com, a handful of product subsites, and our mobile apps. This policy covers all of them. The same rules apply whether you read a blog post, fill out a contact form, buy a plugin, open a support chat, or sign in to one of our mobile apps.
We are the data controller. Our office is in Lucknow, India, and we serve customers globally. For European visitors, this policy is written to meet GDPR. For Indian visitors, it meets the Digital Personal Data Protection Act, 2023. For everyone else, it is the policy.
What we collect
Every data type we hold falls into one of these. If a field is not on this list we are not collecting it.
01
Name, email, project description, and any attachments submitted through /start-a-project/, /rfp/, /book-a-call/, and the contact forms across the site. Stored in our CRM and ticketing tools so we can reply.
Used only to respond to your enquiry.
02
If you buy a plugin or theme, our Easy Digital Downloads store records your billing email, license keys, purchase history, and the invoice address you supply at checkout. Payment card data never touches our servers.
Required to deliver the product, issue licenses, produce invoices.
03
When you open the Crisp chat widget we record the conversation transcript, the page you started chatting from, your browser user-agent, and the email you provide if you choose to share one. Workspace ID 08d857de-573a-4b16-a743-46cc8d9f046d.
Used to answer the question and to keep history if you return.
04
Google Analytics 4 (property G-WXBEQJS1F6) records anonymised page views, referrer, country, device class, and a hashed client ID. IP anonymisation is enabled. We do not enable Google Signals or cross-device tracking.
Used to see which pages get read.
05
Our WordPress store pages (account area, checkout, and older product pages) load Google Tag Manager, which includes a Google Ads tag (AW-826073099) that measures whether our ads lead to purchases. It runs in Google Consent Mode with advertising storage denied, so it sends conversion measurements without setting advertising cookies.
Ad conversion measurement, no advertising cookies.
06
Your cookie choice is saved in your browser's local storage until you clear site data. Functional cookies keep you signed in to the customer dashboard. Visitors in the EU, UK and EEA see a consent banner, and analytics stays off until they accept. Visitors in other regions do not see a banner, and analytics is on by default. Crisp chat loads on every page so the support widget is available. Google Ads runs with advertising storage denied, so it sets no advertising cookies.
Opt-in for EU, UK and EEA visitors; on by default elsewhere.
07
If you subscribe to product updates, your email and the date you signed up are stored in Mailchimp. You can unsubscribe from any email and we honour the request within 24 hours.
Used only for the newsletter you signed up for.
Processors
A small number of processors run the business. Each one is contracted under a data processing agreement and only receives the data needed to do its job.
01
Fronts every domain we run. Sees the IP address of every request for the duration of the connection. Cached static pages are stored at the edge for up to 24 hours. Acts as our CDN, WAF, and DDoS mitigation layer.
CDN, security, edge caching.
02
Property G-WXBEQJS1F6 receives anonymised page-view events from EU, UK and EEA visitors who accept analytics cookies, and from visitors in other regions by default. IP anonymisation is enabled. No Google Signals or cross-device tracking.
Anonymous page analytics.
03
Account AW-826073099, loaded through Google Tag Manager on WordPress store pages. Receives conversion events, such as a purchase and the page that led to it, in Consent Mode with advertising storage denied.
Ad conversion measurement.
04
Workspace ID 08d857de-573a-4b16-a743-46cc8d9f046d. Stores chat transcripts, the page you started chatting from, and contact details you choose to share. Data stored in France under GDPR.
Live chat support.
05
Stores the newsletter list (email + signup date) and sends the emails. Data stored in the United States under the EU-US Data Privacy Framework.
Newsletter delivery.
06
Process payments for store purchases. They receive the data their checkout flows require to complete the payment. We do not see card numbers - those flow directly from your browser to the processor.
Payment processing.
07
Stores support ticket threads. Tickets submitted from /support/ land here and route to the engineer who owns the product. Retainer customer threads are tagged separately.
Support ticket system.
08
Sends review invitations after a purchase if the customer opted in at checkout. Trustpilot stores the email and the review the customer chooses to write.
Optional review invitations.
Mobile apps
Our apps are native clients for the WordPress site you connect to. They are built to collect nothing for us and to keep your credentials on your device.
01
Our mobile apps are native clients for the WordPress community or site you connect to. Your posts, profile, messages, and other content live on that site, not on Wbcom Designs servers. The apps collect no personal data for us and contain no advertising or third-party analytics SDKs.
We receive nothing from your app use.
02
The apps sign in with WordPress Application Passwords, a feature built into WordPress. The credential is stored encrypted on your device (iOS Keychain, Android Keystore) and is sent only to your own site. Sign out or remove the site to delete it from the device.
Credentials never reach our servers.
03
If you allow notifications, an anonymous push token is processed through the Expo push service only to deliver alerts such as replies and mentions from your community. It is not used for tracking, profiling, or advertising.
Notifications only. No tracking.
Governance
Six items covering the parts of GDPR and the Indian DPDP Act that customers ask about most often.
01
Contact and account data is processed under the contractual-necessity basis: we cannot deliver a plugin or reply to an enquiry without it. Newsletter data is processed under consent: nothing is sent until you tick the subscribe box. For visitors in the EU, UK and EEA, analytics is processed under the consent given in the cookie banner. Crisp chat loads on every page so the support widget is available, and chat data is processed when you start a conversation. Invoice and tax data is processed under legal-obligation: Indian and EU tax law require us to keep it.
Contract, consent, legal obligation.
02
Contact form submissions are kept for 24 months and then deleted. Purchase records and license data are kept for the life of the license plus seven years for tax purposes. Crisp chat transcripts are kept for 12 months. Newsletter subscribers are kept until they unsubscribe. Analytics events expire after 14 months at the GA4 property level. Google Ads conversion data is kept under the Google Ads account retention settings.
Retention varies by category.
03
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to stop processing it, or ask us to hand it to another provider in a portable format. Email connect@wbcomdesigns.com; we reply within one to two business days and complete the request within 30 days. If you are not satisfied, you can complain to your local data protection authority.
Access, correction, deletion, portability.
04
Visitors in the EU, UK and EEA see a cookie banner on their first visit, and analytics stays off until they accept. The choice is saved in your browser until you clear site data, which brings the banner back. Visitors in other regions do not see a banner, and analytics is on by default. Strictly necessary storage always loads: a session cookie for the customer dashboard and the saved consent choice. Crisp chat also loads on every page.
Banner and opt-in for EU, UK and EEA visitors.
05
We update this page when we add a processor, change a retention period, or a law requires it. The last-updated date at the top of the page reflects the most recent change. Material changes are emailed to active customers. Current version dated: 15 September 2026.
Last updated 15 September 2026.
06
Wbcom Designs is the data controller for everything described on this page. Office address: Vikrant Khand, Gomti Nagar, Lucknow, Uttar Pradesh 226010, India. Email connect@wbcomdesigns.com for any GDPR or DPDP Act request.
Controller: Wbcom Designs.
Common questions
Email connect@wbcomdesigns.com from the address on file. We reply within one to two business days and send a structured export within 30 days, covering CRM records, purchase history, support tickets, and newsletter status.
Email connect@wbcomdesigns.com asking for deletion. We remove your records from the CRM, Crisp, Mailchimp, and our internal tools within 30 days. Invoice data is retained for the seven years required by tax law and then deleted.
No. We do not sell, rent, or trade personal data to third parties. Data leaves our systems only to the processors listed above, and only to the extent needed to run the service.
Our primary infrastructure runs on hosting in the European Union and the United States. Cloudflare fronts every domain. Crisp stores chat data in France. Mailchimp stores newsletter data in the United States under the EU-US Data Privacy Framework.
Wbcom Designs, Vikrant Khand, Gomti Nagar, Lucknow, Uttar Pradesh 226010, India. Email connect@wbcomdesigns.com for any GDPR or DPDP Act request.
A privacy question we have not answered?
connect@wbcomdesigns.com goes straight to the people who handle GDPR and DPDP requests. We reply within one to two business days.
Very useful website