Last updated: September 6, 2026

This Privacy Policy explains how Vitalii Kiiko and Oksana Kiiko (“we,” “us,” or “our”), operating together under Italian law, collect, use, and protect personal data in connection with the CraftForms WordPress plugin (“the Plugin”) and the website at craftformswp.com (“the Website”).

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) (EU 2016/679) and applicable Italian data protection law.

1. Who We Are

Data Controllers: Vitalii Kiiko and Oksana Kiiko Italy Email: [email protected]. Website: https://craftformswp.com/

2. What Data We Collect and Why

2.1 Website Visitors

We do not use Google Analytics or any other website analytics or tracking tools on craftformswp.com. We do not place tracking cookies or collect behavioral data from visitors.

Contact form: craftformswp.com includes a contact form. Submissions (name, email, and message) are saved to our website’s database so we can respond to your inquiry. This data is used solely to answer your message and is not shared with third parties. We retain contact form submissions for as long as reasonably needed to resolve the inquiry.

2.2 Customers (Pro License Buyers)

CraftForms Pro is sold in two editions, matched to how you purchase — the Freemius Edition and the Standard Edition. The provider that processes your payment depends on which edition you buy:

  • Purchases of the Freemius Edition are processed through Freemius (https://freemius.com), acting as our data processor. See Section 3.
  • Purchases of the Standard Edition are processed through Paddle (https://paddle.com), our Merchant of Record. When you buy through Paddle, you are contracting directly with Paddle rather than with us — Paddle acts as an independent controller of your payment data, handling billing, tax compliance, fraud prevention, and chargebacks under its own legal basis. Paddle shares limited data back with us (e.g. to fulfil your order and provide support) under its own legitimate interest, not under our instruction. See Paddle’s Buyer Privacy Notice. The Paddle account used for CraftForms sales is registered to Oksana Kiiko.

In both cases, the following may be collected on our behalf or shared with us by the relevant provider:

  • Contact information: name, email address
  • Payment information: billing address, payment method details (handled and stored by Paddle or Freemius and their respective payment processors; we do not store card details)
  • License data: domain(s) activated, license key, purchase date, plan type
  • Technical data (Freemius Edition only): WordPress version, plugin version, PHP version, and other diagnostic data — collected only if you opt in via the Freemius SDK opt-in screen shown during plugin activation. The Standard Edition contains no Freemius code and does not collect this data through the plugin. (See Section 2.3 for the Standard Edition’s own license check.)

Purpose of processing: order fulfillment, license management, delivery of updates, tax and regulatory compliance, and customer support.

Legal basis (GDPR): performance of a contract (Art. 6(1)(b)) for order and license data; legitimate interest (Art. 6(1)(f)) for optional diagnostic data and fraud prevention where applicable.

We do not use your data for advertising, profiling, or sale to third parties.

2.3 License Verification (Standard Edition)

The Standard Edition of CraftForms Pro does not use the Freemius SDK. Instead, license validation is handled by our own license server. When the plugin checks its license status, the following is sent to our server:

  • Activation key
  • Site domain / URL
  • IP address (servers typically log this automatically even without explicit capture), plugin/WordPress version. There are periodic checks.

Purpose of processing: verifying that your license is valid and active for the site(s) it’s activated on.

Legal basis (GDPR): performance of a contract (Art. 6(1)(b)).

Retention: license-check records are kept for the time needed for proper operational activity. The server is located inside EEA.

We do not sell this data or use it for advertising.

3. Freemius and Paddle as Payment Providers

Freemius (Freemius Edition only) acts as our data processor under a Data Processing Agreement — it processes purchase data on our instructions rather than its own. Freemius is GDPR-compliant. Review Freemius’s privacy policy at: https://freemius.com/privacy/

When you install the Freemius Edition and activate it in WordPress, the Freemius SDK may display an opt-in prompt asking permission to collect non-sensitive diagnostic and usage data. This is optional. You can decline without affecting plugin functionality.

Paddle (Standard Edition only) is the Merchant of Record for your purchase. Under Paddle’s model, you contract directly with Paddle at checkout, and Paddle acts as an independent controller — not our processor — for billing, tax compliance, fraud prevention, and chargebacks. Paddle shares the data needed for order fulfilment and support back with us under its own legal basis. Review Paddle’s Buyer Privacy Notice at: https://www.paddle.com/privacy-buyers

4. Cookies

craftformswp.com does not use analytics or advertising cookies.

The checkout process — via Paddle or Freemius, depending on the edition purchased — may set session-related cookies necessary to process your purchase (cart state, transaction session, fraud prevention). These are functional cookies strictly necessary to complete a purchase you’ve initiated.

5. Data Retention

We retain your purchase and license data for as long as your license is active and for a reasonable period afterward to comply with legal obligations (e.g., tax and accounting requirements under Italian law, typically 10 years). License-check data collected by our own license server (Standard Edition) is retained as described in Section 2.3.

If you request deletion of your data, we will remove what we can consistent with our legal obligations.

6. Your Rights Under GDPR

If you are in the EEA, you have the right to access, correct, delete, or restrict processing of your personal data, and to object to certain processing or request data portability. Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact us at [email protected]. We will respond within 30 days. You may also lodge a complaint with the Italian Data Protection Authority (Garante) at https://www.garanteprivacy.it/.

For data held directly by Paddle as an independent controller (e.g. payment and billing records), you may also need to contact Paddle directly to exercise your rights over that data — see their Buyer Privacy Notice for details.

7. International Data Transfers

Freemius is a US-based company; your data may be transferred to and processed in the United States, with appropriate safeguards applied in accordance with GDPR requirements — see their privacy policy for details.

Paddle processes payments through either a UK entity (Paddle.com Market Limited) or a US entity (Paddle.com Inc.), depending on your location and the nature of the sale. Where data is transferred outside the EEA, Paddle applies appropriate safeguards in accordance with GDPR requirements — see Paddle’s Buyer Privacy Notice for details.

8. The CraftForms Plugin and Your Users’ Data

CraftForms is a tool that enables you (the site owner) to build forms on your own WordPress website. We have no access to the form submissions collected on your website. You are the data controller for any personal data submitted through forms you build with CraftForms. It is your responsibility to comply with applicable privacy laws in relation to your users’ data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

10. Contact

For privacy-related questions or requests, contact:

Vitalii Kiiko & Oksana Kiiko Email: [email protected] Website: https://craftformswp.com/