Privacy Policy

Last updated: 26 July 2026

This Privacy Policy explains how KarmaPower, s.r.o. (“we”, “us”) processes personal data when you visit wptrueproof.com, contact us or purchase TrueProof. We are the data controller.

Who we are

KarmaPower, s.r.o., Bystrc ev. č. 2438, 635 00 Brno, Czech Republic. Company ID (IČO): 21710007. VAT ID (DIČ): CZ21710007. Email: [email protected]. Support: [email protected].

Data processed on this website

  • Necessary technical data: IP address, request time, requested URL, browser information and security logs needed to deliver and protect the website.
  • Optional analytics: page views, campaign parameters and a Google Analytics client identifier, but only after you consent to Analytics in our privacy choices.
  • Optional advertising measurement: Meta Pixel events, campaign parameters and Meta browser identifiers, but only after you consent to Advertising. If server-side purchase measurement is configured, Meta may also receive the purchase event’s IP address and browser user-agent as matching context. We do not send checkout names, email addresses, phone numbers or billing addresses to Meta.
  • Checkout and customers: plan, name, email, billing address, country, payment status, licence entitlement and support history. Stripe processes card details; we do not receive or store your complete card number.
  • Communication: the content and contact details in emails or support requests you send us.

Purposes and legal bases

  • Providing, securing and troubleshooting the website — our legitimate interests in operating a secure service.
  • Creating checkout, delivering a licence, providing updates and support — performance of a contract or steps requested before entering one.
  • Accounting and tax records — compliance with legal obligations.
  • Analytics and advertising measurement — your consent. You may refuse or withdraw consent without affecting checkout or use of the free plugin.

Privacy choices and cookies

Google Analytics and Meta advertising scripts are not requested until you grant the corresponding choice. “Reject optional” leaves both disabled. “Customize” lets you choose Analytics and Advertising separately. You can reopen Cookie settings in the footer at any time. Your choice is stored in a first-party cookie so the site can remember it. Essential WordPress, security and checkout cookies may be used without optional consent where necessary.

With consent, we retain campaign UTM parameters and, for Advertising, Meta click/browser identifiers for attribution. Landing and referrer context is stored without query strings. The selected consent state and permitted attribution fields are attached to a Stripe Checkout Session so an eventual purchase can be attributed consistently. Without the relevant consent, those optional identifiers are not attached.

Funnel measurement

After consent, this site may send PageView, ViewContent, free-download, checkout and verified purchase events to the selected services. A purchase is recorded only after the Stripe Checkout Session is verified as paid. Browser and optional server events use a shared event identifier to avoid double counting. Server-side Meta or Google purchase reporting operates only when separately configured and only for the categories you accepted.

TrueProof plugin privacy

The free TrueProof plugin reads recent events already stored on the WordPress site where it is installed and makes no external requests. When Pro is used, the plugin sends only the licence key, site URL and licence action to wptrueproof.com for activation, periodic validation or deactivation. It does not send order, visitor or customer records to us.

A notification visitor may see a display name, optional city/country, activity and relative time. Name shortening is enabled by default: a surname is reduced to an initial when available, a single-field name is shown as stored, and email-shaped values are suppressed. Full addresses and order totals are not displayed by the built-in sources. The public WordPress REST endpoint used by the widget returns the configured display events.

Recipients and international transfers

  • Stripe — payment and tax processing.
  • Google — analytics, only with Analytics consent.
  • Meta Platforms — advertising measurement, only with Advertising consent.
  • Cloudflare and our Plesk hosting provider — delivery, security and hosting.
  • Email providers — transactional and support communication.

Some providers may process data outside the EEA using applicable safeguards such as adequacy decisions, the EU–US Data Privacy Framework or Standard Contractual Clauses. Their own privacy notices explain their roles and safeguards.

Retention

Order, invoicing and tax records are retained for the period required by law, commonly up to 10 years. Licence and support data is kept while needed to provide the purchased service and resolve claims. Security logs are retained only as long as operationally necessary. Optional analytics and advertising data follows the configured provider retention period or is removed when no longer needed. Withdrawing consent stops future optional collection but does not automatically erase lawfully collected provider data.

Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, portability or object to processing, and you may withdraw consent at any time. Contact [email protected]. You may also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz.

Changes

We may update this policy when the product, providers or law changes. The date above identifies the current version.