Privacy Policy

Our website.

Cookies on feelspersonal.io (Our Website)

You can manage cookie preferences through your browser settings. Disabling cookies may affect your ability to complete purchases.

B1. Visitor Cookies and Local Storage

The plugin stores personalization data in your visitors' browsers using cookies (with the prefix pz_) and localStorage as a fallback. This data includes:

• Visitor names, locations, and other personalization variables extracted from URL parameters

Cookie attributes:

• Prefix: pz_ (e.g., pz_first_name, pz_country)
• Duration: Configurable by the site administrator (default: 90 days)
• Attributes: SameSite=Lax; path=/

This data is set and read entirely by the visitor's browser and your WordPress server. It is never transmitted to Feels Personal or any third party.

B2. Internal Statistics

The plugin tracks aggregate statistics about personalization usage - specifically, how many times each variable is rendered on each page. This data:

• Is stored in your WordPress database (wp_options)
• Is collected via an internal AJAX call to your own WordPress installation (admin-ajax.php)
• Never leaves your server
• Contains no personal visitor information (no names, no IP addresses, no identifying data)

B3. License Validation - the Only External Data Transmission

The plugin makes server-to-server HTTPS calls to the LemonSqueezy API (api.lemonsqueezy.com) for one purpose only: license activation, validation, and deactivation.

Data transmitted:

• Your license key
• Your site URL
• An instance identifier (generated by LemonSqueezy)

Data NOT transmitted: No visitor data, no page content, no personalization variables, no statistics, no cookies, no IP addresses of your visitors.

These calls are:

• Admin-only - they occur in the WordPress admin dashboard, not on your public-facing site
• Server-to-server - they are not triggered by your visitors
• Encrypted - all communication uses HTTPS

B4. Data Deletion

• Deactivating the plugin preserves all data, allowing you to reactivate without loss.
• Deleting the plugin through WordPress admin permanently removes all plugin data from your database, including all settings, trigger configurations, statistics, config snapshots, and debug logs.
• Browser cookies set by the plugin (pz_ prefix) will expire naturally based on the configured duration, or visitors can clear them manually through their browser settings.

B5. Your Responsibility as a Site Owner

If you use the Feels Personal plugin on a website that serves visitors in the European Union or other jurisdictions with data protection laws, you are responsible for:

• Informing your visitors about the cookies and localStorage data the plugin sets
• Obtaining any consents required under applicable privacy laws (such as GDPR cookie consent)
• Including appropriate disclosures in your own website's privacy policy

We provide this information to help you meet those obligations.

C1. Your account data

We store: your email address and a securely hashed password (managed by our infrastructure provider Supabase; we never see your password), your workspace name, and your sites' configuration: site names, your website address, triggers, variables, fallback text, email service provider merge tags, imported page URLs from your own website, affiliate partner and campaign names you create, and your published personalization configurations. You authored this content and you own it (see the Terms of Service).

We also store your subscription state from Lemon Squeezy (plan, status, renewal date, and your plugin license key, which Lemon Squeezy also emails you directly). We never store card details.

C2. Your visitors - what the snippet does in their browser

When you install the app's snippet on your website, it stores personalization values (for example a first name arriving in a personalized link) in the visitor's browser as FIRST-PARTY cookies on YOUR domain, prefixed pz_. You control the duration: the default is 90 days, it is configurable, and a session-only mode is available (the cookie disappears when the browser closes). If cookies are unavailable the snippet falls back to browser localStorage. These values live in your visitor's browser and on your pages; they are not transmitted to us.

Because these cookies store personalization values on your website, YOU are responsible for your own site's privacy notice and any consent requirements that apply to you (see the Terms).

C3. Your visitors - what actually reaches our servers

If statistics are enabled for your site (you can turn them off per site), the snippet reports a small counting event to us when a page renders personalization. We designed this event to deliberately exclude personal information:

• It contains: the variable NAME that rendered (for example "first_name"), which trigger it belongs to, how it resolved (from the link, from storage, from your fallback, or the default), the page path, a timing number, a runtime version, and a coarse browser family (for example "chrome").
• It does NOT contain: the personalization VALUE (we never receive or store your visitor's name or any other value), cookies (the report is sent without credentials), the raw IP address (an IP is used transiently to rate-limit abuse and is never stored or logged), the full user-agent string, or the link's query string.
• Page paths are scrubbed before storage: segments that look like emails, IDs, or long numbers are replaced with a placeholder.
• Event times are truncated to the minute.

The result is a count of "which placeholders rendered on which pages", not a profile of any visitor. We cannot identify your visitors from these events, and we do not try to.

C4. Retention

• Visitor events are retained according to your plan (Silver 30 days, Gold 60 days, Platinum 180 days) and then automatically deleted. You can also delete all statistics for a site yourself at any time, on any plan.
• Your account and configuration data are retained while your account exists.
• If your subscription lapses, your configuration is retained so you can return; your live personalization stops serving premium features per your plan.
• Support emails: retained for the duration of your subscription plus 12 months.

C5. Deleting your data and taking it with you

Built into the app, available on every plan including Free:

• Export. Download your workspace data as JSON: your account details, sites, triggers, variables, fallbacks, merge tags, your live configuration, and daily event counts.
• Delete a site. Removes the site and all its configuration and events.
• Delete your workspace. Permanently deletes your account data, sites, configurations, and visitor events. We retain a minimal deletion record containing no personal information (hashed identifiers and row counts) for audit and billing-dispute purposes, and billing records required for tax and refund-forensics purposes with your email removed.
• Delete your login. Removes your sign-in entirely once you have deleted or left your workspaces.

Deleting your workspace requires your password entered at that moment, and blocks until any active subscription is cancelled, so a stale session cannot destroy your data.

C6. Who processes data for the app (subprocessors)

• Supabase - database, authentication, and file storage. Region: United States (North Virginia).
• Render - application hosting. Region: United States (Ohio).
• Bunny CDN - content delivery for the served personalization configuration.
• Lemon Squeezy (merchant of record) - payments, billing, and license keys. When you start a checkout we pass Lemon Squeezy an anonymous checkout reference, never your email or account ID; you provide your details to Lemon Squeezy directly on their checkout page.
• Sentry - error monitoring. Error reports carry technical identifiers only, never personalization values or visitor data.
• Resend - delivery of transactional email (sign-in confirmation, password reset). Sends from our own domain; delivered on Amazon Web Services (SES) infrastructure in the United States.
• Vimeo - help videos embedded in the dashboard; Vimeo receives standard requests when you view a help page.

We do not use third-party analytics or advertising trackers inside the app. Transactional emails (verification, password reset) are generated by Supabase Auth and delivered by Resend.

C7. Your customers' rights and your role

For visitor events, you (the account holder) decide whether statistics are on and for which sites; we process them for you. If one of YOUR visitors asks you about their data, note that the app's events contain no identifiable visitor information (see C3). Deleting a site or workspace deletes its events.

Your rights

Security

All communications use HTTPS. Passwords are hashed by our authentication provider. Payment security relies on Lemon Squeezy's PCI-DSS compliance. Access to production data is restricted. No method of transmission or storage is 100% secure and we cannot guarantee absolute security.

Children

Our products and services are not directed at children under 16, and we do not knowingly collect personal information from children under 16.

International transfers

We operate from Australia. The app's data is hosted in the United States (database and authentication in North Virginia; application hosting in Ohio). Lemon Squeezy also operates from the United States. By using our products you acknowledge processing in these jurisdictions.

Changes

Material changes will be communicated to your account email; the date above reflects the latest revision.

Contact