Legal
DRAFT — NOT IN FORCE Privacy Policy
What data the IronGuardWP plugin and this website handle, and what they deliberately do not.
What the plugin sends us
Verified. This section describes how the product actually behaves today and is accurate as written. It still forms part of a document that is not yet in force. Verified against the plugin API contract, §3.8 (telemetry check-in), as of 23 August 2026.
When the plugin checks in, it reports the security posture of your site as counts and identifiers — not as content. Specifically: when the last scan ran, how many files it scanned, how long it took, and how many findings it produced; how many requests the firewall blocked in the last 24 hours and which of our rule identifiers fired; your security score; and, for addresses that attacked your site, the address itself with the kind of attack, a count, and when it was first and last seen. It also reports the environment it is running in: your WordPress version, PHP version, server software, and whether the install is multisite.
Attacking addresses are the one place the plugin sends us an IP address, and it is the attacker’s. That is what makes the shared threat feed work: an address attacking one IronGuardWP site can be blocked across the others.
What the plugin never sends us
Verified. This section describes how the product actually behaves today and is accurate as written. It still forms part of a document that is not yet in force. Verified against the plugin API contract, §3.8, as of 23 August 2026.
Telemetry never carries the content of your site, the contents of any file, your usernames, any email address, or the IP addresses of your visitors. A scan runs entirely on your own server; what leaves it is the count of what was found, never the files themselves.
That is a property of the contract between the plugin and our server, not a promise about intent. If it ever changes, this paragraph changes in the same release.
Support diagnostics are opt-in
Verified. This section describes how the product actually behaves today and is accurate as written. It still forms part of a document that is not yet in force. Verified against the plugin API contract, §3.9 (support ticket), as of 23 August 2026.
When you open a support ticket from inside the plugin you can attach diagnostics. They are optional, and the plugin shows you what they contain before anything is sent.
Who controls your data
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: The controller’s legal identity and contact point, and a representative where one is required. Blocked on the same open legal-entity item as the Terms.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.
Account and billing data
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: What we hold about an account versus what Whop holds as the payment processor. We never receive card details; the exact division still needs to be written down accurately.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.
This website
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: Server logs, cookies, and analytics for ironguardwp.com specifically — separate from the plugin. Depends on the analytics decision; website.md §10 calls for a privacy-respecting choice so the disclosure stays small.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.
Legal bases and retention periods
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: Why each category of data is processed and for how long it is kept. Needs review against the jurisdictions we actually sell into.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.
Your rights and how to exercise them
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: Access, correction, deletion, portability, objection, and the route to a supervisory authority.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.
Processors and international transfers
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: The list of third parties involved — payment, hosting, email — and the transfer mechanism for each. A list that is stale is worse than no list, so it ships when it can be kept current.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.
Security of the data we hold
[ PLACEHOLDER — NO TEXT WRITTEN ]
What this section will cover: How the data described above is protected, and how a breach would be notified.
No terms have been drafted for this section. Nothing is stated, implied, agreed, or waived here.