Privacy Policy
COGNIZENSE LLP
5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN
ICO Registration: 00014276957
Last updated: August 9, 2026
1. About This Policy
This Privacy Policy explains how COGNIZENSE LLP (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit our websites, purchase our WordPress plugins or use plugin services operated by us. We are a UK Limited Liability Partnership and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies to all websites operated by us, including wpgator.tech. If you are a California resident, Section 13 contains additional rights that apply to you under the California Consumer Privacy Act (CCPA).
For questions about this policy, contact us at: info@cognizense.com
2. What Data We Collect
We collect only the data necessary to operate our business, deliver our plugins and provide services explicitly requested by users. We do not buy, rent, or trade personal data.
2.1 Information you provide directly
- Name and email address — when you create an account or purchase a plugin licence
- Billing address and country — required for tax compliance and payment processing
- Payment information — when you make a purchase. We do NOT store your full credit card or payment details. Payments are processed by Stripe, PayPal, and Airwallex, who act as independent data controllers for payment processing. We receive only a transaction confirmation and the last four digits of your card.
- Licence key — generated and stored to activate your plugin and verify your purchase tier
- Support requests — when you contact us for help via email or our contact form
2.2 Information collected automatically
- IP address — logged temporarily for security and fraud prevention
- Browser type, operating system, and referring URL — standard server logs, retained for up to 30 days
- Plugin activation domain — your site URL is stored with your licence key to enforce site limits and provide support
- Aggregate website statistics — we use GoatCounter to understand overall site usage, such as page visits, referring sites and broad technical information. GoatCounter does not use cookies, local storage, or persistent identifiers to track visitors.
2.3 Google data processed by WPGator Search Insights
WPGator Search Insights is an optional, administrator-controlled WordPress plugin that connects to Google Search Console. When an administrator authorizes the connection, the plugin may access:
- Search Console property information — the properties the connected Google account is permitted to view
- Search-performance reports — queries, landing pages, clicks, impressions, click-through rates and average positions for the property selected by the administrator
- OAuth credentials — access and refresh tokens required to maintain the administrator-requested connection
Search Console reports are requested directly by the connected WordPress site from Google and stored in that site’s own WordPress database. WPGator does not receive, store or analyse the site’s Search Console reports. See Section 8 for full details.
2.4 What we do NOT collect
- We do not engage in remarketing or behavioural advertising
- We do not build marketing profiles or audience segments
- We do not use social media plugins or tracking pixels
- We do not collect sensitive personal data such as health information, biometric data or political opinions
- We do not receive or centrally store Search Console queries, landing pages, clicks, impressions, click-through rates or positions retrieved by WPGator Search Insights
3. How We Use Your Data
We process your personal data on the following lawful bases under UK GDPR:
| Purpose | Lawful Basis |
|---|---|
| Creating your account and delivering purchased plugin downloads | Performance of a contract (Article 6(1)(b)) |
| Processing payments and generating licence keys | Performance of a contract |
| Providing an administrator-requested Google OAuth connection for WPGator Search Insights | Performance of a contract — providing the plugin functionality requested by the administrator |
| Responding to support requests | Legitimate interest (Article 6(1)(f)) — providing customer service |
| Sending licence expiry reminders and renewal notices | Legitimate interest — maintaining the customer relationship. You may opt out at any time. |
| Occasional emails about new plugins, features, or updates | Legitimate interest — direct marketing to existing customers. You may opt out at any time. |
| Aggregate website statistics | Legitimate interest — understanding and improving our website without using advertising or persistent visitor tracking |
| Detecting and preventing fraud | Legitimate interest — protecting our business and customers |
| Server logs for security and diagnostics | Legitimate interest — maintaining service security and availability |
We do not use automated decision-making or profiling.
4. Who We Share Your Data With
We share data only as necessary to operate our business or provide a service explicitly requested by a user:
| Recipient | Purpose | Location |
|---|---|---|
| Stripe, PayPal, Airwallex | Payment processing. They receive your name, email, transaction amount, and payment method details. | USA / UK |
| Google account authorization and read-only Search Console API access initiated by the WordPress administrator. Search Console reports flow directly between Google and the connected WordPress site. | Global — as described in Google’s privacy documentation | |
| GoatCounter | Privacy-friendly aggregate website analytics. GoatCounter does not use browser cookies or persistent identifiers for website visitors. | Ireland; hosted service infrastructure in Finland and Germany |
All third-party processors are subject to data processing agreements where required by law. We do NOT sell personal data to anyone.
5. International Transfers
Our website and customer data are hosted on servers managed by our hosting provider. Some service providers, including Google and our payment processors, operate internationally or have US operations. This means limited personal data may be transferred outside the UK when you use those services.
We ensure appropriate safeguards are in place where required, including applicable certification under the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses. Google account and API processing is also governed by Google’s applicable privacy terms and API policies.
6. How Long We Keep Data
| Data Type | Retention Period |
|---|---|
| Account and licence records | Duration of your account plus 6 years from last activity, to comply with UK tax and contract law |
| Server logs | 30 days |
| Support emails | 2 years from last correspondence |
| Payment records | 6 years, as required for UK tax record keeping |
| WPGator Search Insights OAuth relay attempt | Deleted immediately after successful retrieval by the connected WordPress site. An incomplete or unclaimed attempt expires and is deleted within 10 minutes. |
| Google OAuth credentials stored by the WordPress plugin | Stored locally by the connected WordPress site until the administrator disconnects Google access, deletes the plugin data or revokes access through Google. |
| Search Console reports | Stored only in the connected site’s WordPress database until its administrator deletes the local data or uses the documented clean-uninstall option. WPGator does not retain a separate copy. |
We will delete data earlier upon request where we are not legally required to retain it. See Section 9.
7. Cookies and Website Analytics
We use cookies only where they are necessary to provide the website, account, shopping basket, checkout, payment or authorization service that you request.
7.1 Essential cookies
These cookies are necessary for the website to function and cannot be disabled in our systems. They are set in response to actions you take, such as logging in, adding an item to a basket, completing checkout or initiating an authorization flow.
| Cookie category | Purpose | Duration |
|---|---|---|
| WordPress authentication cookies | Maintain your logged-in account session | Session or a limited period set by WordPress |
| WooCommerce cart and session cookies | Maintain your basket, checkout session, and purchase flow | Session or a limited period set by WooCommerce |
| Payment-provider cookies | May be set by the payment method you choose to complete checkout and prevent fraud | As set by the relevant provider |
| Google authorization cookies | May be used by Google when you choose to connect a Google account. These are controlled by Google and are not used by WPGator for advertising or analytics. | As set by Google and the connected Google Account |
These cookies are strictly necessary to provide the service you request and do not require consent under the applicable cookie rules.
7.2 Privacy-friendly analytics
We use GoatCounter for aggregate website analytics. GoatCounter does not use cookies, local storage, cache, or other persistent browser identifiers. It does not create advertising profiles or track you across websites. We use the resulting aggregate information to understand overall website use and improve our content and products.
7.3 How we do NOT use cookies
- We do not use analytics cookies
- We do not use remarketing or behavioural advertising cookies
- We do not use social media tracking cookies
- We do not build advertising profiles or audience segments
7.4 Managing cookies
You can manage or disable cookies through your browser settings. Note that disabling essential cookies may prevent you from logging in, maintaining a basket, completing purchases or connecting an external service that you request.
8. Google Search Console Data — WPGator Search Insights
WPGator Search Insights allows a WordPress administrator to connect a Google account and request read-only Search Console data for properties that account is permitted to view.
8.1 Access and purpose
The plugin requests only the following Google permission:
https://www.googleapis.com/auth/webmasters.readonly
This permission allows the plugin to list the connected account’s available Search Console properties and retrieve read-only search-performance data for the property selected by the administrator. The data may include queries, landing pages, clicks, impressions, click-through rates and average positions.
The data is used only to provide the visible query, landing-page, search-opportunity and content-alignment features requested by the administrator. The plugin cannot modify a Search Console property or change its configuration.
8.2 Authorization relay and local storage
A distributed WordPress plugin cannot safely contain a shared Google OAuth client secret. WPGator therefore operates a limited authorization relay to complete Google’s OAuth callback and refresh access tokens.
During connection, the relay temporarily processes OAuth protocol state, the authorization response and an encrypted token bundle pending one-time retrieval by the connecting WordPress site. A successfully claimed attempt is deleted immediately. An incomplete or unclaimed attempt expires and is deleted within 10 minutes.
The relay does not request, proxy, receive, store or analyse Search Console reporting data. Search Console reports are requested directly by the connected WordPress site from Google and stored in that site’s own WordPress database.
The connected WordPress installation stores its Google access and refresh tokens locally in encrypted, non-autoloaded WordPress data. The encryption key is derived from secret material belonging to that WordPress installation and is not stored by WPGator.
8.3 Sharing and Limited Use
Google user data obtained through WPGator Search Insights is not:
- Sold or rented
- Used for advertising or remarketing
- Used to build marketing profiles or audience segments
- Used to train general-purpose artificial intelligence or machine-learning models
- Transferred to third parties except as necessary for the administrator-requested interaction between their WordPress site and Google
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
8.4 Administrator control, revocation and deletion
Only an authorized WordPress administrator can connect a Google account, select a Search Console property, synchronize reports, disconnect Google access or delete locally stored Search Console data.
Disconnecting removes the OAuth credentials stored by the WordPress plugin and stops future synchronization. Existing reporting history remains in the site’s database so it is not destroyed without an explicit administrator decision.
The administrator can use the plugin’s Delete Local Data control, or its documented clean-uninstall option, to delete stored Search Console reports. Access may also be revoked through the connected Google Account’s third-party connections settings.
9. Your Data Protection Rights
Under UK GDPR, you have the following rights:
| Right | What It Means |
|---|---|
| Access | You can request a copy of the personal data we hold about you. |
| Rectification | You can ask us to correct inaccurate or incomplete data. |
| Erasure | You can ask us to delete your personal data where there is no compelling reason for us to keep it. |
| Restriction | You can ask us to limit how we use your data while a concern is investigated. |
| Portability | You can ask us to provide your data in a structured, machine-readable format. |
| Objection | You can object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time. |
To exercise any of these rights, contact us at info@cognizense.com. We will respond within one month.
If you are dissatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint
10. Security
We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), access controls, authenticated encryption for locally stored OAuth credentials, short-lived authorization state and secure payment processing through PCI-DSS compliant providers.
However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.
11. Children’s Privacy
Our plugins are designed for adult website administrators and developers. We do not knowingly collect data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. Changes to This Policy
We may update this policy from time to time, including when plugin functionality or our handling of Google user data changes. Material changes will be communicated by email, where appropriate, or by a notice on our website.
Our use of Google user data will remain limited to the practices disclosed in the current published version of this policy.
13. California Residents — CCPA Notice
This section applies solely to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
13.1 Categories of personal information collected
In the past 12 months, we have collected or processed the following categories of personal information:
| Category | Collected or Processed? | Sold or Shared? |
|---|---|---|
| Identifiers, including name, email and IP address | Yes | No |
| Commercial information, including purchase records | Yes | No |
| Internet activity, including browser type, pages visited and referring URL | Yes — through server logs and aggregate GoatCounter website statistics | No — not used for cross-context behavioural advertising |
| Google account authorization data | Yes — only when an administrator chooses to connect WPGator Search Insights | No |
| Search Console reports | Processed and stored locally by the administrator’s WordPress site; not collected by WPGator | No |
| Geolocation data | No identifiable geolocation data; GoatCounter may report aggregate country-level statistics | No |
13.2 We do NOT sell or share personal information
We do not sell personal information as defined under CCPA. We do not share personal information for cross-context behavioural advertising. We have no actual knowledge of selling or sharing personal information belonging to consumers under 16 years of age.
13.3 Your CCPA rights
To exercise these rights, email us at info@cognizense.com with “CCPA Request” in the subject line. We will verify your identity before processing your request, typically by matching the information you provide with data we already hold.
13.4 Authorized agents
You may designate an authorized agent to exercise your CCPA rights on your behalf. We will require written proof of the agent’s authority and may verify your identity directly.
14. Contact
For questions about this Privacy Policy, Google data handling or your data-protection rights:
- Privacy and data-protection email: info@cognizense.com
- Product support: wpgator.tech/contact/
- Post: COGNIZENSE LLP, 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN
- ICO Registration: 00014276957