# Privacy policy

> What personal data evoaddons.com processes when you contact us, buy and use the licence server, where it is stored and for how long. Draft pending review.

# Privacy policy

> Draft pending review by a lawyer. Do not publish without review.

This text describes what the site does with data today. Legal bases, retention periods and third-party terms are marked as pending.

## Controller

\[DATOS DEL TITULAR: company name, tax ID, address and contact email\]. The full details are in the [Legal notice](https://evoaddons.com/en/legal-notice).

## What data is processed

### Contact

If you write by email or through the form, we process what you send us (usually name, email and the message) so we can reply. \[PENDIENTE: exact fields of the contact form, built separately\]

### Purchase

Payment happens on a payment page hosted by Stripe: this website does not collect or store card data. Stripe returns the following purchase data, which we store on the order:

- the customer's name and email;
- billing address and, if you provide it, tax ID or VAT number;
- amount, taxes and currency, and the order status (paid, refunded, disputed, duplicate);
- the identifiers of the Stripe payment session and charge;
- the invoice number and URL, once issued.

The shop calculates VAT with Stripe's automatic tax feature.

### Customer account

When you pay, a Joomla account is created with the payment email (or the existing one is reused) and you receive a link to set the password. The account holds your subscriptions, your websites with their domains and your licences. The full Download ID is stored encrypted so it can be shown to you; a hash is used to look it up.

### Email notices

We send an email to confirm a purchase, renewal or upgrade, and expiry reminders before and after the date. Each is sent once per subscription and expiry date.

### Invoices

Each paid order is put in a notification queue and sent to an automation flow (n8n), which creates the invoice in the invoicing system (Holded). The notification carries the order and the customer's data (name, email, address and tax ID or VAT number). Delivered notifications are removed from the queue after 90 days. \[PENDIENTE: confirm providers, server locations and data processing agreements\]

### Licence server

When an extension checks its licence, the server receives: Download ID, product, the site's domain, a site identifier (random UUID), the extension version and the PHP and Joomla versions. The licence stores the site identifier, the dates of the first and last check, the extension version and the domain. The PHP and Joomla versions are received but not stored. No personal data and no site content is sent.

To limit abusive requests, the server keeps the request's IP address and the Download ID hash in a temporary table. Those records are deleted after 24 hours, and a daily task removes anything older than 2 days.

### Downloads

Each ZIP download records the subscription, the licence, the version, the IP address and the date. \[PENDIENTE: retention period for downloads; the code has no automatic deletion today\]

### Server logs

The licence server writes system errors to a Joomla log (`evolicenses.php`). By design it does not store Stripe keys or full Download IDs. The administration panel also keeps a log of administrators' actions on subscriptions. \[PENDIENTE: web server and hosting logs, and their retention period\]

### Cookies and local storage

See the [Cookie policy](https://evoaddons.com/en/cookies).

## Who we share data with

- **Stripe**, for payment and tax calculation.
- **n8n and Holded**, for automation and invoicing.
- The web hosting and email provider. \[PENDIENTE: name of the hosting and email provider\]

\[PENDIENTE: international transfers, if any, and safeguards\]

## Legal basis and retention periods

\[PENDIENTE: legal basis and retention periods to be set with the adviser\]

What the system does today: Joomla's privacy plugin can export a user's data and handle an erasure request. While orders under 6 years old exist, the erasure request is refused, citing the obligation to keep invoices. With no orders subject to that retention, the account, subscriptions, websites and licences, downloads, reminders and orders are deleted. \[PENDIENTE: confirm the 6-year period with the adviser\]

## Your rights

You can ask for access, rectification, erasure, objection, restriction and portability by writing to \[DATOS DEL TITULAR: email de contacto\]. \[PENDIENTE: wording of the rights and of the complaint route to the supervisory authority, to be reviewed by the adviser\]

This is not legal advice; check with your own adviser.

---

https://evoaddons.com/en/privacy