Privacy & Security Policy

1. Overview

Covlor ("we", "us", "our") is committed to protecting your privacy. We operate covlor.uk and associated sub-domains, providing WordPress plugins, After Effects scripts, and a software license management platform.

This Privacy & Security Policy applies to all personal data collected through our websites, products, and communications. By using our services you agree to the practices described below.

2. Data We Collect

2.1 Account & Purchase Data

When you register or purchase a license we collect:

• Full name and email address
• Billing address (country, postcode)
• Payment method — processed securely by our payment provider; we do not store card numbers
• License key activation history (domain, IP address, timestamp)

2.2 Plugin Telemetry (Optional)

Our plugins may optionally send anonymous usage statistics — plugin version, WordPress version, PHP version, and active feature flags — to help us improve the product. This is always opt-in and clearly labelled during setup. No personally identifiable information is included.

2.3 Website Usage Data

We collect standard web server logs and, where you consent, analytics data including:

• Pages visited and time on site
• Referring URL and browser/device type
• IP address (anonymised before storage)

2.4 Support Communications

When you contact us at hello@covlor.uk we retain the content of that communication to resolve your issue and improve our support processes.

3. How We Use Your Data

We never sell your personal data to third parties. We never use your data for advertising profiling.

4. Cookies

We use a small number of cookies:

• Essential cookies — session management, login state, CSRF protection. These are required for the site to function.
• Preference cookies — remembering your UI settings (e.g., dark mode). Stored for 1 year.
• Analytics cookies — only set after you accept our cookie notice. We use privacy-respecting analytics with IP anonymisation and no cross-site tracking.

You can manage or delete cookies at any time through your browser settings. Declining analytics cookies does not affect your access to any feature.

5. Third-Party Services

We share data with trusted third parties only where necessary:

All providers are contractually bound to use data only for the purposes stated and to maintain appropriate security standards.

6. Data Storage & Retention

Your data is stored on servers located in the European Union. We retain:

• Account data — for the lifetime of your account plus 2 years after closure (required for tax records)
• License activation logs — 3 years
• Support emails — 2 years
• Analytics data — 13 months rolling window
• Server logs — 30 days

7. Security

We take security seriously and implement industry-standard measures to protect your data:

• HTTPS everywhere — all traffic is encrypted with TLS 1.2+
• Password hashing — passwords are hashed using bcrypt; we never store plaintext passwords
• API authentication — license validation uses signed tokens with expiry
• Access controls — production databases are not publicly accessible; access is limited to authorised personnel only
• Dependency monitoring — we regularly audit and update third-party dependencies for known vulnerabilities
• Data minimisation — we collect only what is necessary for the stated purpose

Despite our best efforts, no system is 100% secure. If you discover a vulnerability please report it responsibly to hello@covlor.uk.

8. Your Rights

Under GDPR and applicable UK/EU data protection law you have the right to:

• Access — request a copy of all personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Restriction — ask us to stop processing your data in certain circumstances
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is consent-based, withdraw at any time

To exercise any of these rights, email us at hello@covlor.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect data from anyone under 16. If we become aware that we have inadvertently collected such data we will delete it promptly. Please contact us if you believe a child's data has been submitted.

10. Policy Changes

We may update this policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. Continued use of our services after the effective date constitutes acceptance of the revised policy.

11. Contact Us

For any privacy-related queries, data subject requests, or security disclosures:

• 📧 Email: hello@covlor.uk
• 🌐 Website: covlor.uk

We aim to respond to all enquiries within 1 business day and all formal data subject requests within 30 days.