Last updated: 5 October 2026

I. General information

1. This document specifies the privacy principles applicable in the Online Service https://fibofilters.com/ (hereinafter referred to as the “Online Service”).
2. For the purposes of data protection legislation, we are the data controller of your personal data. Damian Góra Web Development, sierż. Grzegorza Załogi 2/13, 42-500 Będzin, Poland (EU), Our VAT-EU number: PL6521701234, Email: [email protected] .
3. Personal information collected by the Controller shall be processed in accordance with the provisions of the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (GDPR).
4. We are committed to complying with the GDPR.

II. Personal information

1. The Controller collects information provided voluntarily by the Online Service Customers. However, the provision of marked personal data is a condition for placing an order.
2. Moreover, The Controller may record the information about connection parameters, like IP addresses, for technical purposes, for server administration and for collection of general, statistical demographic information (e.g. about the region from which the connection comes), and also for security purposes. Server logs containing such connection data are kept for 30 days and are then deleted automatically.
3. The Controller shall make an extra effort in order to protect privacy and information about the Online Service Customers provided to him. The Controller shall exercise due diligence when selecting and applying appropriate technical measures, including those of programming and organizational nature, in order to protect the processed data, and in particular he shall protect the data from unauthorized access, disclosure, loss and destruction, unauthorized modification, and also from their processing with the breach of the applicable provisions of law.
4. Personal data will be processed in accordance with the principles of art. 5 GDPR.
5. Personal data will be:
   1. processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
   2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; (‘purpose limitation’);
   3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
   4. accurate and, where necessary, kept up to date (‘accuracy’);
   5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; (‘storage limitation’);
   6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

III. Purpose for Processing

1. The basis for the processing of the Customer’s Personal Data is primarily the necessity to perform the contract to which he is a party or the need to take action at his request prior to its conclusion (Article 6 par 1 ( b) of GDPR).
2. In other purposes, the Customer’s Personal Data may be processed on the basis of:
   1. applicable law when processing is necessary to fulfill the legal obligation of the Controller e.g. when based on tax regulations or accounting one, The Controller settles concluded sales contracts (Article 6 (1) (c) of the GDPR);
   2. indispensable for purposes other than those mentioned above resulting from legitimate interests pursued by the Controller or by a third party, in particular to determine, assert or defend claims, market and statistical analyses (Article 6 (1) (f) GDPR).
3. Personal data processed for purposes related to the purchase will be processed for the period necessary to complete the purchase and order, after which the data subject to archiving will be stored for the period appropriate for the limitation of claims.

IV. The personal data we collect and use

1. We ensure that the collection and use of your personal data is lawful. Therefore, for the purposes listed below, we only use your personal data if one of the following conditions apply:
   1. You have given us your consent ;
   2. We need your personal data for the performance of a contract you enter into with us, such as when you purchase a product through the website ;
   3. We need to comply with legal obligations ;
   4. We need to protect your vital interests ;
   5. Your data is necessary for the public interest, or ;
   6. We have a legitimate interest in processing the personal data.
2. We may collect the following:
   1. Contact information: First name, Email ;
   2. Submission of forms: First name, Email, User’s Licence key, Media files uploaded via user, the subject of the user’s message ; support requests, whether sent through our forms or by email, are kept for as long as they are needed to handle your case and to keep the history of issues affecting our products, so that we can recognise a problem that comes back. You can ask us to delete your support requests at any time.
   3. Purchases: First name, Last name, Email, postal address ;
   4. Statistical information about your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data. When we collect it with Google Analytics, we use cookies that distinguish visitors, and only after you accept statistics cookies (see COOKIES).
3. Purchases are made through the Freemius checkout. Freemius, Inc. sells the licences for our products in its own name: it takes your payment through its payment providers (for example Stripe or PayPal), issues the invoice and manages your licence. We do not collect or store your card details. In the Freemius dashboard we can see the data needed to deliver and support the product: your name, email address and country, and the details of your purchases and licences.
4. We sell our products using Freemius secure checkout, which enables secure online payments, licensing, fulfillment, and more. We also use Freemius iframe to display “My Account” area.
5. Freemius Inc., (4023 Kennett Pike, Wilmington, 19807 DE, USA), USA acts as the ‘data processor’. The Standard Contractual Clauses adopted by the European Commission also apply to such processing. Freemius keeps purchase, licence and account data for as long as it remains accurate and necessary for the purpose it was collected for, and deletes it afterwards unless it has a legal basis to keep it longer. You can request deletion of your Freemius account data in your Freemius account or at [email protected].
6. We share your personal data with service providers only for the purposes described in this policy; the providers are listed in section VI. Freemius, Inc. also processes purchase data under its own privacy policy (https://freemius.com/privacy/) for the purposes described there, because it sells the licences for our products in its own name; for the plugin data described in section VI, it acts as our processor, and it also uses some of that data under its own privacy policy.
7. Support requests and our support archive. We handle the messages you send to our support email addresses in our helpdesk (Zendesk). We also keep an internal archive of support cases, which includes the requests handled in our helpdesk and the public threads of the FiboSearch support forum on wordpress.org. Before a case is added to the archive, our software automatically removes from its text the names and contact details that we know from the helpdesk record (for example the requester’s name and email address), names in greetings and signatures, and the identifiers that it recognises by their form, such as email addresses, IP addresses, phone numbers and postal addresses written in common formats, Polish tax numbers (NIP) written with the label NIP, payment card numbers, passwords, access and licence keys, and the domain names of websites. Automatic removal does not catch everything, so a case may still contain personal data that the software did not recognise. A case in which our final check still finds a name or contact detail known from the helpdesk record, or a password or key, is not sent to OpenAI. We use the archive to analyse the problems and requests reported by our customers, in order to improve our products and our support; for this purpose the cleaned text is processed by OpenAI (see section VI). Each helpdesk case in the archive carries, where we know them, pseudonymous keys calculated from your email address and from the address of your site with a secret key that we keep separately from the archive; a case may also record the country indicated by the ending of your site’s domain or of your company email domain (for example .de). We use these keys only to link support cases with the purchase and installation data we receive from Freemius for aggregate statistics, and to find your cases when you ask us to access or delete your data; we do not use them for marketing directed at you or for decisions about individual customers. The legal basis for this processing is our legitimate interest in improving our products and our support and in statistical analyses (Article 6(1)(f) GDPR); we find and delete your cases at your request to comply with our obligations under the GDPR (Article 6(1)(c) GDPR).
8. You have the right to object, on grounds relating to your particular situation, at any time to the processing of your support requests in our support archive. To do so, write to us at the email address given in section I.
9. Whenever we transfer your personal data out of the EEA, we attach a similar degree of protection to it (as it would receive in the EEA) by ensuring at least one of the following safeguards is implemented:
   1. We will only transfer your personal data to countries, territories or sectors within a country that have been deemed to provide an adequate level of protection for personal data by the European Commission.
   2. The transfer is subject to a legally binding and enforceable commitment on the recipient to protection the personal data (e.g. through the use of European Commission approved standard contractual clauses).
   3. The transfer is made subject to binding corporate rules.
   4. The transfer is based on a derogation from restrictions on transferring personal data outside of the EEA (such as where you give your consent, the transfer is necessary for the performance of contract with you, or the transfer is necessary for the establishment, exercise or defence of legal claims).

V. Your rights on personal data concerning you

1. As Customers provide their personal information voluntarily, they shall have the right to access their personal data and the right to rectify, delete, limit the processing, the right to data transfer, the right to object, the right to withdraw consent at any time.
2. If it is found that the processing of personal data violates the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, www.uodo.gov.pl.
3. Detailed conditions of the above rights shall be indicated in Articles 15­22 of the GDPR Regulation.

VI. Who we share your personal data with

We share personal data with the following providers, for the purposes described below.

1. Freemius, Inc. (Wilmington, Delaware, USA) sells the licences for our products in its own name. It runs the checkout, takes your payment, issues the invoice and manages your licence and the “My Account” area (see section IV). When you open our pricing page, your browser loads the Freemius checkout script from Freemius servers. If you opt in when activating our plugin in WordPress, Freemius also receives, on our behalf, your name and email address, the address of your site, the versions of WordPress, PHP and our plugin, the status of the plugin, the language of your site and, optionally, the list of plugins and themes installed on your site. We use this data to provide support, to understand how our plugins are used and to add you to our mailing list (see Mailchimp below). Freemius also processes some of this data under its own privacy policy (https://freemius.com/privacy/).
2. Amazon Web Services EMEA SARL (Luxembourg): hosting of our websites (Amazon Lightsail) and storage of their backups (Amazon S3).
3. Cloudflare: all traffic to our websites passes through Cloudflare, which provides our DNS, content delivery and protection against attacks, and processes your IP address for these purposes.
4. Google: Google Analytics 4, only if you accept statistics cookies (see COOKIES); Google reCAPTCHA, which protects our contact form against spam: its script is loaded on every page of our website, so your browser connects to Google servers, which receive your IP address and information about your visit; Google Workspace, our company email (including messages you send to our support addresses and messages from the contact form on our website) and our file storage, where we also keep an encrypted backup copy of our support archive.
5. Zendesk: our helpdesk. Messages you send to our support email addresses are handled as support requests in Zendesk.
6. OpenAI Ireland Limited: we use the OpenAI API to summarise the cases in our support archive and to extract facts from them, such as the product, the problem and the solution (see section IV). We send the text cleaned as described in section IV, that is the title and the messages of a support case or forum thread, including our team’s internal notes and text attachments such as log files, together with a few technical labels of the case, such as the product, the plan, the channel and the year. Other attachments, such as images, are not sent. OpenAI Ireland Limited processes this data as our processor under a data processing agreement and may transfer it to OpenAI affiliates and subprocessors outside the EEA, including the United States (see the last paragraph of this section).
7. Mailchimp: our mailing list. It holds mainly people who opted in when activating our plugin in WordPress (added through the Freemius integration) and people who signed up through forms on our websites. For each contact it stores the email address, name, the IP address used when opting in, whether marketing emails were allowed, and the status of the contact’s installations and licences of our plugins.
8. Slack and ClickUp: our internal team chat and task management tools, where our team may discuss your support request or create a task based on it.

Some of these providers, or the companies that process data for them, are based in the United States. Amazon Web Services, Inc., Cloudflare, Inc., Google LLC, Zendesk, Inc., The Rocket Science Group d/b/a Mailchimp and Slack Technologies, LLC are certified under the EU-U.S. Data Privacy Framework, and transfers to them are based on the European Commission’s adequacy decision for that framework. Transfers to Freemius, Inc. and to Mango Technologies, Inc. (ClickUp) are based on the Standard Contractual Clauses adopted by the European Commission. OpenAI Ireland Limited transfers data outside the EEA only on the basis of agreements containing these Standard Contractual Clauses or of an adequacy decision of the European Commission. The Standard Contractual Clauses are set out in Commission Implementing Decision (EU) 2021/914; you can ask us for more information about the safeguards that apply to a given provider at the email address given in section I.

VII. How long we keep your personal data

1. Purchase, licence and account data held by Freemius: as described in the Freemius paragraph in section IV.
2. Support requests, including their cleaned copies and summaries in our support archive: for as long as they are needed to handle your case and to keep the history of issues affecting our products. You can ask us to delete them at any time.
3. Support cases sent to OpenAI: we ask OpenAI not to keep our requests after processing them, and we delete the files we upload for batch processing as soon as we receive the results. According to OpenAI, encrypted cache data that it may create while processing a request is not kept longer than 24 hours, and its abuse monitoring logs, which may contain the content of requests, are kept for up to 30 days unless longer retention is required by law or is necessary to protect its services or others from harm (https://developers.openai.com/api/docs/guides/your-data).
4. Mailing list (Mailchimp): we email you until you unsubscribe. After that, your address stays in our Mailchimp list marked as unsubscribed; you can ask us to delete it completely.
5. Google Analytics: user-level and event-level data are deleted automatically at the end of the data retention period set in our Google Analytics account; standard aggregated reports are not affected by this setting.
6. Server logs: 30 days, as described in section II.
7. Your cookie consent choice: 365 days.

COOKIES

1. We use cookies on our website.
2. When viewing the Online Service websites “cookie” files are used, which are small text files recorded in the Customer’s target device in connection with using the Online Service. They are used in order to improve the experience with the Online Service websites.
3. The “cookie” files used by the Controller are safe for the Customer’s devices. In particular, it is not possible for viruses or other unwanted or malicious software to enter the Customer’s devices in that way. Those files allow to identify the software used by the Customer and to adjust the Online Service to each Customer individually. “Cookie” files sometimes contain information about the domain name of their origin, how long they are kept in the device and the ascribed value.
4. The Controller uses three types of “cookie” files:
   1. Session cookies: they are kept in the Online Service Customer’s device and remain there until the given browser session is closed. Then the recorded information is permanently deleted from the memory of the Online Service Customer’s device. The session cookies’ mechanism does not allow to download any personal information or confidential information from the Online Service Customer’s device.
   2. Permanent cookies: they are kept in the Online Service Customer’s device and remain there until they are deleted. They are not deleted automatically when the session of the given browser is closed or when the device is turned off. The permanent cookies’ mechanism does not allow to download any personal information or confidential information from the Online Service Customer’s device.
   3. “Analytical” cookies allow for a better understanding of how the Customer interacts with the content of the Service, better organize its layout. “Analytical” ” cookies ” collect information about the manner of using the Service by the Customer, the type of website from which the Recipient was redirected, and the number of visits and time of the Customer’s visit to the Service. This information is linked to cookies that distinguish visitors and is used to develop statistics on the use of the Service. Analytical cookies are set only after you accept statistics cookies.
5. The Customer may, by himself and at any time, change the “cookie” files settings, specifying the conditions of their storing and of their access to the Customer’s device. The settings referred to in the previous sentence may be changed by the Customer through the web browser settings or through configuration of the service. Those settings may be changed in particular so as to block automatic support for “cookie” files in the web browser settings or to inform each time they are introduced to the Customer’s device. Detailed information about the possibilities and ways of supporting cookie files is available in the software (web browser) settings.
6. To learn how to manage cookies, including how to disable them in your browser, you can use the help section of your browser. You can learn more about this by pressing the F1 key while in your browser. In addition, you will find appropriate tips on the following pages, depending on the browser you are using:
   1. Firefox
   2. Chrome
   3. Safari
   4. Internet Explorer / Microsoft Edge
7. The Customer may remove “cookie” files at any time, using the functions available in the web browser he uses.
8. Limitation of the “cookie” files application may affect some functionalities available on the Online Service website.
9. We use the following third party cookies to help run our business:
   1. Google Analytics
      
      We use Google Analytics 4, provided by Google LLC (Mountain View, California, USA), to understand how visitors use our website. Google Analytics is loaded only after you accept statistics cookies in the consent banner. According to Google, Google Analytics 4 does not log or store IP addresses (https://support.google.com/analytics/answer/2763052). You can withdraw your consent at any time using the “Manage consent” button, which appears on our pages after you make your first choice.
      
   2. Freemius
      
      The Website uses Freemius 4023 Kennett Pike, Wilmington, 19807 DE, USA. The service automatically adds cookies when a user opens the checkout. Those are essential cookies for security, fraud detection & prevention, and completion of a purchase. There’s no way to check out without letting the service use cookies. The checkout address is https://fibofilters.com/pricing. We also use Freemius iframe to display “My Account” area. The “My Account” address is https://fibofilters.com/account. There’s no way to log in without letting the service use cookies. Here’s a link to the Freemius privacy policy and its checkout cookie policy. If you wish to opt-out of Freemius’ cookies setting please go to their cookie policy on https://freemius.com/privacy/cookies/ and follow their opt-out instructions.

Consent and the cookies we use

When you first visit our website, a banner lets you accept or deny cookies by category. Google Analytics cookies are set only after you accept statistics cookies. You can change or withdraw your choice at any time using the “Manage consent” button, which appears on our pages after your first choice. Your choice is remembered for 365 days.

Cookies and similar technologies used on our website:

1. cmplz_* (cookies whose names begin with cmplz_): remember your consent choices; set by our website (Complianz plugin); functional; 365 days.
2. _ga and _ga_*: distinguish visitors and keep the state of an analytics session; set by Google Analytics only after you accept statistics cookies.
3. Freemius checkout and “My Account” cookies: described in the Freemius paragraph above.
4. cf_clearance: set by Cloudflare on our domain to protect our website against automated traffic; necessary for security; up to 365 days.
5. Google reCAPTCHA, which is loaded on every page to protect our contact form, stores data in your browser’s local storage under the name _grecaptcha and may set its own cookies in the google.com domain.

If you have any questions or concerns about this Privacy Policy, please contact us at [email protected].