Legal

GDPR

Last updated June 2026

GDPR Compliance

Why self-hosting matters for GDPR

The General Data Protection Regulation (GDPR) and the UK GDPR set the standard for how personal data should be handled, and we agree with that standard. Our whole product philosophy is privacy-first and self-hosted, which makes compliance far simpler for you: the data your visitors generate stays in your own WordPress database, never on our servers.

Because our plugins do not ship visitor data to third parties, there are fewer processors to document, fewer cross-border transfers to justify, and less surface area for things to go wrong.

1. Controller and processor roles

  • For data inside your WordPress site - form entries, orders, comments, forum posts - you are the data controller. The plugins are tools you operate, and that data never reaches us.
  • For your customer account and license - we are the controller, because we decide how to run billing, licensing, and support.
  • For license and update checks - we act as a limited processor of the minimal data those calls contain (your site URL and plugin version).

We are happy to enter a Data Processing Agreement (DPA) with business customers who need one. Request it at privacy@revolutionaryplugins.com.

2. Lawful basis for processing

We only process personal data when we have a lawful basis under Article 6:

  • Delivering your license and running your account - performance of a contract.
  • Processing payments and keeping tax records - legal obligation.
  • Securing our systems and preventing abuse - legitimate interests.
  • Sending product update emails - consent (you can withdraw it any time).

3. Your rights as a data subject

If you are in the EU or UK, the GDPR gives you strong rights over your personal data. We support all of them:

  • Right to be informed - this page and our Privacy Policy explain what we do.
  • Right of access - request a copy of the personal data we hold about you.
  • Right to rectification - have inaccurate data corrected.
  • Right to erasure - ask us to delete your data, subject to legal retention limits.
  • Right to restrict processing - ask us to pause processing while a concern is resolved.
  • Right to data portability - receive your data in a structured, machine-readable format.
  • Right to object - object to processing based on legitimate interests or direct marketing.

To exercise any right, email privacy@revolutionaryplugins.com. We verify your identity, respond within one month, and never charge for a reasonable request.

4. How our plugins help you comply

  • Revolutionary Captcha replaces Google reCAPTCHA with a self-hosted challenge, so your forms stop bots without sending visitor data to a third party.
  • Revolutionary Forms lets you switch off IP and user-agent storage, set automatic entry retention windows, add consent checkboxes, and plugs into WordPress native export and erase tools.
  • Revolutionary SEO ships with no analytics or external phone-home calls of its own, so it adds nothing to your processor list.
  • Revolutionary eCommerce keeps order and customer records in your database and honors WordPress data-export and erase requests.

5. WordPress data export and erasure

WordPress has built-in tools under Tools, Export Personal Data and Tools, Erase Personal Data that let you fulfil a visitor access or deletion request. Our data-collecting plugins register with these tools, so when a visitor asks you to export or erase their data, the entries, orders, or messages our plugins stored are included automatically. You handle the request once, in one place.

Set sensible retention windows so old personal data is purged automatically. Holding data you no longer need is one of the most common compliance gaps, and one our plugins help you close with a single setting.

6. International data transfers

Because visitor data stays on your own server, you decide where it lives. For the limited data we hold as a controller (your account, billing, and license), our sub-processors are chosen for their compliance posture, and any transfer outside the EU or UK is covered by appropriate safeguards such as Standard Contractual Clauses. The full sub-processor list lives in our Privacy Policy.

7. Security measures

The GDPR requires appropriate technical and organizational measures. Ours include TLS encryption in transit, encryption at rest for sensitive data, hashed passwords, multi-factor authentication on production access, least-privilege permissions, and short log-retention windows. We design every feature to collect the minimum data needed - the simplest way to protect data is not to hold it.

8. Breach notification

If a personal data breach affecting our customers occurs, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where required, and we will inform affected individuals without undue delay when the breach is likely to result in a high risk to their rights.

For data your site collects, you are the controller, which means breach notification for that data is your duty. We give you the tools to secure and minimize it, but the obligation sits with you as the operator of the site.

9. Data Processing Agreement

For the minimal data we process on your behalf during license and update checks, we offer a Data Processing Agreement that meets Article 28 requirements. It is a short, readable document. Request a copy at privacy@revolutionaryplugins.com and we will send it over for signature.

10. Contact our data team

Questions about GDPR, a data request, or a DPA? Email privacy@revolutionaryplugins.com. We treat data questions as a priority and answer them ourselves. For the broader picture of how we handle information, read our Privacy Policy.