The plugin
The Movebase plugin runs on your WordPress site. It sends nothing to us unless you connect it to Movebase Cloud. If you connect your own storage (IDrive e2, MEGA S4 or another S3-compatible service), backups go straight from your site to that service under its own privacy policy.
Movebase Cloud: what we collect
- Account details: your name, email address and a one-way hash of your password. If you turn on two-step sign-in, an encrypted authenticator secret.
- Google sign-in: if you choose “Continue with Google”, Google tells us your name, email address, whether Google has verified that address, and an account ID that links your Google account to Movebase. We never receive your Google password or access your Gmail, Drive or other Google data.
- Billing details: your plan, payment status and the customer and subscription IDs from Stripe or Paddle. Card and bank details go directly to Stripe or Paddle; we never see or store them. For each payment we keep an invoice with the amount, date and the billing details you chose to add (company name, address, tax ID), as tax law requires.
- Connected websites: each site’s address, WordPress and Movebase versions, when it last connected, and how much storage it uses.
- Backups: the backup files your sites upload. They contain whatever is on those sites, which can include personal data about your visitors and customers. For that data, you are the controller and we process it only on your instructions, to store it and give it back to you.
- Security logs: sign-in times, IP addresses and changes made in your account, kept to protect the service. Repeated failed sign-ins lock an account for a short time, and we record blocked attempts.
Newsletter
If you subscribe to our newsletter, we keep your email address, when you subscribed and confirmed, and the IP address used. We only send it after you click the link in the confirmation email. Every newsletter has a one-click unsubscribe link; after you unsubscribe we keep your address only on a do-not-send list, and you can ask us to delete it completely.
Why we use it
To run your account and storage, take payments, send emails you need (such as invoices, renewal and failed-payment reminders, a reminder if you started paying but didn’t finish, password resets and storage warnings), prevent abuse and answer support requests. We do not sell personal data, show ads or use backups for anything else.
Who processes it for us
- Our storage provider, which holds backup files in private storage that only Movebase Cloud can access.
- Stripe or Paddle, for payments.
- Our web host.
- Our email delivery provider (such as Resend), which sends account emails and newsletters.
- Google, if you sign in with Google, and Google Analytics, if you allow analytics cookies.
- Cloudflare Turnstile, when it protects our sign-in and sign-up forms from bots. It checks your browser without tracking you across sites.
- Search engines that support IndexNow (such as Bing), which we tell when a public page on this website is published or changed. Only the page address is sent.
Each is bound by its own terms to protect the data and use it only to provide its service.
Cookies
We always use a few cookies the site needs to work: a session cookie that keeps you signed in, a security cookie that protects forms, and a small cookie that remembers how you last signed in, so we can mark it “Last used”. Your choices for theme, dismissed notices and cookies are stored in your browser only.
We use Google Analytics 4 to understand how many people visit and which pages help them. It only runs after you choose “Accept” in the cookie banner. It sets cookies such as _ga that last up to two years, and Google processes the data under its own privacy policy. We do not use advertising features or sell this data. You can change your choice at any time with “Cookie settings” at the bottom of every page.
How long we keep it
- Backups: until you delete them, or 30 days after your plan ends.
- Account details: while your account is open, then deleted within 30 days of closing it, except billing records we must keep for tax law.
- Security logs: up to 12 months.
- Newsletter: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days.
Your rights
You can see and change your details in your account, download your backups, and ask us to export or delete your data. Depending on where you live, you may also have the right to object or complain to a data protection authority.
Contact
Privacy questions or requests: [email protected].