Legal

Privacy Policy

Template — review by legal counsel before launch. This is a good-faith starting draft describing the data x402 Paywall actually handles. It is not legal advice and must be reviewed and adapted by a qualified professional for [JURISDICTION] (including GDPR/UK-GDPR and CCPA/CPRA specifics) before publication. Fill in every bracketed placeholder such as [COMPANY LEGAL NAME].

Last updated: [LAST UPDATED — set on publish]

1. Who we are

This policy covers x402-wp.com (the "Site"), the x402 Paywall WordPress plugin (the "Plugin"), and the licence/update service at plugins.x402-wp.com (the "Service"). The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Contact: support@x402-wp.com.

2. What the marketing website collects

The Site is a static marketing site and ships no advertising or cross-site tracking cookies by default. It may collect:

Server / hosting logs — standard request logs (IP address, user-agent, timestamp, requested URL) kept by our host for security and abuse prevention, for a limited period.
Newsletter / contact form (optional). If the form is enabled, the email address and any message you submit are sent to the configured provider so we can reply or send updates you asked for. It is off unless an endpoint is configured, and no third-party form provider is loaded until then. [Name the provider and its region here once configured.]
Privacy-respecting analytics (only if enabled). We do not run analytics by default. If we later add a cookieless, aggregate-only analytics tool, we will name it here and update this policy first.

3. What the licence & update service collects

When you install the Plugin and activate or validate a licence, your WordPress site communicates with our Service. To validate licences and deliver premium updates, the Service processes:

your licence key;
your site URL / domain and an activation instance id (so a licence is bound to the sites it is used on, up to its activation limit);
basic environment metadata sent with update checks (e.g. Plugin version, WordPress and PHP versions); and
request logs for the update endpoints (IP, timestamp) for security and rate-limiting.

We use this data only to authenticate licences, enforce activation limits, serve the correct update, provide support, and prevent abuse. We do not collect the content of your posts, your visitors' personal data, or your customers' payment details through the Service.

4. Payments and billing data

Purchases are handled by Lemon Squeezy as our Merchant of Record. Lemon Squeezy collects and processes your billing details (name, email, payment method, billing address, tax information) under its own privacy policy; we receive only the order and licence information needed to fulfil and support your purchase (such as your email, product/tier, and licence key). We never receive or store your full card number.

5. On-chain USDC payments are not ours to hold

The Plugin facilitates wallet-to-wallet USDC payments between your site and your readers or customers. Those payments settle directly on the blockchain to the wallet you configure; we take no custody of funds and this website does not receive your readers' payment data. Note that public blockchains are inherently transparent and permanent — wallet addresses and transaction amounts are visible on-chain to anyone. How you handle any personal data of your own customers is your responsibility as their data controller.

6. Why we process data (legal bases)

Contract — to provide the licence, updates and support you purchased.
Legitimate interests — security, abuse prevention, and improving the product.
Consent — for the optional newsletter, which you can withdraw at any time.
Legal obligation — where we must retain records (largely handled by Lemon Squeezy as MoR).

We share data only with service providers acting on our behalf or as MoR, including Lemon Squeezy (billing), our hosting/infrastructure provider (the Site and Service run on our Coolify-managed hosting), and any newsletter or analytics provider we explicitly enable and name above. We do not sell your personal data.

8. Retention

We keep licence and instance records for as long as your licence is active and as needed afterwards for support, renewals and legal/accounting purposes, then delete or anonymise them. Server logs are kept for a limited period. [State exact retention periods after review.]

9. Cookies and local storage

The Site uses a single functional browser localStorage entry to remember your light/dark theme preference. It is not a tracking cookie and is not shared. The Site sets no advertising or analytics cookies by default; if that changes, we will add a cookie notice and update this section first.

10. Your rights

Depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. To exercise any of these, email support@x402-wp.com. You also have the right to complain to your local data-protection authority. For billing data held by Lemon Squeezy, requests may need to be directed to them as MoR.

11. International transfers

Our providers may process data in countries other than yours. Where required, transfers rely on appropriate safeguards (such as Standard Contractual Clauses). [Confirm provider locations and safeguards during review.]

12. Children

The Site and Service are not directed to children and we do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy; the "Last updated" date will change and material changes will be highlighted where appropriate. Continued use after an update means you accept the revised policy.