Who we are
Apaxon builds WordPress plugins and operates the WPApaxon platform at wpapaxon.com. For the purposes of UK data protection law, Apaxon is the data controller for the information described on this page.
Apaxon Limited, registered in England and Wales, company number 09784429. Registered address: Piccadilly Business Centre, Aldow Enterprise Park, Manchester, M12 6AE, Greater Manchester.
For anything on this page, write to privacy@apaxon.co.uk.
What we collect and why
Only what the service needs to work. Each item below exists because something would break without it.
| What | Why | Lawful basis |
|---|---|---|
| Email address | To identify your account, sign you in, and send service messages | Contract |
| Name, if you give one | To address you properly in the portal and in support | Contract |
| Password | Stored only as an Argon2id hash. We cannot read it, and cannot tell you what it is | Contract |
| Two-factor secret and recovery codes | Only if you enable two-factor authentication. The secret is encrypted at rest; recovery codes are stored hashed | Contract |
| Licence keys | Stored as a SHA-256 hash plus the first few characters, so you can recognise a key in a list. We never hold the full key | Contract |
| Site addresses you activate | To count seats and show you which sites are using a licence | Contract |
| WordPress, PHP and plugin versions | To warn you about vulnerabilities affecting your setup, and to support you without asking what you are running | Legitimate interests |
| Hashed IP address | To rate-limit sign-in and activation attempts. Hashed with a secret pepper, so the original address cannot be recovered from our database | Legitimate interests — security |
| Audit records | Sign-ins, licence activations, role changes and similar. So that if something happens to your account, both of us can see what | Legitimate interests — security |
Where we rely on legitimate interests, we have considered whether the processing is necessary and whether it is what you would reasonably expect. If you disagree with that assessment for your own data, tell us and we will look at it again.
What the Apaxon Core plugin sends
Nothing, until you enter a licence key. Installed and activated without one, Apaxon Core makes no requests to us at all.
Once a key is entered, the plugin contacts us on a schedule and sends:
- The licence key, so we can tell whose it is
- Your site address, so seats can be counted and shown to you
- WordPress, PHP and installed Apaxon plugin version numbers — and you can turn this off under Apaxon → Settings → Privacy. The cost of turning it off is that we can no longer warn you about vulnerabilities affecting your specific setup
These checks run on a scheduled task, roughly twice a day. They never run on a visitor page load, and no visitor to your website causes a request to us.
What we do not collect
This list matters as much as the one above.
- Nothing about your website's visitors. No page views, no IP addresses, no behavioural data, no fingerprinting
- No content from your site. Not your posts, your products, your customers or your orders
- Analytics only if you say yes. We use Google Analytics to count which pages people find useful. It is switched off until you accept it, and declining changes nothing about how the site works. There is no Facebook pixel, no advertising tag and no other third-party script
- No advertising data, ever. We do not sell, rent or share personal data with advertisers, data brokers or anyone else for their own purposes
Where your data is held
Account and licensing data is stored in a PostgreSQL database hosted by Neon in London, United Kingdom (AWS eu-west-2).
The website and its API run on Vercel. Vercel operates globally, so a request may be handled by infrastructure outside the UK, and Vercel may process technical data such as IP addresses to route and secure that request. Where personal data leaves the UK it is transferred under the UK International Data Transfer Addendum or an adequacy decision.
Who else processes it
We use a small number of suppliers to run the service. Each acts on our instructions under a data processing agreement, and none may use your data for their own purposes.
| Supplier | What for | Where |
|---|---|---|
| Neon | Database hosting | United Kingdom |
| Vercel | Website and API hosting | Global, with UK/EU routing |
| Our email provider | Service messages — sign-in alerts, licence notices | United Kingdom / EU |
We do not currently take payments through this website. When we do, payment card details will be handled by the payment provider and will never reach our servers. This page will be updated before that happens.
How long we keep it
- Account data — for as long as your account exists. Close it and we delete or anonymise your personal data within 30 days
- Licence and activation records — for the life of the licence, then for six years, because they form part of our accounting records
- Audit records — 12 months
- Sessions — 30 days, or until you sign out
Your rights
Under UK GDPR you have the right to:
- Ask what we hold about you, and get a copy
- Have inaccurate information corrected
- Have your data deleted, where we have no overriding reason to keep it
- Object to processing we carry out under legitimate interests
- Ask us to restrict processing while a dispute is resolved
- Receive your data in a portable format
Email privacy@apaxon.co.uk. We will respond within one month. There is no charge, and you do not have to give a reason.
Changes to this policy
If we change anything material — a new supplier, a new category of data, a different purpose — we will update the date at the top and email account holders before it takes effect. We will not quietly broaden what we collect.
Complaints
If you think we have handled your data badly, please tell us first at privacy@apaxon.co.uk — most things are a misunderstanding we can fix quickly.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. You do not have to come to us first.