Privacy — MarcoPlot

This website

marcoplot.com is a handful of static HTML files and one stylesheet. There is no database behind it, no application, no login and no form.

No cookies. The site sets none of any kind.
No analytics and no tracking. There is no analytics script, no tag manager, no pixel and no third-party embed.
Nothing loaded from anywhere else. No external fonts, no external images, no third-party host serving any part of this page. Every byte this page needs comes from this domain.
Server logs. The web server keeps ordinary access logs — IP address, time, the page requested, browser user-agent — as every web server does. They are used to keep the site running and to see whether it is broken, and are not combined with anything else or given to anybody.
Cloudflare is in front of this domain. DNS and traffic for marcoplot.com go through Cloudflare before reaching our server, so Cloudflare sees the request first and keeps its own short-lived logs of it. That is protection and delivery, not measurement: we ask Cloudflare for no report about you, and Cloudflare Web Analytics is not in use. Its bot check does try to add a small script of its own to every page here; this site’s Content-Security-Policy refuses to run it, and no cookie is set either way.

If you e-mail contact@marcoplot.com, we keep the e-mail so we can answer it. That is the only place this site could ever get your address from, because there is nothing here that could ask for it.

The plugins

MarcoPlot's free WordPress plugins, such as MarcoPlot Booking Venue, and their paid Pro add-ons, run entirely inside your own WordPress site. We do not host anything for you, we never see your bookings, and we have no copy of your customers' data.

The free plugin does not phone home. No analytics, no usage reporting, no licence check, no external script, no external font, no external image. The admin screens load nothing from anywhere.
The Feedback page sends only when you press Send: to marcoplot.com, the topic and message you wrote, your reply address if you gave one, the versions of the plugin, its Pro add-on, WordPress and PHP, and the site language. We keep it with the date and the IP address it came from, so that we can answer it and limit abuse; nothing about your bookings or customers is sent.
Payments, only if you switch them on. With your own Stripe key, the plugin sends api.stripe.com the amount, currency, a description of the booking (space, date and time), the booking ID, the customer's email and the address of the customer's booking page, then opens Stripe Checkout; it also checks payment and refund status, checks your key and reads your account's country and payment method settings, creates a tax rate if you charge sales tax, and closes any open payment pages when you delete the plugin. With your own PayPal credentials, it sends PayPal the amount and the tax in it, currency, a description of the booking, the booking ID and the address of the booking page, and checks payment and refund status. These requests go from your server to Stripe or PayPal. They do not pass through us.
An email address check, on your own server. When a customer, or you, enter an email address, the plugin looks up the domain (the part after the @) with a DNS lookup on your server's own resolver, to catch mistyped addresses. No third-party service receives the address or the domain from the plugin.
Your payment account is yours. Money goes from your customer to your own Stripe or PayPal account. We take no commission and add no fee for your customers.
A Pro add-on makes more requests, and only Pro does. When you activate the licence, when it checks the licence and looks for updates (at most a few times a day), when it downloads an update, and when you press Deactivate on the Pro license screen, it tells marcoplot.com the licence key, the address of the site, the product, and its version — nothing about your bookings, your customers or your takings. If the licence check cannot reach us, Pro keeps working for seven days and then switches its paid features off; it never blocks the free plugin and it never deletes anything.
Card details never touch your site. Customers pay on a page hosted by Stripe or PayPal. What your site stores are Stripe's and PayPal's own identifiers for the payment, which are useless to anybody outside your account.

If you buy Pro

Buying is the one place where we hold data about you, the shop owner. The sale goes through Link, a Stripe affiliate that acts as the seller of record: it takes the payment on Stripe's own pages, works out the tax and issues the receipts and invoices, and it processes your billing details under its own privacy policy. We never see a card. What our licence service stores is the short list it needs in order to answer “is this subscription still paid?”: your licence key, the e-mail address you paid with, Stripe's own customer and subscription identifiers, the plan and the date it is paid through, the addresses of the sites you activate, and a dated log of activations, renewals and refusals so that a support question has an answer. We do not sell it, share it, or use it to write to you about anything other than your subscription. Cancel and ask, and it is deleted; the record Stripe keeps of the payment is Stripe's and is kept as long as the law requires them to. The email address given at checkout is used to send your license key and the confirmations of your purchase, refund and canceled renewal.

Your obligations, not ours

Booking data — names, e-mail addresses, phone numbers, times, notes, answers to your booking questions and payments — is stored in your own WordPress database. Under the GDPR and equivalent laws you are the controller of it. The plugin gives you the tools; what you collect, how long you keep it and what you tell your customers is yours to decide.

Two things worth knowing when you write your own privacy notice:

The iCalendar subscription links carry a secret instead of a login, because a calendar application polling a feed has no session. They show customer names, so treat a link like a password. A new link can be made under Settings, and the old one stops working at once.
Uninstalling the plugin keeps your data unless you first choose to delete it with the plugin, in Settings. Stripe keys and PayPal credentials are removed on deletion whichever way that choice is left, because they are credentials rather than records.

Stripe and PayPal

When you switch payments on, Stripe or PayPal processes payment data as your own payment provider, under the agreement you have with them. We are not a party to it.

Questions about any of this: contact@marcoplot.com. This page will be updated if what the site or the plugin does ever changes.