Home / Data processing & sub-processors
Data processing & sub-processors
What we hold, who else touches it, and what deliberately never reaches us at all.
Who is controller
For your account, billing and licence records, OwnWebServers LTD is the controller. Where you use the plugin to process personal data belonging to your own site's visitors, you are the controller and we are not involved — see the section below.
What we process
Account and billing data: name, email, country, licence keys, order and invoice records, and the domains you activate. Operational data: IP address and timestamp of licence API calls, which is how activation limits and abuse detection work. Payment card details are never held by us; they are entered with the payment provider directly.
What never reaches us
This is the most important section and the one most policies get wrong.
The plugin uses your own API key for whichever provider you choose — Anthropic, OpenAI, Google Gemini, NVIDIA NIM or OpenRouter — and calls it directly from your WordPress installation. Your prompts, your source material and the generated text do not pass through our servers, are not stored by us, and cannot be read by us. In that exchange the AI provider is your processor under your agreement with them, not our sub-processor.
We therefore cannot produce your generated content in response to a data request, because we do not have it.
Sub-processors
Current as of the date above. We will update this list before adding a new one.
| Processor | Purpose | Data reaching them |
|---|---|---|
| Cloudflare | CDN, DNS and edge protection | IP address, request metadata |
| Mailjet | Transactional email | Email address, name, message content |
| Stripe | Card payments | Name, email, billing country, payment details |
| PayPal | PayPal payments | Name, email, payment details |
| CCAvenue | Payments in INR | Name, email, billing details |
| Tawk.to | Live chat on our website | Anything you type into chat, IP address |
| Google (Analytics) | Website analytics | Truncated IP address, pages viewed, device and referrer |
| Google (reCAPTCHA) | Spam protection on the contact form | IP address and interaction signals, at the moment of submission |
The AI providers are deliberately absent: under the bring-your-own-key model whichever one you configure is your processor, not ours.
International transfers
Several processors above are outside India and the EEA. Transfers rely on the standard contractual clauses in each provider's own data-processing terms.
The transfer basis and this agreement's status as a DPA under Indian DPDP and EU GDPR need review by a qualified lawyer. This page states what the system actually does; it is not a substitute for a reviewed agreement.
Retention
Invoices and order records are retained as long as tax law requires and cannot be deleted on request — an issued invoice is immutable by design. Account and licence records are retained while the account exists. Licence API request logs are retained for operational and abuse-detection purposes and then rolled into anonymous daily aggregates.
Your rights
You can export your account data or request erasure from your dashboard under Profile. Erasure is handled as a request rather than executed instantly, because records tied to a tax invoice cannot lawfully be removed.
Breach notification
If personal data we hold is compromised we will notify affected customers and the relevant authority within the period the applicable law requires.
OwnWebServers LTD
Rockaway, NJ, USA
Data enquiries: [email protected]