Privacy Policy

Last updated: 28 October 2026

This policy covers the omniswp.com website and the online services we run for our WordPress software (licence checks, updates, the vulnerability data feed and the Eventward Stripe connection service). Our software is self-hosted: what your Siteward dashboard records about the sites you manage stays on your server. Section 4 lists exactly what the software does send, and to whom.

1. Who we are

OmnisWP is the trading name of Jason Climo, a sole trader based in New Zealand. We are responsible (the “controller”) for the personal information described in this policy. For any privacy question or request, email privacy@omniswp.com.

2. Information you give us

• Forms and email. If you use our contact or “Suggest a feature” form, or email us, we receive what you send, such as your name, email address and message.
• Product emails. If you tick the box to receive Siteward product updates (on a form or before buying), we send your name and email address to our mailing list provider. You get an email asking you to confirm, and you are only added once you do. To be able to show you agreed, we keep a record of your consent: your email address, name, the form it came from, the wording you agreed to, the time and your IP address. MailerLite keeps the time and IP address of your sign-up and confirmation with your subscription.
• Purchases. Lemon Squeezy sells our plans as Merchant of Record and handles your payment details; we never see your full card details. We receive order details such as your name, email address, country, what you bought and your licence key.

3. Information collected when you visit

• Analytics, with your consent. If you choose “Accept” on our cookie banner, we use Google Analytics 4 to understand how the site is used: pages viewed, approximate location (city level), device, browser and how you arrived. Google Analytics does not load until you accept. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. See our Cookie Policy.
• Purchase measurement. When an order is placed, our site tells Google Analytics that a purchase happened: the order number, product and amount. It is linked to your visit only if you accepted analytics cookies; otherwise it is recorded without any link to you. It contains no name or email address.
• Server logs. Our web server records each request: IP address, time, address requested and browser or software details. We use these logs for security and to keep the site and services running, and they are deleted after 7 days.

4. Our software and your data

Siteward runs on your own server, and what it records about your sites stays there. These are the only times our software contacts us or a third party. When WordPress software makes a web request, it normally identifies itself with the web address of the site making the request, so the recipient can see that address and the server’s IP address.

• Vulnerability feed (Siteward, free). Your dashboard downloads our vulnerability list about twice a day, or when you press “Refresh & rescan”. The request carries no information about the sites you manage or the software on them: checking for vulnerabilities happens on your server. We see the dashboard’s address and IP address, as above.
• Licence checks and updates (Siteward Pro and add-ons). Your dashboard checks its licence and looks for updates, sending your licence key, the dashboard’s web address and the plugin version. Licence keys are checked with Lemon Squeezy.
• Updates for Siteward Advanced Child. Each site running it checks with us for updates, sending its plugin version; we see the site’s address and IP address.
• Domain expiry checks (Siteward Pro). Your dashboard looks up the domain names of your sites in public registration data through rdap.org.
• Google Analytics in reports (Siteward Reports). If you connect Google Analytics, your dashboard reads traffic figures from Google using credentials you provide. They go directly between your server and Google.
• AI assistants (Siteward MCP). If you connect an AI assistant, it reads information through your dashboard and sends it to the AI provider you chose, under your agreement with that provider. When you connect ChatGPT or Claude, your dashboard fetches their published app details from their websites. None of this comes to us.
• Eventward and Stripe. When a website running Eventward connects its Stripe account, our connection service briefly handles the Stripe account ID and access tokens so they can be passed to that website. They are held encrypted for no more than 10 minutes, used once, and not kept. Payments never pass through us.
• WordPress itself contacts WordPress.org and the makers of your other plugins to check for updates, as it always does. That is outside our control.

If you manage websites for clients, you decide how their data is handled and you remain responsible for it. We do not receive it or process it on your behalf.

5. How we use information, and our legal bases

Under the UK and EU GDPR we need a legal basis for each use:

• Providing what you bought (licences, updates, downloads, support): performance of a contract.
• Replying to you, and running and securing the site and services (including server logs and preventing misuse of licence keys): our legitimate interests in running a reliable, secure business.
• Analytics cookies and product emails: your consent, which you can withdraw at any time.
• Purchase measurement without cookies: our legitimate interest in knowing which pages lead to sales, using no names or contact details.
• Keeping consent and order records, and meeting tax and legal requirements: legal obligation, and our legitimate interest in being able to show we acted lawfully.

We don’t sell your personal information, share it for cross-context behavioural advertising, or make decisions about you by purely automated means.

6. Who we share it with

We share personal information only with providers that help us run the business, and only what they need:

• Our hosting provider, which hosts this site and our services in New Zealand.
• Google (Google Analytics), for website analytics with your consent.
• MailerLite, which sends the product emails you agreed to.
• Lemon Squeezy, which sells our plans and checks licence keys. As Merchant of Record it is responsible for your payment data under its own privacy policy.
• Stripe, for Eventward connections, under its own privacy policy.

We may also disclose information where the law requires it, to protect our rights or others’ safety, or to a business that takes over the software, which would have to keep protecting it as this policy describes.

7. International transfers

We are based in New Zealand, which the European Commission and the UK recognise as providing adequate protection for personal data, and our site and services are hosted here. Some of our providers (such as Google, MailerLite, Lemon Squeezy and Stripe) process information in other countries, including the United States. Where the law requires it, those transfers are protected by safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, and we take reasonable steps to make sure the information is protected to a standard comparable to New Zealand’s Privacy Act 2020.

8. How long we keep it

• Server logs: 7 days.
• Analytics data: 14 months in Google Analytics.
• Enquiries and form submissions: up to 2 years after our last contact with you.
• Mailing list: MailerLite keeps your subscription, with its consent details, until you unsubscribe, then keeps your address on a suppression list so you are not emailed again. Our own copy of your consent record is deleted 2 years after you gave it.
• Orders and licences: for as long as your licence is active, then 7 years to meet New Zealand tax record-keeping rules.
• Stripe connection data: no more than 10 minutes.

9. Your rights

Wherever you live, you can ask us for a copy of the personal information we hold about you and ask us to correct it. Depending on where you live, you may also have the right to ask us to delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent at any time (this doesn’t affect anything we did before). If you are in California or another US state with a privacy law, you can ask what we collect and to delete it, and we will not treat you differently for doing so.

To make a request, email privacy@omniswp.com. We may need to confirm who you are. We will reply within 20 working days, or within one month where the GDPR applies, and tell you if we need longer.

If you are unhappy with how we handled your information, please tell us first. You can also complain to a privacy regulator: in New Zealand the Office of the Privacy Commissioner (privacy.org.nz), in Australia the OAIC (oaic.gov.au), in the UK the ICO (ico.org.uk), or in the EU your local data protection authority.

10. Security

We protect information with measures appropriate to it, including encrypted connections, restricted access, keeping secrets out of the website’s public folders, and encryption of Stripe tokens. No system is perfectly secure. If a breach of your personal information is likely to cause you serious harm, we will tell you and the relevant regulator as the law requires.

11. Children

Our website, software and services are for businesses and are not directed at children under 16. We don’t knowingly collect their information.

12. Changes to this policy

We will update this policy when what we do changes. If a change significantly affects how we use your information, we will make it clear on this page, and tell customers and subscribers by email, before it applies.

13. Contact

Jason Climo, trading as OmnisWP · New Zealand · privacy@omniswp.com