Who we are

The shop is run by Digital Pragmatics, a sole trader business, which makes Polecat Blur. Digital Pragmatics decides how your personal information is used, which makes us the “controller” under UK data protection law.

Contact us about anything in this notice, or to use any of your rights, at info@digitalpragmatics.net. Our order emails come from support@digitalpragmatics.net and our forum emails from forum@digitalpragmatics.net, but please write to info@ about your information.

We are a very small business without a data protection officer, so you will be dealing with us directly.

What we collect

Your account. You need an account to buy, because your account is the lasting home of your licence. We keep your email address, your name and billing address from checkout, your password (stored as a one-way scrambled “hash”, not as the password itself), the date you joined, and the date you were last active on the site, so we can tell when an account has fallen out of use. New accounts also get a member name made up at random, such as “member-482913” (see “The forum”). If you tick the optional box to hear about product announcements, we record that you did, when, where, and the wording you agreed to, and the same if you later untick it.

Logging in. When you log in, WordPress keeps a record of that login (your IP address, your browser type, and when the login started and when it expires) so it can keep you logged in safely. The record stops working when you log out or the login expires, and we delete expired records within a day.

Your orders. At checkout we ask for your name, billing address and email address. A phone number and an order note are optional. We also record the IP address and browser type used to place the order, what you bought, the price and how you paid.

Your payment. Card details are typed into secure fields run by Stripe, not into our own pages, so we never see or store the card number or security code. To take the payment, check it for fraud and handle any refund or dispute, our payment service also receives details such as your name, email address, billing address and the amount. We keep a reference to the payment, the card brand, the last four digits and the result of the fraud check. If you tick the box to save your card, the payment service keeps it and we hold only a token that points to it; you can remove a saved card under My Account at any time. If you pay with Apple Pay or Google Pay, Apple or Google handles that part under their own terms.

Fraud prevention on the basket and checkout. When you open the basket or checkout pages, two fraud-prevention services run in your browser as part of our payment service. Stripe’s code collects information about your device and browser to spot fraudulent payments. Stripe’s payment frame also loads an invisible anti-bot check provided by hCaptcha, which receives technical information from your browser and sets a short-lived cookie on hcaptcha.com. Our payment service also uses Sift, a fraud-prevention company, whose code collects your IP address, browser type and other details of your device and browser (including a “fingerprint” made from how your browser draws a hidden image) and sets a cookie that lasts about 13 months. Sift runs on the basket as well as the checkout because a payment can start there: the basket can show Apple Pay and Google Pay buttons. Its cookie lasts that long so that it can recognise a device that has been used for fraud before; Sift sets that period, and we cannot change it. If you are logged in, our payment service also gives Sift the customer reference that Stripe holds for you, and tells Sift when you log in, so Sift can link your device to your account. Sift is responsible for its own use of this information: see Sift’s privacy notice at sift.com/legal-and-compliance/service-privacy-notice.

Your licence. Your Polecat Blur licence code contains the name from your billing details, your order number, a licence number and a short scrambled fingerprint made from your email address, so the licence is tied to you. The code is encoded, not encrypted, so anyone who has the code can read your name in it. Please do not post your licence code publicly. We keep the code with your order so you can see it again under My Account > Licences. If the name associated with your licence is wrong, contact us. We can correct our customer records and will explain what remedy is available for the existing licence. A licence already issued cannot necessarily be renamed or replaced. We also keep a separate record of every licence issued, so that we can confirm a licence is genuine and help with support. That record holds your order number, the licence number, the product and the dates, with a one-way hash of your email address and of the licence code, not the email itself. The order number links the record straight to your order, and anyone who already knows an email address could recreate the hash and match it, so the law treats this as personal information, and so do we.

Your basket. The shop remembers what is in your basket while you shop and, if you are logged in, keeps it with your account until 90 days after you last changed it.

The forum. If you use the forum, we keep what you post, any files you attach, your reactions, poll votes, subscriptions, mentions, which topics you have read, and any reports you make about posts.

Records of the emails we send. The shop keeps a short record of each email it sends you: who it went to, the subject, when it was sent, and whether our server reported a problem sending it. It does not keep the message itself. These records are deleted automatically after 30 days. Our host’s mail server also keeps its own log of the emails our server sends (see “How long we keep it”).

Emails with you. If you write to us, we keep your message, your name and your email address so we can help.

Payment troubleshooting. Our payment software can keep a detailed record of its messages with the payment service. It is switched off, and we switch it on only while we are investigating a payment fault.

Anti-spam check. On the page where you log in or create an account, Cloudflare Turnstile checks that you are a person, not a bot. To do that, Cloudflare looks at your IP address, your browser type and technical details of your connection.

Website logs. Our host, Hostinger, records requests to the site, including your IP address, browser type, the page asked for and the time.

Visitor statistics. We use Cloudflare Web Analytics to count visits, so that we can see how the shop is used and improve it. For each page view it records the address of the page (without anything after a “?” in it), the page that sent you, how quickly the page loaded, and the country, browser, operating system and type of device that Cloudflare works out from your connection. It uses no cookies and stores nothing on your device. Cloudflare sees your IP address when the page loads and uses it to work out your country; Cloudflare says it does not use your IP address or browser details to identify or follow individual visitors, and we see only totals.

You can turn visitor statistics off in your browser here, and back on again. Your choice is remembered in your browser (see “Cookies”). If your browser sends a Global Privacy Control signal, we never collect visitor statistics from it.

We do not ask for sensitive information such as health details, and would rather you did not put any in forum posts, order notes or emails. If it turns up where it is not needed, we may remove it.

Where it comes from

Most of it comes from you: what you type into the shop, the forum and your emails. Some comes automatically from your browser and device when you visit (IP address, browser and device details, the page that sent you). Some comes back to us from Stripe, Apple, Google and the card networks about your payment.

What you must give us, and what is optional

To buy, you must give your name, billing address and email address, and create an account, because that is where your licence is kept. Your phone number, order notes, saving a card, the forum and the product announcements are all optional.

The forum

Anyone on the internet, logged in or not, can see the forum’s topic titles, the recent-activity list, search results, and the forum names of the people who started and last replied to each topic. Search engines can index these, and other people can copy them. Only logged-in members can read the posts themselves, the members list and members’ profiles.

Files attached to posts are listed only to logged-in members, but anyone who has a file’s direct link can open it, even without an account. Please do not attach anything private.

Your forum activity is shown under your forum name. New members start with a forum name made up at random, such as “member-482913”; the automatically assigned forum name does not use their real name or email address. Some members who joined before we introduced random member names in October 2026 may have a forum name or profile web address taken from their name or email address. Any member can change the forum name other people see under My Account > Account details, or ask us to change it. Your profile web address is also the name others use to @mention you. It cannot be changed under My Account: for new members it remains the random member name, and if yours was taken from your name or email address, ask us and we will change it. Your forum profile does not show the first name from your billing details.

You can edit your own posts. If you would like a post of yours taken down, ask us and we will remove it, unless we need to keep it for a short time to deal with misuse or a dispute, in which case we will tell you. If a post is removed here, we cannot remove copies made elsewhere.

What the Polecat Blur plugin sends

The plugin sends nothing to this shop. Licence entry, licence checks and the 14-day trial all happen on your own computer, with no internet connection needed, and the plugin collects no usage data. Its only internet request is the Check For Updates… item in the three-line menu at the far right of the toolbar, which you have to choose yourself. That asks polecatplugins.com, not the shop, whether a new version is out. It sends no account, licence or usage details, though like any request on the internet it reveals your IP address and the type of software asking. Some menu items open a page in your web browser instead; that is an ordinary visit to that website, covered by its own notice. Installer downloads also come from polecatplugins.com, which keeps its own download records; its privacy notice explains those: polecatplugins.com/privacy.

Why we use it, and our legal reasons

UK law asks us to tell you the legal reason (“lawful basis”) for each use.

What we do	Legal reason
Keep your basket while you shop	Steps you ask for before buying
Create and run your account, keep you logged in, take your order and payment, issue and re-show your licence, send order and licence emails	To carry out our contract with you
Save a card for next time, when you tick the box	To carry out our contract with you: it is a service you ask for
Run the forum: publish the posts you write under your forum name, show logged-in members who is a member, send the notifications you subscribe to	Our legitimate interest in running a helpful community for Polecat Plugins users
Check payments for fraud, stop spam sign-ups, keep the licence record so we can confirm a licence is genuine, keep logs and backups to keep the site secure, moderate the forum and deal with misuse	Our legitimate interest in protecting customers, the shop and our products
Keep the shop connected to Automattic, which our payment service needs in order to work	Our legitimate interest in using a reliable payment service
Answer your emails and support questions	Our contract, where it concerns something you bought; otherwise our legitimate interest in helping you
Keep short records of sent emails and, when needed, payment troubleshooting records	Our legitimate interest in making sure orders and licences reach you and payments work
Keep sales and tax records	Because the law requires us to
Count visits with Cloudflare Web Analytics	Our legitimate interest in knowing, in total, how the shop is used, so that we can improve it
Review product feedback, as described below	Our legitimate interest in understanding product feedback
Product announcements, if you ticked the box	Your consent, which you can withdraw at any time, including from the link in each announcement email

Where we rely on legitimate interests, we have weighed them against your privacy. You can ask us for the details, and you can object (see “Your rights”).

Product feedback: To help us review feedback internally, we use a tool that sends the display name or handle, post date and up to 500 characters from replies to our own posts on Instagram and KVR, and from members’ replies in the Product Announcements topics on our forum, to Anthropic’s Claude API. Processing takes place in the United States under Anthropic’s commercial terms, which do not allow this data to be used for model training, and our copy is kept for up to 90 days. This tool is not used for customer questions or support, which we handle ourselves.

Automatic fraud checks. Our payment service, WooPayments, and Stripe, which processes the payments, screen every card payment automatically and may block one that looks risky. They look at things such as the payment and card details you give, whether the card’s security code matches, details of your device, browser and connection, and patterns seen in fraudulent payments. Most of the screening rules are set by WooPayments and Stripe, not by us. Our own setting blocks a payment when the card’s security code does not match. Your card issuer may also decline a payment.

If a payment is blocked, the order is not completed and your card is not charged. We cannot override a block made by WooPayments, Stripe or your bank, but it is still our shop and our responsibility: if a payment of yours is refused, email us at info@digitalpragmatics.net. We will look into it with you, ask our payment service to review it where we can, and help you find another way to pay where one is available. You can also question the decision and ask for a person to look at it. More about how the screening works: woocommerce.com/document/woopayments/fraud-and-disputes/ and stripe.com/gb/privacy.

Who else sees your information

We do not sell your information and we do not share it with advertisers. These are the organisations that receive some of it:

• Hostinger (Hostinger International Ltd), our web host, which stores the shop’s database, files, server logs and backups, runs our email, our content delivery network and domain names, and runs a security scanner on our server. It works on our instructions.
• Stripe, which processes card payments, checks them for fraud and stores saved cards, on our behalf. Stripe also uses payment information for its own fraud-prevention and legal duties, under its own privacy notice.
• Sift (Sift Science, Inc.), the fraud-prevention service described above, which is responsible for its own use of the information it collects.
• Card networks and your card issuer, which handle the payment itself.
• Apple and Google, if you pay with Apple Pay or Google Pay, under their own terms.
• Automattic (the company behind WooCommerce and WordPress.com), which operates WooPayments, the payment service in our shop, together with Stripe, and receives the payment details described above for that purpose. WooPayments also needs the shop to stay connected to Automattic’s servers, and that connection regularly sends copies of each order’s contents, total, payment method and status, and the city, county, postcode and country from the billing address. As set up in the software, it is designed to leave out names, email addresses, phone numbers, street addresses and IP addresses. Automattic handles this on our behalf.
• Cloudflare, which runs the anti-spam check on the login and sign-up page, and the visitor statistics, on our behalf. Cloudflare also uses the anti-spam check’s information to improve its bot detection, under its own terms.
• Anthropic (Claude API), which processes limited extracts from replies to our posts and forum topics in the United States so we can review feedback internally; it is not used for customer support.
• Your own email provider, which receives the emails we send you.

We may also share information when the law requires it, with professional advisers such as an accountant, or to deal with a payment dispute.

Information sent outside the UK

Our host keeps the shop’s website and database on servers in France and our mailboxes in Germany. Both are in the European Economic Area, which UK law recognises as protecting personal information to the UK’s standard.

Stripe, Sift, Automattic and Cloudflare may handle information in the United States and other countries. Stripe and Cloudflare are certified under the UK Extension to the EU–US Data Privacy Framework, and also use standard contractual clauses approved for transfers from the UK. Automattic uses standard contractual arrangements approved by the UK government. Sift says it relies on standard contractual clauses. Anthropic processes the product feedback extracts described above in the United States, under the UK Addendum to the EU standard contractual clauses in its data processing addendum. Apple and Google explain the safeguards they use in their own privacy policies (apple.com/legal/privacy and policies.google.com/privacy). You can ask us for more detail, including a copy of the relevant safeguard.

How long we keep it

Information	How long
Your account, if you have bought something	While your account is open. We never close it just because it has not been used, because it is where you find your licence again. You can ask us to close it at any time; we will send you your licence codes first, and your licences keep working on your computers after the account is closed. We close it within 30 days of your request, keeping only what the rows below need.
An account with no purchase	We review these once a year. If an account has not been used for at least two years, we email you, and close it if you do not reply within 30 days.
Login records	Deleted within a day of the login expiring
Orders, billing and payment records	At least five years after the 31 January tax-return filing deadline for the tax year in which you bought
The licence record	For as long as the licence can be used, since Polecat Blur licences are perpetual and we need to be able to confirm a licence is genuine. If a licence is refunded or cancelled, up to 6 years after that.
Basket for visitors	48 hours
Saved basket for logged-in customers	Deleted 90 days after you last changed it
Forum posts	Until you ask us to remove them, or a moderator does. If you close your account, your posts stay so that discussions still make sense, but they no longer show your forum name; where other members quoted or @mentioned you, your forum name stays in their posts.
Reports about forum posts and other moderation records	Normally deleted once the report and any review of it are finished, and ordinarily within 12 months. We keep them longer only where we need to, for an unresolved dispute, repeated misuse, someone’s safety or a legal claim.
Records of emails the shop sends	30 days
Our host’s mail log	It records who each email went to and the email’s header details. Entries are deleted after 30 days.
Your emails to us	Until the matter is resolved, and then for up to two years after our last exchange. Messages about a purchase, tax, a dispute or a legal claim may be kept for up to six years, or longer where the law requires it.
Payment troubleshooting records	Only while we investigate a fault; each day’s record is deleted automatically after 30 days
Our host’s backups	Daily backups, each deleted automatically after 7 days
Copies we take ourselves before changing the site	Deleted within 30 days
Website logs at Hostinger	Hostinger keeps these under its own operational and security schedule. About seven days of them are visible to us, but Hostinger does not publish or guarantee a fixed period.
Visitor statistics at Cloudflare	Cloudflare keeps the detailed records for 7 days and then only a sample of them; we can see statistics for the past six months
Order copies held by Automattic	For as long as the shop is connected to WooPayments. If we stop using WooPayments, we will ask Automattic to delete them.
Payment records Stripe holds for us	For as long as we use Stripe, and then for the periods the law sets for payment records
Information Stripe, Sift, Apple, Google and the card networks hold for their own purposes	Set by them, by the criteria in their privacy notices (for Sift, for as long as is consistent with its fraud-prevention purpose)

Cookies

Cookies are small files a website stores in your browser. Browser storage is a similar feature that keeps small pieces of information in your browser. We use only the ones the shop, the checkout and the forum need. We do not use cookies for advertising. Stripe and Sift use the fraud-prevention cookies listed below, and Sift uses its cookie to recognise a device over time for fraud prevention.

Name	What it does	How long
wp_woocommerce_session_…	Remembers your basket and checkout	48 hours, or 7 days while you are logged in
woocommerce_items_in_cart, woocommerce_cart_hash	Tell the page your basket is not empty	Until you close your browser
wordpress_logged_in_…, wordpress_sec_…	Keep you logged in	Until you close your browser, or 14 days if you tick “Remember me” or have just created your account at checkout
wordpress_test_cookie	Checks that your browser accepts cookies, on the login page	Until you close your browser
_lscache_vary	Makes sure you see your own page, not someone else’s saved copy	About 2 days
__stripe_mid, __stripe_sid	Set by Stripe on the basket and checkout pages to prevent payment fraud	About 1 year, and 30 minutes
__ssid	Set by Sift on the basket and checkout pages to prevent payment fraud	About 13 months, set by Sift
__cf_bm	Set on .hcaptcha.com when Stripe’s payment frame loads hCaptcha on the basket and checkout. It helps distinguish people from automated traffic as part of Stripe’s fraud-prevention checks	About 30 minutes
asgarosforum_unread_cleared	Set only if you press “mark all as read” in the forum without logging in, so it remembers	12 months
storeApiCartData, storeApiCartHash, storeApiNonce, wc-blocks_dismissed_incompatible_extensions_notices, wcpay_appearance_blocks_checkout (browser storage)	Let the basket and checkout pages show your basket and the payment form correctly	Until cleared by the shop or by you
wp-api-schema-model… (browser storage)	Lets the forum’s editor work	Until you close the browser tab
dp_stats_off (browser storage)	Remembers that you turned visitor statistics off	Until you turn them back on or clear your browser’s storage

Cloudflare Turnstile, the anti-spam check on our login and registration page, sets no cookies on our site. The separate hCaptcha check used inside Stripe’s payment frame sets the third-party cookie listed above on hcaptcha.com. Cloudflare Web Analytics sets no cookies and stores nothing in your browser. Our own statistics switch uses the dp_stats_off browser-storage item listed above solely to remember that you turned visitor statistics off.

We consider each of these strictly necessary: each one is needed to give you something you have asked for (your basket, your login, a secure payment, the forum’s “mark all as read”, or turning statistics off) or to keep payments, sign-up and login safe, so the law does not require us to ask first. We do not use Google Analytics, advertising pixels or social media trackers.

You can delete or block cookies in your browser settings. If you block the ones above, the basket, checkout and login will not work.

Your rights

You have the right to:

• see the personal information we hold about you and get a copy;
• correct it if it is wrong;
• have it deleted, where we no longer need it or have no other legal reason to keep it (we must keep the sales records the law requires, and we will tell you if that affects your request);
• limit how we use it, in some circumstances;
• object to uses based on our legitimate interests;
• take it with you in a common computer format, for information you gave us under our contract or with your consent;
• withdraw your consent at any time, where we rely on it, without affecting what we did before;
• question an automatic decision about you, such as a blocked payment, and ask for a person to look at it.

To use any of these, email info@digitalpragmatics.net. We will reply within one month, and there is normally no charge. We may need to check it is really you before we act.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We will update this notice when what we do changes, and change the date at the top. We will tell account holders by email about significant changes, such as using your information for a new purpose.