Privacy Policy
Last updated: 25 Aug 2026
1. Who We Are
This Privacy Policy explains how WPXFacets collects, uses, shares, retains, and protects personal data in connection with the WPXFacets website, customer accounts, subscriptions, support, managed cloud service, and optional Search Analytics feature.
WPXFacets is a commercial brand operated by:
- Legal entity: SC WEBIXKIT SOLUTIONS S.R.L.
- VAT ID: RO45267408
- Trade Registry: J13/3824/17.11.2021
- Registered address: Str. Arțarului, nr. 25, Camera nr. 4, Sat Siminoc, Oraș Murfatlar, Județul Constanța, Romania
- Website: www.wpxfacets.com
- Privacy contact: support@wpxfacets.com
- Billing contact: billing@wpxfacets.com
2. Our Data Protection Roles
WPXFacets acts as a data controller when it determines why and how personal data is processed for its own purposes, including:
- operating the WPXFacets website;
- managing accounts and subscriptions;
- processing orders, invoices, and payments;
- providing customer support;
- protecting accounts and infrastructure;
- preventing fraud and abuse;
- complying with accounting, tax, and other legal obligations.
For Customer Data processed inside a customer’s dedicated managed service, the customer ordinarily acts as the data controller and WPXFacets ordinarily acts as a data processor.
This includes catalog data and optional Search Analytics data that WPXFacets processes only to provide, secure, support, retain, and delete the customer’s managed service in accordance with documented instructions and the applicable Data Processing Agreement.
Infrastructure providers such as Hetzner may act as subprocessors for this processing. The current list, processing activities, locations, and change history are available on our Subprocessors page.
The final role allocation depends on the actual processing activity and applicable law, not only on the labels used in this Policy or a contract.
3. Personal Data We Collect
3.1 Website visitors
When you visit our website, we or our service providers may process:
- IP address and approximate location;
- browser, device, and operating-system information;
- pages visited and interactions with the website;
- referrer information;
- cookie preferences;
- technical, security, and server-log information.
Where Google Analytics is enabled, analytics cookies and related data are processed only after the required consent has been provided through our cookie controls.
Analytics information is not necessarily anonymous at the moment it is collected. Depending on the service configuration, it may include online identifiers and technical information before it is aggregated or otherwise minimized.
3.2 Contact and support enquiries
When you contact us, request information, or receive support, we may process:
- your name;
- company and job-related information;
- email address and other contact details;
- the content of your request and our response;
- technical information you choose to provide for troubleshooting.
Please do not send passwords, secret API keys, private keys, full payment-card details, or unnecessary personal data through support messages.
3.3 Customers and account representatives
When a business creates an account, starts a trial, places an order, or purchases a subscription, we may process:
- the legal company name;
- the name and contact details of the company representative;
- billing address and country;
- VAT ID or other business tax or registration identifier;
- account login and access information;
- orders, subscriptions, renewals, cancellations, and account history;
- invoices, credit notes, and related fiscal records;
- payment status, transaction references, refunds, and chargebacks;
- communications relating to the account or service.
Payment-card information is collected and processed by Stripe. WPXFacets does not store full payment-card numbers or card security codes. We may receive limited transaction information needed to manage the order, subscription, invoice, refund, fraud review, or customer support.
3.4 Managed service and plugin connection data
When a customer connects a WordPress installation to the managed Cloud Service, we may process information necessary to authorize, provision, operate, and secure that service, including:
- the customer account and subscription identifier;
- website URL and installation identifier;
- selected environment or index slot;
- API credentials and their status;
- plan and capacity information;
- managed server identifiers, region, provisioning status, and service health;
- authorization, synchronization, and operational status information;
- security and diagnostic information required to operate or protect the service.
The plugin does not send generalized or advertising telemetry about the customer’s store to the WPXFacets website. It does send the requests and metadata required to authenticate, provision, operate, monitor, support, and enforce the limits of the managed service.
3.5 Customer Data in the managed service
The customer’s dedicated managed service may process data submitted from its WordPress or WooCommerce installation, including:
- product or catalog content;
- taxonomies, attributes, prices, inventory information, and search-related fields;
- supported configuration required for indexing and search;
- optional Search Analytics data where the feature has been enabled.
This Customer Data is processed on the customer’s dedicated managed node. It is separate from the account, billing, and control-plane data stored on the WPXFacets website.
4. Why We Process Personal Data
| Purpose | Typical legal basis |
|---|---|
| Creating accounts, providing trials, subscriptions, managed infrastructure, and support | Performance of a contract or steps requested before entering into a contract — Article 6(1)(b) GDPR |
| Processing invoices, credit notes, tax information, and legally required records | Compliance with a legal obligation — Article 6(1)(c) GDPR |
| Protecting accounts, preventing fraud and abuse, securing infrastructure, and handling legal claims | Legitimate interests — Article 6(1)(f) GDPR |
| Responding to business enquiries and improving customer support | Contractual necessity or legitimate interests, depending on the context |
| Non-essential website analytics and similar cookies | Consent — Article 6(1)(a) GDPR |
| Processing Customer Data inside the managed service | The customer determines the applicable lawful basis as controller; WPXFacets processes the data under the customer’s documented instructions and the applicable data processing agreement |
Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against the rights and reasonable expectations of affected individuals.
5. Optional Search Analytics
Search Analytics is an optional merchant feature. It is disabled by default and can be enabled only by an authorized administrator for the Main managed environment after the applicable DPA has been accepted. DPA acceptance does not enable collection. Secondary environments cannot enable collection or perform analytics lifecycle actions; a secondary environment assigned to the same subscription and managed server may read the bounded Main report where supported.
If enabled, Search Analytics processes eligible, deliberate, first-page storefront search terms and result-count information as daily, language-specific aggregates.
The stored information may include:
- readable normalized and display search text;
- a query hash used as an aggregation key;
- UTC calendar day and language;
- search and zero-result counters;
- aggregate result-count values;
- the analytics schema version.
The query hash is an aggregation key and does not make the readable search terms anonymous.
Search Analytics does not store a visitor, customer account, session, cookie, or IP identifier with an analytics record.
Search terms are free text and may contain names, addresses, health information, account information, or other personal data. The feature rejects common sensitive patterns, but these filters cannot identify every form of personal or sensitive information.
Accepted Search Analytics aggregates are retained for up to 90 UTC calendar days. An authorized merchant administrator may stop collection or delete the complete Search Analytics dataset sooner.
Disabling Search Analytics stops new collection but does not automatically delete retained data. Deleting retained data is a separate confirmed action.
Disconnecting the website, removing credentials, deactivating a licence, cancelling a subscription, or uninstalling the plugin does not by itself send an immediate remote deletion request. Retained data instead follows the applicable 90-day retention or managed-service deletion process.
Search terms are processed on the customer’s dedicated managed node. They are not sent to the WPXFacets WordPress control plane.
WPXFacets does not sell Search Analytics data, use it for advertising, share it with another customer, add it to a shared search corpus, or use one customer’s search terms to improve another customer’s service.
Search Analytics is a best-effort merchandising and search-quality signal. It is not an audited visitor, traffic, or billing measurement system and it does not automatically modify search relevance.
The merchant is responsible for determining the lawful basis for enabling the feature, updating its shopper-facing privacy information, controlling report access, and responding to affected individuals. Enabling the feature in WPXFacets is not, by itself, visitor consent.
6. Service Providers and Other Recipients
We disclose personal data only where necessary for the purposes described in this Policy, to comply with law, or when you direct us to do so.
| Provider or recipient | Purpose | More information |
|---|---|---|
| Hetzner Online GmbH | Website hosting and managed infrastructure hosting | Hetzner Privacy Policy |
| Stripe | Payment processing, recurring payments, fraud prevention, refunds, and payment-related support | Stripe Privacy Policy |
| Website analytics where enabled with consent | Google Privacy Policy | |
| Email and communications providers | Transactional messages, account notices, support, and service communications | The applicable provider may be disclosed on request |
| Accountants, legal advisers, and professional consultants | Accounting, tax, legal compliance, claims, and professional advice | Only where reasonably necessary and subject to applicable confidentiality obligations |
| Public authorities | Compliance with valid legal obligations, court orders, or regulatory requests | Only where required or permitted by applicable law |
WPXFacets does not sell personal data.
We may also disclose data in connection with a merger, reorganization, financing, acquisition, or transfer of all or part of the business, subject to appropriate confidentiality and data-protection requirements.
7. Data Storage and International Transfers
The WPXFacets website and account system currently use infrastructure located in Germany within the European Union.
Customer-dedicated managed Elasticsearch infrastructure under the current service is provisioned only in the European Union: Nuremberg or Falkenstein in Germany, or Helsinki in Finland, according to the location selected for the subscription.
The selected EU location is documented during onboarding and in the applicable Data Processing Agreement. Current providers and processing locations are listed on the Subprocessors page.
The current DPA package does not authorize a non-EEA managed location. If WPXFacets offers one in the future, it will require separate advance disclosure, an applicable Chapter V transfer mechanism, and any required transfer assessment and supplementary measures before processing begins.
Some service providers, including payment and analytics providers, may also process personal data outside the European Economic Area. Customers should review the privacy information of the relevant provider for details about its processing locations, roles, and transfer safeguards.
8. How Long We Keep Data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, or to satisfy legal, accounting, security, and dispute-resolution requirements.
| Data category | Retention approach |
|---|---|
| Account and subscription data | During the customer relationship and generally for up to 3 years afterward where needed for contractual records, support, or legal claims, unless a longer legal obligation applies |
| Invoices, credit notes, payment, and fiscal records | For the period required by applicable Romanian accounting, tax, and fiscal law |
| Support and business communications | For as long as necessary to handle the request and afterward where needed for service history, security, or legal claims |
| Active API credentials and connection records | While required to provide and secure the service; credentials may be revoked when entitlement ends, while deletion follows the controlled account and managed-service lifecycle |
| Provisioning and operational metadata | While the managed service is active and afterward only as needed for offboarding, security, support, accounting, or legal obligations |
| Catalog and index data on the managed node | While the service is active and during controlled offboarding until the managed environment is permanently destroyed |
| Search Analytics aggregates | Up to 90 UTC calendar days, or earlier if the complete dataset is deleted through the available confirmed action |
| DPA version and acceptance records | For the subscription term and generally for up to 3 years afterward as contract evidence, unless a longer period is required for legal claims or compliance. Representative identifiers may be deleted or anonymized when no longer needed, while the evidentiary core may be retained where legally necessary. |
| Website analytics | According to the configured analytics retention period and the choices described through our cookie controls |
| Technical and security logs | For a limited period necessary for security, troubleshooting, abuse prevention, or incident investigation |
When a subscription is pending cancellation, managed-service access normally remains available until the paid period ends.
After entitlement ends, managed-service authorization may be rejected and the VPS may be powered off. Permanent destruction of the managed environment is a separate controlled operation.
WPXFacets does not currently provide managed Elasticsearch snapshots or index backups. Destroying the VPS removes the managed product and Search Analytics indexes stored on that node.
Destroying the managed environment does not delete invoices, payment records, tax records, support history, or other information retained for separate legal or operational purposes.
9. Data Security
We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.
Depending on the service component, these measures may include:
- TLS-encrypted connections;
- dedicated managed infrastructure;
- restricted administrative and service access;
- credential and authorization controls;
- exact environment and index authorization;
- capacity and request restrictions;
- monitoring, maintenance, and security updates;
- data minimization and bounded retention.
Managed service traffic is protected in transit with TLS. Data on the dedicated managed server is not encrypted at rest, and WPXFacets does not currently provide managed Elasticsearch snapshots or index backups. No method of transmission or storage is completely secure. We cannot guarantee absolute security.
10. Your Data Protection Rights
Subject to the conditions and exceptions provided by applicable law, you may have the right to:
- Access personal data we hold about you;
- Correct inaccurate or incomplete personal data;
- Request deletion of personal data where no legal reason requires continued retention;
- Restrict processing in certain circumstances;
- Object to processing based on legitimate interests;
- Receive portable data where the right to data portability applies;
- Withdraw consent at any time for future consent-based processing;
- Lodge a complaint with a competent data protection authority.
To exercise a right concerning data for which WPXFacets is controller, contact support@wpxfacets.com.
We may need to verify your identity and clarify your request. We normally respond within one month, although applicable law may permit an extension for complex or multiple requests.
You may also lodge a complaint with the Romanian supervisory authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
www.dataprotection.ro
You may alternatively contact the competent supervisory authority in your country of residence, work, or the place of the alleged infringement.
11. Requests Concerning a Customer’s Storefront Data
If your request concerns data collected through a store that uses WPXFacets, you should normally contact that store first. The merchant ordinarily acts as controller and decides how the storefront data is used.
WPXFacets will assist the merchant under the applicable data processing agreement using the data and technical capabilities actually available.
Search Analytics deliberately stores no visitor identifier. WPXFacets and the merchant may therefore be unable to prove that an analytics aggregate relates to a particular person.
The current deletion capability applies to the complete Search Analytics dataset, not reliably to one visitor or one individual query. Where deletion is legally required and an individual record cannot be reliably isolated, deleting the complete dataset may be necessary.
12. Cookies
We use essential cookies required for website functionality, security, accounts, checkout, and preference management.
Non-essential analytics or similar cookies are used only where permitted and after the required consent has been obtained.
You can review or change your preferences through our cookie controls. For additional information, see our Cookie Policy (EU).
Withdrawing consent does not affect the lawfulness of processing performed before consent was withdrawn.
13. Children
The WPXFacets Cloud Service is offered only to business customers and is not directed to children.
If you believe that a child has provided personal data directly to WPXFacets without appropriate authorization, contact us so that we can assess and address the situation.
14. Changes to This Policy
We may update this Privacy Policy when our services, processing activities, service providers, or legal obligations change.
The revised policy will display a new “Last updated” date. Where required or reasonably appropriate, we will provide additional notice through the website, customer account, or email.
15. Contact
For questions about this Privacy Policy or our processing of personal data, contact:
SC WEBIXKIT SOLUTIONS S.R.L.
Str. Arțarului, nr. 25, Camera nr. 4
Sat Siminoc, Oraș Murfatlar, Județul Constanța
Romania
Email: support@wpxfacets.com
