Legal
Privacy policy
Last updated 19 October 2026
Joinery ("we", "us") sells WordPress plugins and runs the store, customer accounts and update service behind them. This policy explains what personal data we collect, why, and what rights you have. It applies to visitors of this website, customers, and stores that run our paid plugins.
Joinery is a partner brand owned and operated by HFB Global, Friesestraatweg 16, 9718 NG Groningen, Netherlands (KVK 82762201), which is the data controller for the personal data described here.
What we collect
When you buy a licence: your name, email address, billing address, VAT number if you give one, and what you bought. Payment is handled by Link, a Stripe company that sells our licences as the merchant of record: we never see or store your card or bank details, only that a payment succeeded, the amount and currency. Link processes your payment details under its own privacy policy.
When you sign in: your email address. We sign you in with a one-time link sent to that address, so we don’t store a password.
When a store uses a paid Joinery plugin: once you enter a licence key in WordPress, the plugin contacts our update service when it checks for updates and when you activate or deactivate the key. Each request sends the licence key, the site address, the WordPress environment type (production, staging, development or local), the WordPress and PHP versions, and which Joinery plugins and versions are installed. We use this to count your sites, offer updates and help with support. It doesn’t include your store’s customers, orders or products.
Joinery Core (our free plugin on WordPress.org) and the data it stores in your WordPress database, such as pricing rules and store-credit balances, stay on your site. Joinery Core doesn’t send us any data.
Support: what you send us when you ask for help, such as your email, your message and any screenshots or system details you include.
Technical data: standard server logs (IP address, browser, pages requested, timestamps), kept for security and to fix problems.
How we use it
To sell and renew licences, deliver plugin downloads and updates, count activated sites, send sign-in and account emails, answer support requests, prevent fraud and abuse, and meet our accounting and tax obligations. We don’t sell personal data and don’t use it for advertising.
Legal basis
Mostly performance of a contract: we need these details to provide the licence you bought. We keep invoices and payment records because the law requires it (Dutch tax law). Server logs and fraud prevention rely on our legitimate interest in keeping the service secure. If we ever ask for something optional, such as a newsletter, we’ll rely on your consent, and you can withdraw it at any time.
Who we share data with
We share data only with the companies that run parts of the service for us:
- Stripe and Link: checkout, payments, subscriptions, invoices, tax and the billing portal.
- Supabase: our database and sign-in, including the sign-in emails, hosted in the EU.
- Vercel: hosts this website and the update service.
- Fontshare (Indian Type Foundry): serves the typeface this website uses, so your browser sends it your IP address when a page loads.
If you buy through the WooCommerce Marketplace instead of this website, WooCommerce handles that purchase under its own privacy policy.
International transfers
We keep our database in the EU. Some of the providers above are based outside the EU or transfer data there to run their service. Where data leaves the EU, we rely on the safeguards those providers offer, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
Invoices and payment records are kept for seven years, as Dutch tax law requires. Account and licence data is kept while you have an account and for two years after your last licence ends, in case you come back. Site activations are kept until you deactivate the site or your account is deleted. Server logs are deleted after 30 days.
Cookies
We use only essential cookies: one set keeps you signed in to your account, and Stripe sets its own while you pay, for security and fraud prevention. We don’t use analytics, advertising or tracking cookies.
Your rights
You can ask to access, correct, delete or export your personal data, and to object to or restrict how we use it. Email us from the address on your account and we’ll reply within one month. You can change your email address and delete your account yourself under Profile in your account. A deletion takes effect 14 days after you ask, so you can change your mind; renewals stop straight away. Deleting your account removes your licence keys, sites and support messages and ends your licences’ access to updates and support. Invoices we must keep by law (seven years under Dutch tax law) are kept with our payment provider, but no longer linked to an account.
If you’re unhappy with how we handle your data, you can complain to the Dutch Autoriteit Persoonsgegevens or the data protection authority where you live.
Changes to this policy
We’ll update this page when how we handle data changes, and change the date at the top. For significant changes, we’ll also email customers.
Contact us
Questions about this policy or your data: hello@joinerywp.com. See also our terms & conditions.