Privacy Policy

This Privacy Policy explains what personal data vanrossum.dev collects, why, and what your rights are. It covers this website and the products sold here (WordPress plugins and other software).

The data controller is Jeffrey van Rossum, a sole trader based in the Netherlands, trading as vanrossum.dev. For any privacy question or request, email [email protected].

The short version

I try to collect as little as possible. This website uses no tracking cookies, which is why there's no cookie banner. Visits are counted with Fathom Analytics, a privacy-first, cookieless service that doesn't collect or store personal data and can't follow you across the web. Beyond that, the only personal data I handle is what you actively send me — a message through the contact form, or an order you place — plus the technical minimum needed to run and secure the site.

What I collect and why

Contact form. When you use the contact form or email me, I receive your name, email address and message. I use this only to reply to you and to keep a record of our correspondence. Legal basis: my legitimate interest in answering enquiries.

Purchases. Payments are handled by Lemon Squeezy, which acts as the Merchant of Record for every order. Lemon Squeezy collects your billing details (name, email, address, payment information and any tax identifiers) directly and is the controller for that data — see the Lemon Squeezy Privacy Policy. I receive from them the order information I need to deliver your product and provide support: typically your name, email address, the product purchased and your licence key. Legal basis: performance of our contract.

Licence checks and updates. When a plugin on your site checks its licence or looks for an update, my server receives the licence key and the URL (instance) of the site it's installed on. This is used to verify the licence and deliver updates, and to enforce the number of sites your licence covers. Legal basis: performance of our contract.

Transactional email. Order confirmations, licence details and support replies are sent through a transactional email provider on my behalf.

Analytics. I use Fathom Analytics to see aggregate, anonymous statistics (page views, referrers, countries). Fathom uses no cookies and stores no personal data or identifiers, so it requires no consent banner. Legal basis: legitimate interest in understanding how the site is used.

Server logs. My hosting and CDN providers keep standard technical logs (for example IP address, browser type and requested URL) for security, abuse prevention and troubleshooting. Legal basis: legitimate interest in keeping the service secure and reliable.

I don't sell your personal data. I share it only with the service providers needed to run the business, acting as processors or, where noted, as independent controllers:

Lemon Squeezy — payment processing, invoicing and tax (Merchant of Record).
My email provider — sending transactional and support email.
My hosting and CDN providers (including Cloudflare) — serving the site and storing product downloads.

Some of these providers are based outside the EU; where that's the case, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

How long I keep it

Contact messages: kept while relevant to our correspondence, then deleted.
Order and licence records: kept as long as needed to support the product and to meet legal and accounting obligations.
Server logs: kept for a short period on a rolling basis.

Your rights

Under the GDPR you can ask to access, correct, delete, or export your personal data, or object to or restrict how it's used. Email [email protected] and I'll handle it. You also have the right to lodge a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

Changes