Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning website and our content. Processing takes place on the basis of the applicable legal provisions, in particular Art. 6 GDPR. This website is deliberately designed to be data-minimal. We use Google Analytics to measure reach (see section 7) and, to measure the success of our advertising, Google Ads with conversion tracking and remarketing (see section 8), both exclusively with your prior consent given through our cookie banner. Without your consent, neither analytics nor advertising cookies are set and no data is transmitted to Google.

3. Hosting and server log files

Our website is hosted by an external service provider: Hostinger International Ltd., 61 Lordou Vironos Str., 6023 Larnaca, Cyprus. A data processing agreement pursuant to Art. 28 GDPR is in place with this provider.

Each time the website is accessed, the server automatically records information transmitted by your browser and stores it in what are known as server log files. These are usually:

• shortened or anonymised IP address
• date and time of access
• page or file requested
• volume of data transferred and notification of successful retrieval
• browser type and operating system used
• referrer URL (the previously visited page)

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and the security of our website. Log files are deleted after 14 days unless security-relevant events require longer retention.

4. Contacting us

If you contact us by email or telephone, your details are stored in order to process your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters, and otherwise our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR. We delete this data as soon as the enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion.

5. Cookies and local storage

Technically necessary storage: we store your cookie decision and any language selection in your browser's local storage. This information is required to operate the site and to apply your choice (Art. 6(1)(f) GDPR and Section 25(2) TDDDG, the German Digital Services Data Protection Act) and is not passed on to third parties.

Cookies requiring consent: Google Analytics cookies for reach measurement (see section 7) and Google Ads cookies for conversion tracking and remarketing (see section 8) are only set after you have selected “Accept” in the cookie banner. Without your consent these cookies are not set. You can withdraw your consent at any time via the “Cookie settings” link in the footer.

6. Fonts (locally hosted)

This website does not use any external font services. All fonts used are delivered locally from our own server. No connection is made to third-party servers (for example Google Fonts) and no data is transferred to such services.

7. Web analytics with Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps us understand how visitors use the website so that we can improve it.

Consent as the legal basis. Google Analytics is loaded and activated exclusively after you have actively given your consent via our cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG (formerly TTDSG). Before you give consent, no analytics cookies are set and no scripts or data are loaded from or transmitted to Google.

Withdrawal. You can withdraw your consent at any time with effect for the future by clicking “Cookie settings” at the bottom of the page and selecting “Decline”.

Data processed. Google Analytics sets cookies and processes, among other things, a shortened IP address (IP anonymisation is enabled), device and browser information, pages visited, time spent on the site, and an approximate location that cannot be traced back to you as a person. Pseudonymous usage statistics are created from this.

Data transfer to the USA. When Google Analytics is used, data may be transferred to Google LLC in the USA. The legal basis for the transfer is your explicit consent (Art. 49(1)(a) GDPR); in addition, Google relies on EU standard contractual clauses and is certified under the EU-US Data Privacy Framework. The USA does not offer a level of data protection fully comparable to European law, and access by US authorities cannot be ruled out.

Retention period and opt-out. User-related data is deleted automatically after the retention period configured in Google Analytics (by default a maximum of 14 months). You can also prevent collection using Google's browser add-on: tools.google.com/dlpage/gaoptout. Further information on data protection at Google: policies.google.com/privacy.

8. Google Ads: conversion tracking and remarketing

We advertise our WordPress plugins via Google Ads, an advertising programme provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For this purpose, the Google tag with the identifier AW-999310176 is embedded on this website.

Consent as the legal basis. Like Google Analytics, the Google Ads tag is loaded exclusively after you have actively given your consent via our cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Before you give consent, no advertising cookies are set and no scripts or data are loaded from or transmitted to Google. You can withdraw your consent at any time via the “Cookie settings” link in the footer.

Conversion tracking. If you reach this website via one of our Google ads, Google sets a cookie that expires after 30 days. If you then click a download link to WordPress.org, the tag reports this event to Google. This tells us how many users reached a plugin download via an ad. We receive aggregated statistics only and cannot identify individual users.

Remarketing. Using the Google tag, we assign visitors of certain product pages to an audience list (retention period 90 days). We can use this list to show you our plugin ads again on websites and in services operated by Google or by Google advertising partners. Here too we do not process plain data but work with pseudonymous identifiers; the lists contain no information that is personal to us.

Data processed. In particular, cookie identifiers or the Google Click Identifier (GCLID), pages visited and events triggered, device and browser information, and an approximate location are processed. We use Google's Consent Mode v2, so that Google is informed of the status of your consent.

Data transfer to the USA. With Google Ads, too, data may be transferred to Google LLC in the USA. The legal basis is your explicit consent (Art. 49(1)(a) GDPR); in addition, Google relies on EU standard contractual clauses and is certified under the EU-US Data Privacy Framework. The USA does not offer a level of data protection fully comparable to European law, and access by US authorities cannot be ruled out.

Objection and settings. Independently of our cookie banner, you can deactivate personalised advertising in your Google ad settings: adssettings.google.com. Further information on data protection at Google: policies.google.com/privacy and policies.google.com/technologies/ads.

9. Freemius (purchase of Pro licences and affiliate programme)

Our paid Pro versions are sold through the reseller Freemius, Inc., based in the USA (“Freemius”). When you click a purchase link on this website, you leave our site and are taken to the Freemius checkout (checkout.freemius.com). Only there do you enter order and payment details; Freemius processes these as an independent controller, and the purchase contract is concluded with Freemius. Our website itself sets no Freemius cookies and transmits no personal data to Freemius.

Our affiliate programme is also handled technically through the Freemius affiliate platform. The attribution of referrals to partners (cookie lifetime 30 days), the administration of partner accounts and the payout of commissions are carried out by Freemius; applications to the programme reach us by email and are forwarded by us to Freemius manually. Further information can be found in the Freemius privacy policy: freemius.com/privacy.

10. Your rights as a data subject

Under the GDPR you have in particular the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to withdraw consent already given (Art. 7(3) GDPR)

An informal message to moin@hafenstudios.com is enough to exercise your rights.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

12. Data security (SSL/TLS encryption)

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

13. Postal mail to businesses (direct marketing)

We occasionally send individually prepared postal mail to businesses. In doing so we process the company name, business address and the name of the management, which we take from publicly accessible sources (the imprint of the company website, the commercial register). The legal basis is our legitimate interest in direct marketing in business dealings (Art. 6(1)(f) GDPR, recital 47). The data is used solely for the respective mailing, is not sold to third parties and is deleted at the latest six months after the mailing has been completed; our mailing service provider receives it exclusively in order to produce and deliver the item. You can object to this processing at any time (Art. 21 GDPR): a short message to moin@hafenstudios.com is enough, we will add the address permanently to our suppression list and you will receive no further mail from us. Your remaining rights are set out in section 10.

14. Status of this policy

This privacy policy is dated August 2026. Further development of the website or changes in legal requirements may make it necessary to adapt this policy.

15. Language versions

This privacy policy is also available in English, French, Spanish, Italian, Dutch and Portuguese. The translations are provided for your convenience; the German version is the authoritative and legally binding one.

← Back to the homepage