Privacy Policy
Last updated: 2 November 2026
DashWP is a service for managing WordPress websites. This policy explains what personal data we process, why, and the rights you have. If anything is unclear, contact us at [email protected].
1. Who we are
The DashWP service ("DashWP", "we", "us") is operated by Reducto Ltd, registered in Bulgaria, company number (UIC) 208651488, VAT No. BG208651488, registered address 6, Osma St., Malina 9559, Dobrich, Bulgaria. We are the data controller for the personal data described below.
Contact for privacy matters: [email protected].
2. What data we collect
- Waitlist - if you join the early-access waitlist, we collect the email address you submit.
- Account data - for registered users: name, email address and a securely hashed password.
- Managed-site data - the URLs and technical metadata of the WordPress sites you connect (versions, plugins, themes, update and security status), and a separate connection secret for each site, which is stored encrypted.
- Data from connected WordPress sites - once you connect a site with the DashWP Beacon plugin, the site sends DashWP, in answer to signed requests from your dashboard: its WordPress users (login name, display name, email address, roles), its activity log (logins, including failed ones, and content, plugin, theme and settings changes - each with the user, email address, IP address and browser of who made it) and, only while error monitoring is turned on for that site, PHP errors and the end of the WordPress debug.log. Nothing is sent before the site is connected or after it is disconnected.
- Website backups - when you turn on backups or start one, the site's files and a database dump are uploaded directly from the site to our storage (Cloudflare R2, EU). The DashWP connection secrets are never included in a backup.
- Technical data - IP address, browser type and server logs, collected to run and secure the service.
- Cookies - a strictly necessary session cookie to keep you signed in. See section 9.
For the data that comes from the sites you connect (their users, the IP addresses in their activity logs, error logs and backups), you are the data controller and DashWP processes it on your behalf, only to provide the service to you.
3. Why we process it (legal bases)
- To provide the service - performance of a contract with you (Art. 6(1)(b) GDPR).
- Security, fraud prevention and product improvement - our legitimate interests (Art. 6(1)(f) GDPR).
- Waitlist and product updates - your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Legal obligations - where we must keep records (Art. 6(1)(c) GDPR).
4. Who we share it with
We do not sell your data. We use a small number of trusted providers (sub-processors) that process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting | EU (Germany) |
| Cloudflare, Inc. | DNS and network, encrypted backups of DashWP, storage for website backups (R2), PDF reports | EU (storage) |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery | USA |
| Stripe Payments Europe, Ltd. | Payments and invoicing | EU (Ireland) |
We may also disclose data where required by law.
Google user data (Google Analytics)
When you connect a Google account, DashWP requests read-only access to your Google Analytics (the analytics.readonly scope) solely to show your website traffic statistics inside DashWP and in the reports you generate. DashWP's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising, and do not share it with third parties except as needed to provide the service to you. You can disconnect the Google account at any time from Settings.
Google user data (Gmail)
You can connect a Gmail account so that the emails DashWP sends on your behalf - the reports and notifications for your clients - go out from your own Gmail address. For this, DashWP requests only the gmail.send scope ("Send email on your behalf"), together with your Google account's email address (the openid and email scopes) to show which account is connected.
- What we access: permission to send email only. DashWP cannot read, search, list, modify or delete any message, label, contact or setting in your mailbox, and it never does.
- What we store: the Gmail address you connected and the access token Google issues for it, stored encrypted (AES-256-GCM). We do not store the emails we send: they are composed in DashWP and handed to Gmail, which keeps a copy in your Sent folder as it does for any email you send.
- How we use it: only to send the emails you set up in DashWP (client reports, client notifications and test emails you request), in the order of email accounts you choose under Integrations.
- Disconnecting: you can disconnect Gmail at any time under Settings → Integrations; DashWP then deletes the stored token and revokes the access at Google. You can also remove DashWP from your Google account at myaccount.google.com/permissions.
DashWP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use this data only to provide the email sending you ask for; we do not transfer it to third parties except as necessary to provide this feature, to comply with applicable law, or as part of a merger or acquisition with notice to you; we do not use it for advertising, including retargeting or personalised ads; we do not sell it; no person at DashWP reads it unless you give us explicit permission (for example, in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law; and we do not use Google Workspace API data to develop, improve or train generalised artificial intelligence or machine-learning models.
5. International transfers
We aim to keep data within the EU/EEA. Where a provider processes data outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Waitlist emails - until we launch and you either sign up or ask to be removed, and no longer than 24 months.
- Account and managed-site data - for as long as your account is active, then deleted or anonymised within a reasonable period after closure.
- Backups - encrypted backups are rotated and expire on a rolling schedule (up to a few months).
- Website backups - for the retention you set in the backup settings in DashWP (manual backups: 30 days); deleted from storage when they expire or when you delete them. "Safe updates" snapshots are deleted after a few days, or as soon as the update is confirmed healthy.
7. How we protect it
Credentials and connection tokens are encrypted (AES-256-GCM). Every request between DashWP and a connected site is signed with that site's own secret (HMAC-SHA256) and checked for freshness, so it can not be forged or replayed. Access is restricted, connections use TLS, and data is backed up in encrypted form. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, and to data portability. To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg).
9. Cookies
We use only strictly necessary cookies required to sign you in and keep your session secure. We do not use advertising cookies. If we later add analytics, we will ask for your consent first.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date above shows the latest version, and material changes will be communicated where appropriate.
11. Contact
Questions about this policy or your data: [email protected].