This summary is here to help. The full policy below is what applies.
- We collect little. Only what we need to run rootwright.com, sell licences and support you.
- Your students’ data stays with you. The plugin stores it in your own WordPress database. RootWright never receives it.
- We don’t sell data. We share it only with the service providers that help us run RootWright.
- You’re in control. Ask to see, correct, export or delete your data at [privacy email].
Who we are and what this covers
This privacy policy explains how [Company legal name] (“RootWright”, “we”, “us”) collects, uses and protects personal data when you visit rootwright.com, sign up for our newsletter or beta waitlist, buy a licence, or contact us for support.
[Company legal name] is the controller of that data. Our registered address is [Company address].
The RootWright LMS plugin works differently. When you install it on your own WordPress site, the data it handles stays on your site and you are in charge of it. Section 3 explains how.
Information we collect
Forms on our website
When you sign up for the newsletter, join the beta waitlist or send us a message through the contact form, we collect what you enter:
- First and last name
- Email address
- Your website URL, if you give it
- Your message, for the contact form
Purchases
When you buy a Pro licence, our payment processor handles checkout and collects your payment details directly. We receive your name, email address, billing country, the plan you bought and the status of the payment. We never see or store full card numbers.
Licence checks
When RootWright LMS Pro checks for updates or validates its licence, your site sends us its site URL and licence key. We use them to confirm the licence is active and to deliver updates. These checks do not include data about your students or users.
Support conversations
When you email us or open a support request, we keep the conversation and anything you choose to share with it, such as screenshots, logs or system information.
Analytics and cookies
We use [Analytics provider] to understand how people use rootwright.com, for example which pages are visited and how visitors find us. We also use a few cookies the site needs to work. Section 4 has the details.
Your students’ data stays on your site
RootWright does not receive your students’ data.
The RootWright LMS plugin runs on your WordPress site. It stores student data, such as accounts, enrollments, progress, quiz attempts and reviews, in dedicated tables in your own WordPress database, on your server. None of it is sent to us.
For that data, you, the site owner, are the controller. You decide what to collect, how long to keep it and how to respond to your students’ requests. Your own privacy policy should tell your students about it.
Some features connect your site to other services, but only if you turn them on. Examples are Stripe, Paddle or Lemon Squeezy for payments and Telegram for review reminders. When you enable one, your site sends the data that service needs directly to it, under your control and that service’s own terms. It does not pass through RootWright.
The plugin sends email through WordPress’s wp_mail() function, so messages go out through your site’s own mail setup or SMTP plugin, not through our servers.
Cookies and analytics
Cookies are small files a website stores in your browser. We use two kinds:
- Necessary cookies. They keep the website and checkout working, for example by remembering your session. The site can’t work properly without them.
- Analytics cookies. Set by [Analytics provider] to measure how pages are used, in aggregate. Where the law requires it, we only set them after you agree.
You can block or delete cookies in your browser settings. If you block necessary cookies, parts of the site, such as checkout, may stop working.
How we use your information
- To send the newsletter and beta updates you asked for. Every email has an unsubscribe link.
- To process purchases, issue licence keys and send receipts.
- To check licences and deliver plugin updates.
- To answer your messages and provide support.
- To understand how our website is used and improve our products.
- To keep our services secure and prevent fraud and abuse.
- To meet our legal, tax and accounting obligations.
We do not sell your personal data. We do not use it to make automated decisions that have legal or similarly significant effects on you.
Legal bases for processing
Where laws such as the EU or UK GDPR apply, we rely on these legal bases:
- Consent. For the newsletter, the beta waitlist and analytics cookies where consent is required. You can withdraw it at any time.
- Contract. To process purchases and provide the licences, updates and support you have paid for.
- Legitimate interests. To answer contact messages, keep our services secure and improve our website, always weighed against your rights.
- Legal obligation. To keep invoices and transaction records as tax law requires.
Sharing and service providers
We share personal data only with service providers that help us run RootWright, and only what each one needs:
- Payment processor. Checkout, billing, tax and fraud checks for purchases.
- Amazon SES (Amazon Web Services). Delivers our transactional email, such as receipts, licence keys and account messages.
- [Analytics provider]. Website analytics.
- Hosting and infrastructure providers. Store our website, licence and support data on our behalf.
These providers may only process data on our instructions. We may also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of our business. If that happens, we will tell you.
International transfers
RootWright and our service providers may process data in countries other than the one you live in, and those countries may have different data protection laws. Where the law requires it, we put appropriate safeguards in place, such as standard contractual clauses. You can ask for details of these safeguards at [privacy email].
How long we keep data
We keep personal data only as long as we need it for the purposes above:
- Newsletter and beta waitlist. Until you unsubscribe or ask us to delete it.
- Contact and support conversations. For [Retention period] after the conversation ends.
- Purchase and invoice records. For as long as tax and accounting law requires.
- Licence records. While your licence is active, and for a reasonable period after it ends so we can help if you come back.
- Analytics data. For the period set in our [Analytics provider] settings.
When we no longer need data, we delete it or make it anonymous.
Your rights
Depending on where you live, you have the right to:
- Access. Get a copy of the personal data we hold about you.
- Correction. Fix data that is wrong or incomplete.
- Deletion. Ask us to erase your data.
- Objection. Object to, or ask us to restrict, how we use your data.
- Portability. Receive your data in a structured, machine-readable format.
- Withdrawing consent. At any time, without affecting what we did before.
How to exercise your rights
Email [privacy email] from the address you used with us and tell us what you would like. We may need to confirm your identity first. We will reply within the time the law requires and will not charge you for reasonable requests.
If you are a student on a website that uses RootWright LMS, please contact that website’s owner. They hold your data, and we cannot access it.
You also have the right to complain to your local data protection authority.
Children
Our website and products are meant for site owners and businesses. They are not directed at children, and we do not knowingly collect personal data from children under [Minimum age]. If you believe a child has given us personal data, contact [privacy email] and we will delete it.
If your own school teaches children, you are responsible for any consent the law requires before their data is stored on your site.
Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections, access controls and keeping our systems up to date. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
Changes to this policy
We may update this policy as our products and the law change. When we do, we will change the “Last updated” date at the top of this page. If a change is significant, we will tell you by email or with a notice on our website before it takes effect.
Contact us
For questions about this policy or your personal data, contact us:
- Email. [privacy email]
- Post. [Company legal name], [Company address]