Privacy & Cookie Policy
Effective date: September 12, 2026
On this page: Privacy Policy · Cookies and your choices. See also our Terms and Conditions and Refund Policy.
Privacy Policy
1. Controller and contact
Depicter International Integrated Services SPC, operating under the Averta brand, controls the personal data used to provide the Phlox website, account, license, update, support and marketing services.
Registered address: Bousher, Muscat Governorate, P.O. Box 132, Postal Code 121, Sultanate of Oman. Privacy contact: [email protected].
Paddle separately acts as merchant of record for a Direct transaction and processes payment and transaction data under its own buyer terms and privacy notice.
2. Data we process
Depending on how you use Phlox, we process:
- identity and contact data, such as name and email address;
- account and authentication data;
- transaction and entitlement data received from Paddle, such as customer, order, product, price, tax, payment status, refund status and transaction reference;
- license, download and update data, such as plan, entitlement status, WordPress site URL or hostname, activation status and timestamps, software version and request/security logs;
- support data, such as messages, chat content, attachments, diagnostic details and support eligibility;
- marketing data, such as newsletter subscription, preferences and message engagement;
- website and analytics data, such as pages viewed, session activity, approximate location, device, browser, referrer and cookie identifiers;
- records of privacy requests, consent choices, fraud prevention, security incidents and legal compliance.
We do not receive or store full payment-card details from Paddle checkout.
3. Sources
We receive data directly from you, from your browser or WordPress installation when it uses our services, from Paddle for the transaction, and from the service providers listed below. We may also generate records when we provide support, administer an entitlement or protect our systems.
4. Purposes and legal bases
We use personal data to:
- create and secure accounts, deliver the ZIP, issue and manage entitlements, provide updates and perform the purchase-related service;
- provide support and keep a support history;
- process refunds and respond to transaction questions with Paddle;
- operate, secure, diagnose and improve the website and services;
- meet accounting, tax, legal and regulatory duties and handle legal claims;
- send product, account, license and service messages;
- send newsletters, product news, discounts and similar marketing when you have requested them or another lawful basis applies;
- measure website use with Google Analytics where the required consent or other legal basis is in place.
The applicable legal bases may include performance of a contract, compliance with a legal obligation, our legitimate interests in operating and protecting the service, and consent. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
5. Service providers and recipients
| Recipient/system | Role and purpose | Data involved |
|---|---|---|
| Paddle | Merchant of record; checkout, payment, tax, receipt, refund and financial transaction email | Customer and transaction data; Paddle handles payment credentials under its own notice |
| Hetzner, Germany | Hosting infrastructure | Account, entitlement, service and server data stored or processed on the Phlox systems hosted there |
| Cloudflare | Public edge, content delivery, availability and security; Network Error Logging may send request/error metadata | IP address, request headers, URL, device/network and security data |
| Help Scout | Support CRM, contact form, live chat/Beacon and support history | Name, email, device identifier, messages, attachments, support/account/license context |
| MailerLite | Newsletter and promotional-email management | Name if provided, email, subscription status, preferences and engagement |
| Google Analytics | Website measurement | Cookie identifiers, page/session activity, approximate location, device and browser data |
| Averta-operated account, licensing, download and update systems | Product delivery and entitlement administration | Account, plan, transaction reference, site hostname/URL, activation, download, update and security data |
| Professional advisers and authorities | Legal, tax, audit, dispute and regulatory matters where necessary | The limited records relevant to the matter |
Paddle sends payment, receipt, refund and other financial transaction emails. Averta sends product, account, license and other service messages through its systems and contracted communications infrastructure. MailerLite is not used for these transactional service messages.
6. International processing
The primary Phlox server is hosted in Germany. Paddle, Cloudflare, Help Scout, MailerLite, Google and their subprocessors may process data in the European Economic Area, the United States and other countries described in their current notices. Where required, we use applicable contractual safeguards or another lawful transfer mechanism and assess the transfer in light of applicable law.
7. Retention
| Data | Retention rule |
|---|---|
| Account and lifetime entitlement | For as long as the account or entitlement is active; after closure or revocation, limited core records may be kept for up to three years for recovery, fraud prevention and claims |
| Transaction, refund, tax and accounting records | For the period required by applicable commercial, tax and accounting law and Paddle’s transaction obligations |
| Active site/activation record | While the activation is active; deactivation and transfer history for up to three years for entitlement enforcement, support and dispute handling |
| Routine server, access, licensing and update logs | Up to 90 days, unless an entry is required longer for an active security investigation, fraud review or legal claim |
| Support conversations | Three years from the last interaction, unless a longer period is required for a legal claim or legal obligation |
| Marketing subscription | Until unsubscribe or withdrawal; a minimal suppression record may be retained as needed to honour the opt-out |
| Google Analytics event data | 2 months in the current GA4 property setting |
| Google Analytics user data | 14 months in the current GA4 property setting; the period resets on new activity |
| Cookie-choice record | Up to three years from the recorded choice, or until replaced where a shorter period applies |
| Privacy-request record | For the time needed to complete the request and up to three years afterward to show compliance and manage related claims |
We delete or anonymise data when the applicable period ends unless a legal hold or longer mandatory period applies.
8. Cookies and similar technologies
We use necessary browser storage to operate the website and, after the required choice, optional technologies for analytics, marketing and support functionality. The Cookie Policy describes the current audited names and the controls that are available.
The current GA4 property has event retention set to two months and user retention set to 14 months. Google Signals and user-provided data collection are off, and no Google Ads account is linked. Ads personalization is enabled at property level even though no Google Ads account is linked. We use Google Analytics for website measurement.
9. Marketing
MailerLite is used only for newsletters, product news, discounts and similar promotions. Marketing consent is separate from the purchase and is not preselected. You may unsubscribe through the link in a marketing email or contact [email protected]. Withdrawing marketing consent does not stop necessary purchase, account, security, license or support messages.
10. Your rights
Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent and information about processing. You may also have the right to complain to a competent data-protection authority.
Send a request to [email protected]. We may ask for information reasonably necessary to verify identity and protect the account. If we cannot fulfil a request in full, we will explain the applicable reason unless the law prevents us from doing so.
11. Children and automated decisions
Phlox is intended for people able to enter a business or consumer software transaction and is not directed to children under 16. We do not knowingly use children’s data for marketing.
We do not make a solely automated decision that produces legal or similarly significant effects for a customer. Automated fraud or security signals may temporarily delay delivery or trigger human review.
12. Security, changes and contact
We use organisational and technical measures designed to protect personal data, including access control, transport encryption, service monitoring and limited staff access according to role. No system can guarantee absolute security.
We may update this policy when our services, providers or legal duties change. We will publish the version and effective date and provide appropriate notice of a material change.
For questions or privacy requests, email [email protected].
Cookie Policy
Cookies and similar storage help operate the Phlox website and provide optional analytics, marketing and support features. Necessary storage may operate without consent where the law permits. Optional technologies are loaded only after the applicable choice, and you can change that choice through the permanent Cookie Settings link.
Cookies and browser storage
| Category | Technology | Purpose | Duration |
|---|---|---|---|
| Analytics — optional | _ga on .phlox.pro |
Distinguishes visitors for Google Analytics | Google default: 2 years; observed Chrome expiry: approximately 400 days because browser limits apply |
| Analytics — optional | _ga_7QDYVM4PST on .phlox.pro |
Maintains GA4 session state for the Phlox measurement ID | Google default: 2 years; observed Chrome expiry: approximately 400 days because browser limits apply |
| Support functionality — optional until requested | persist:hs-beacon-7954be8c-f44c-49ee-9348-a9e8776f86cd in local storage |
Help Scout Beacon device and support-history state | Until cleared or deleted by the application; local storage has no automatic expiry |
| Support functionality — optional until requested | persist:hs-beacon-message-7954be8c-f44c-49ee-9348-a9e8776f86cd in local storage |
Help Scout Beacon message state | Until cleared or deleted by the application |
| Support functionality — session | persist:hs-beacon-session-7954be8c-f44c-49ee-9348-a9e8776f86cd in session storage |
Help Scout Beacon session | Browser-tab session |
| Necessary | wpEmojiSettingsSupports in session storage |
WordPress browser feature detection | Browser-tab session |
We use MailerLite for newsletter and promotional signup features. Its optional marketing scripts and associated requests are controlled by your marketing preference. Storage behavior may vary by campaign and interaction.
Cloudflare may use security technologies when needed to detect malicious traffic or respond to a security challenge.
Choices
- Accept optional cookies enables the optional categories selected by the visitor.
- Reject optional cookies keeps optional analytics, marketing and support storage disabled.
- Manage preferences permits category-level choices.
- Cookie Settings remains available after the first choice so consent can be withdrawn as easily as it was given.
