Privacy Policy
Last updated: 17 August 2026
1. Who we are
This website is operated by SecondGate (“we,” “us,” “our”), based in the United Kingdom. Our website address is https://secondgatewp.com. For the purposes of UK GDPR and the EU GDPR, SecondGate acts as the data controller for personal information collected through this website. This policy applies to this website and, separately, to the SecondGate WordPress plugin, as explained in Section 5.
2. What we collect, why, and our legal basis for processing
Comments
When you leave a comment, we collect the data shown in the comment form, your IP address, and your browser user agent string, to help detect spam. Legal basis: our legitimate interest in maintaining a functional, spam-free site.
An anonymised hash of your email address may be shared with the Gravatar service to check whether you have an account there. Gravatar’s own privacy policy governs that processing: automattic.com/privacy. If your comment is approved and you have a Gravatar-linked profile picture, that picture becomes publicly visible alongside your comment.
Contact forms and enquiries
If you contact us, we collect whatever you provide, name, email address, and your message, to respond to you. Legal basis: it’s necessary to take steps at your request before entering into a contract, or our legitimate interest in responding to enquiries.
Account data
If you register an account, we store the information in your profile. You can view, edit, or delete it at any time, except your username. We can also view and edit this data where necessary for support, billing, or security. Legal basis: performance of a contract with you.
Payment and billing data
Payments are processed by Stripe and PayPal. We do not store your full card details ourselves, that’s handled entirely by Stripe’s or PayPal’s own systems, governed by their own privacy policies (stripe.com/privacy, paypal.com/uk/webapps/mpp/ua/privacy-full). We retain records of the transaction itself (amount, date, product purchased) for accounting and legal obligations. Legal basis: performance of a contract, and our legal obligation to keep financial records.
Hosting and email
This site is hosted with IONOS, and email sent from this site (including password resets and any correspondence) is delivered through IONOS’s email infrastructure. IONOS’s own privacy policy governs their processing of this data as our hosting provider: ionos.co.uk/terms-gtc/privacy-policy.
Server logs
Our server automatically logs visitor IP addresses, browser type, pages visited, and timestamps, standard technical data used for security monitoring and diagnosing faults. Legal basis: legitimate interest in keeping the site secure and operational.
Media
If you upload images, avoid ones containing embedded location data (EXIF GPS). Anyone can extract that data from an image once it’s published on the site. We are not responsible for metadata you choose to include in uploaded files.
3. Cookies
If you comment, you may opt in to saving your name, email, and website in a cookie for convenience on future comments. These last one year.
Visiting our login page sets a temporary cookie to check whether your browser accepts cookies. It contains no personal data and is discarded when you close your browser.
Logging in sets cookies to keep you signed in and remember your display preferences. Login cookies last two days (two weeks with “Remember Me”); screen option cookies last a year. Logging out removes login cookies.
Editing or publishing content sets an additional cookie containing only the post ID, no personal data, expiring after one day.
You can control or delete cookies through your browser settings at any time. Doing so may affect how parts of the site function. This site also uses a cookie consent banner to manage non-essential cookies, including analytics, as described below.
3a. Analytics
We use Google Analytics and Google Search Console to understand how visitors use this site and how it appears in Google search results. Google Analytics sets cookies on your device and collects data about your visit, pages viewed, time on site, general location, and similar. This data is processed by Google in line with their privacy policy: policies.google.com/privacy. Google Search Console does not set cookies on visitors or collect personal data about them directly, it shows us aggregated data about how the site performs in Google’s search results.
Google Analytics is not strictly necessary for the site to function, so we ask for your consent, via our cookie banner, before it’s activated. You can withdraw that consent at any time through your cookie preferences.
4. Embedded content
Where a page embeds content from another website (a video, image, or article), that content behaves as if you had visited the other site directly. That site may collect data about you, set its own cookies, and track your interaction with the embedded content, including if you are logged into an account there. We are not responsible for the privacy practices of third-party sites whose content is embedded here.
5. The SecondGate plugin: how it’s different
If you install the SecondGate WordPress plugin on your own website, it does not transmit your visitors’ personal data to us. Country blocking, threat-intelligence matching, canary-trap detection, and vulnerability scanning are performed locally, on your own server, checked against publicly available data sources (WordPress.org’s own checksums, independently maintained IP reputation lists, and similar public data). We do not operate a central server that receives telemetry, usage data, or visitor data from installations of the plugin, and we have no visibility into how the plugin is used on any individual site.
If you use the plugin’s optional features that connect to third-party services you choose to configure yourself, for example, a webhook to your own Slack or Discord, that connection and any data sent through it is governed by your own configuration and the third party’s own terms, not by us.
6. Who we share data with
Payment details are shared with Stripe and PayPal solely to process your transaction.
Hosting and email delivery are handled by IONOS.
Analytics data is shared with Google, via Google Analytics and Google Search Console, as described above.
If you request a password reset, your IP address is included in the reset email as a standard anti-abuse measure.
Comments may be checked through an automated spam-detection service.
We do not sell personal data, to anyone, for any purpose. We do not share personal data with third parties for their own independent marketing purposes.
We may disclose personal data where required by law, to comply with a legal obligation, court order, or governmental request, or where necessary to protect our rights, property, or safety, or that of our users or the public.
7. International data transfers
We are based in the United Kingdom. If you access this site or use our services from outside the UK, your data may be processed in the UK. Where our third-party processors (Stripe, PayPal, IONOS, Google) are located outside the UK or EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement, an EU Commission adequacy decision, or Standard Contractual Clauses, as applicable, to ensure your data continues to receive an appropriate level of protection.
8. How long we keep your data
Comments and their metadata are kept indefinitely, so genuine follow-up comments can be recognised automatically rather than held for repeated moderation.
Account data is kept for as long as your account exists, plus a reasonable period afterward to comply with legal, tax, or security obligations.
Enquiry data is kept only as long as needed to resolve your enquiry, then deleted or anonymised.
Transaction and billing records are retained for the period required by applicable tax and accounting law.
9. Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected individuals and, where legally required, the relevant supervisory authority, without undue delay and in line with our legal obligations.
10. Your rights
If you’re in the UK or EU (UK GDPR / EU GDPR):
You have the right to access the personal data we hold about you, correct inaccuracies, request erasure, restrict or object to certain processing, request data portability, and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at info@secondgatewp.com. If you’re unsatisfied with our response, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local EU data protection authority.
If you’re in California (CCPA/CPRA):
You have the right to know what personal information we’ve collected, request its deletion, correct inaccurate information, and opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under California law. Exercising these rights will never result in discriminatory treatment.
If you’re elsewhere:
The same core rights, access, correction, deletion, and objection, apply regardless of your location, and we will honour requests in line with applicable local law.
We will respond to verified rights requests within the timeframe required by applicable law, and may ask you to verify your identity before acting on a request, to protect against fraudulent requests made on your behalf.
11. Do Not Track
Some browsers offer a “Do Not Track” signal. There is currently no industry standard for how sites should respond to it, and this site does not currently alter its behaviour based on that signal.
12. Children’s privacy
This site is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
13. Limitation of liability
This website and the information on it are provided on an “as is” basis. While we take reasonable care to keep information accurate and the site secure, we make no warranty that the site will be uninterrupted, error-free, or completely secure. To the maximum extent permitted by law, we are not liable for any indirect, incidental, or consequential loss arising from your use of this site. Nothing in this policy limits liability where such limitation would be unlawful, including liability for fraud or for death or personal injury caused by our negligence.
14. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top will always reflect the most current version. Material changes will be indicated clearly on this page.
15. Governing law
This policy is governed by the laws of England and Wales. Any dispute arising from it will be subject to the exclusive jurisdiction of the courts of England and Wales, without prejudice to your right, as a consumer, to bring proceedings in your own country of residence where applicable law provides for that.
16. Severability
If any provision of this policy is found to be unenforceable or invalid under applicable law, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will continue in full force and effect.
17. Contact us
For anything relating to this policy, your data, or to exercise any of the rights described above:
Email: info@secondgatewp.com