Legal

Privacy policy for the All in One WP Settings website and customer portal.

What account data the website and customer portal collect, how it runs your licenses and support, and how it is protected.

Policy overview

All in One WP Settings uses customer account data to operate the website, customer portal, licensing records, downloads, AppSumo redemption, support requests, and payment-provider records. Payment details are handled by configured payment providers, and the portal stores operational records needed for orders, licenses, support, security, and account access.

Account data is used to deliver what you purchased: issuing and validating licenses, serving entitled downloads, tracking direct checkout and payment handoff status, processing AppSumo redemptions, and answering support tickets with the right license context attached.

Payment card details are never stored on this site. Card and billing data are processed by the payment provider selected at checkout, and only the resulting order, payment status, and license records are kept in the customer portal.

Operational records such as orders, licenses, payments, redemptions, security logs, and support history are retained for as long as they are needed to run active licenses and to meet accounting, fraud-prevention, security, and license-enforcement obligations. You can ask about the account data linked to your customer account through the published support or contact path.

Company details

Kenan AFSAR

Address: Altınay Cd. Dolantı Sk. No:21 Siteler, 06360 Ankara, Türkiye
Phone: +905323041421
E-mail: support@allinonewpsettings.com
Tax office: Muhammed Karagüzel V.D.
Tax number: 0081100554

In practice

How your account data is handled day to day

This is what the policy above means for a normal customer account, from the moment you buy to the moment you ask a question about your records.

What is stored

Your account profile, licenses, orders and payment status, AppSumo redemptions, downloads, and support history — the records needed to run what you purchased, and nothing about your WordPress site content.

What never touches this site

Full card numbers and billing details are handled by the payment provider at checkout; only the resulting order and payment status are returned to the portal for your records.

Asking about your data

Send data questions through the published support or contact path so your identity and account can be verified before any record is located, exported, or changed.

Google user data

When you connect a Google account to All in One WP Settings — either to send your site's email through Gmail, or to store backups in Google Drive — the plugin uses Google's OAuth consent flow. We never see or store your Google password. The same applies, word for word, to Easy Connect SMTP Free, our free Gmail sender plugin: it connects through the same service under the same consent, asks only for the send permission, and everything in this section is true of it.

What we access

For email, only the gmail.send scope: permission to submit outgoing messages on your behalf. We do not read, list or modify your messages, and we do not access labels, drafts, threads, settings or contacts. For backups, only the Drive scope (drive.file) needed to write and manage the backup files this plugin creates. We also read your account's email address and basic profile so the plugin can show you which account is connected.

What we store

An encrypted refresh token on our server (and, until it expires, the short-lived access token it produces), the connected account's email address and Google account ID, the scopes you granted, and the time a token was last issued.

How we use it

We use Google user data only to provide the feature you connected: to submit the messages your site sends, or to write and manage the backup files it creates. The content of your email never passes through our servers: messages go directly from your WordPress site to Google. We do not read your mail.

Sharing and disclosure

We do not transfer or disclose your information to third parties for purposes other than the ones provided. Google user data is stored on servers operated for us by IONOS SE in Germany, who act as our processor and do not access it. Data is backed up daily in encrypted form. Beyond that we share it with no one: we do not sell it, we do not use it for advertising or transfer it to data brokers, we do not use it to determine creditworthiness or for lending purposes, and we do not use it to train artificial-intelligence or machine-learning models. We would disclose it only where the law requires it.

How we protect it

We use encryption to protect your information: the refresh token and the access token are stored encrypted at rest (AES-256) and are excluded from every serialisation and every API answer. An access token is issued only to the WordPress site that made the connection, after four checks — the licence key, the site's activation token, the site's domain and the licence's validity — and it expires within an hour. Every connection, between your site and us and between us and Google, is encrypted in transit. Security procedures are in place to protect the confidentiality of your data: administrative access is limited to our own staff accounts, and the administrative screens show which account is connected but never a token.

Limited Use

All in One WP Settings' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

We retain Google user data only for as long as the connection is in use. Your tokens are deleted when you disconnect from the plugin's own screen (we also revoke them at Google); at the next attempt to send or back up after you revoke our access at https://myaccount.google.com/permissions; 30 days after the licence your site runs on has ended or the site's activation has been removed — a lapsed licence can still disconnect at any time; and after 180 days without a token being issued. The connection record — the account's email address and Google account ID, and the scopes — is deleted 90 days after the tokens. When a retention period expires, the data is deleted.

Deletion on request

You may request the deletion of your Google user data at any time by writing to support from the address on your account and naming the site or the connected Google account. We revoke the tokens at Google and delete the connection record within 30 days — usually the same working day — and confirm to you when it is done.

FAQ

Privacy Policy FAQ

The portal keeps the operational records needed to run what you bought: your account profile, licenses, orders and payment status, AppSumo redemptions, downloads, and support history. It does not keep your site content or passwords.

No. The payment provider you choose at checkout handles card and billing details end to end, and the site itself never sees them. What returns to your portal account is limited to the order, its payment state, and the license it unlocked.

Send the request through the published support or contact path so your identity and account can be verified first. That verification makes sure records are located for the right person.

No. Account data is used to run your licenses, downloads, and support, and is shared only with the payment provider needed to complete a purchase. It is never sold or rented to third parties.

Operational records are kept while a license is active and for as long as accounting, security, and fraud-prevention duties require. After that, records are removed when they are no longer needed.