This policy explains what East End Web Dev does with personal data collected through eastendweb.dev and licenses.eastendweb.dev. It applies to visitors to those sites, people who contact us, and people who buy a licence or subscription.
Effective 02/09/2026. Last updated 02/09/2026.
1 Who we are
Cameron McDougall, a sole trader based in the United Kingdom and trading as East End Web Dev, is the controller of the personal data described in this policy.
For anything to do with your data, including any of the requests in clause 11, email cam@eastendweb.dev. That address reaches us directly and is the fastest way to get an answer.
2 What this policy covers
This policy covers both of our websites:
- eastendweb.dev – our main site, where we publish documentation and where you can contact us.
- licenses.eastendweb.dev – where licences and subscriptions for our plugins are bought and managed.
It does not cover our plugins once they are installed on your own website. When eew Subscriptions runs on your site, it processes your customers’ data on your server, under your control and through your own payment accounts. You are the controller for that data, not us. The one exception is licence validation, which is described in clause 8.
3 Personal data we collect
We collect very little, and most of it you give us directly:
- Your email address, when you buy a licence or subscription. This is the only field on our checkout. If you pay through PayPal or a Stripe account under a different address, we also receive that address, because it is where the licence key is sent.
- Your name, email address and message, if you use the contact form on eastendweb.dev.
- Your licence details – the key we issued you, the plan it belongs to, and the websites it has been activated on.
- Payment records received from Stripe or PayPal. We never see or hold your card details.
- Technical and usage data collected automatically when you visit: IP address, browser and device type, pages viewed and the site you arrived from.
We do not collect any special category data, and we never ask for it.
4 How we use it, and our lawful basis
| Purpose | Data used | |
|---|---|---|
| (a) Selling and delivering a licence or subscription | Your email address, the plan you bought, payment status and history, the licence key issued to you | Performance of a contract, UK GDPR Art. 6(1)(b) |
| (b) Managing an active licence | The website addresses your key is activated on, activation dates and counts, the IP address of the server making each check | Contract, Art. 6(1)(b), and our legitimate interest in preventing misuse of licence keys, Art. 6(1)(f) |
| (c) Support | Whatever you tell us, plus your licence and purchase history so we can find your account | Contract, Art. 6(1)(b) |
| (d) Accounting and tax | Transaction records and the email address attached to them | Legal obligation, Art. 6(1)(c) |
| (e) Replying to messages sent through our contact form | Your name, email address and message, plus the time it was sent and the IP address it came from. These are emailed to us and also saved in our website database so that nothing is lost | Our legitimate interest in answering enquiries, Art. 6(1)(f), and where the enquiry leads to a purchase, Art. 6(1)(b) |
| (f) Understanding how the sites are used | Pages viewed, referring site, approximate location, device and browser type, broken links and load times | Legitimate interests, Art. 6(1)(f) |
| (g) Keeping the sites secure and working | Server logs containing IP address, browser user agent, requested page and timestamp | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests we have considered whether our interest is overridden by your rights, and we have limited what we collect accordingly. You can object to any of it – see clause 11.
5 Payments
Payments are handled by Stripe and PayPal. When you buy a licence you enter your email address on our site, and your card or account details go directly to Stripe or PayPal. Those details never pass through or get stored on our servers. We receive confirmation of the payment, the email address associated with it, and the transaction reference.
Stripe and PayPal are separate controllers for the data you give them. Their own privacy notices are at stripe.com/privacy and paypal.com.
Stripe sets cookies on our checkout pages to detect fraud. These are necessary for the payment to work safely and cannot be switched off if you want to buy something.
6 Cookies and analytics
We do not use advertising or tracking cookies, and we do not run Google Analytics or any similar service. This is everything our sites do:
Our own analytics. Both sites use Independent Analytics, which runs on our own server and sets no cookies at all. It records the page you visited, where you arrived from, your device and browser type, and an approximate location derived from your IP address. We use it to see how many people visit, which pages are slow, and which links are broken. Nothing is stored on your device and nothing is shared with anyone else.
Payment cookies. Stripe sets two cookies (__stripe_mid and __stripe_sid) to detect fraudulent payments. On pages where you can buy a licence these are necessary for the payment to work safely, so they cannot be switched off if you want to buy something. Where Stripe loads on a page with no payment form, we ask your permission first through our cookie notice, and you can decline without losing anything.
Essential cookies. WordPress sets cookies when you log in to an account on our sites and to protect forms against cross-site request forgery. These are strictly necessary and are not used for tracking.
Fonts and other files. Everything our pages load – including our typefaces – is served from our own domain. Your browser is not asked to contact any third party in order to display our sites.
Google Search Console. We use Search Console to see how our pages perform in Google search. It reports aggregated figures from Google’s own index, adds nothing to our pages, sets no cookies and does not identify individual visitors.
7 Who we share data with
We do not sell personal data, and we do not share it for anyone else’s marketing. We use the following service providers, who process data on our instructions:
- Kualo – website hosting and email, United Kingdom. Every message we send you, including receipts, licence keys and replies to enquiries, is sent from Kualo’s own mail servers. We do not use a third-party email delivery service.
- Stripe and PayPal – payment processing.
- Google – search performance reporting only, through Search Console. Google receives no data about you from our sites.
- Our accountant, for tax and bookkeeping.
We will also disclose data where the law requires it, or to establish or defend a legal claim.
8 Licence validation
When you install one of our plugins on your website using a licence key, that installation contacts licenses.eastendweb.dev to check the key is valid. The check sends us the licence key, the address of the website it is installed on, and the IP address of the server making the request. We use this to confirm the key is genuine, to count how many sites a licence is being used on, and to identify keys being shared beyond their terms. We do not receive any data about your website’s visitors or customers through this check.
9 Transfers outside the UK
Our hosting, our website files and our analytics are all in the United Kingdom. The only personal data that leaves the UK is what goes to Stripe and PayPal when you make a payment, which they process in the United States and elsewhere. For those transfers we rely on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.
10 How long we keep things
| Record | Kept for |
|---|---|
| Licence and subscription records | For as long as the licence is active, then 12 months |
| Payment and transaction records | 6 years from the end of the tax year, as HMRC requires |
| Licence validation logs | 90 days |
| Contact form messages | 24 months from the date you sent them |
| Our own analytics | 14 months, on a rolling basis |
| Server and security logs | Up to 90 days |
11 Your rights
Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you; to have it corrected if it is wrong; to have it deleted; to have our use of it restricted; to receive it in a portable format; and to object to us using it where we rely on legitimate interests. Where we ask for your consent, as we do for cookies on pages with no payment form, you can withdraw it at any time and that does not affect anything we did before you withdrew it.
To exercise any of these, email cam@eastendweb.dev. We will respond within one month. There is no charge. Some data we must keep regardless – tax records in particular – and we will tell you if that applies.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first so we can put it right.
12 Security
Our sites are served over HTTPS. Access to the systems holding personal data is restricted and protected by strong, unique credentials and two-factor authentication where available. We do not store card details at any point.
13 Children
Our sites and products are aimed at people running websites professionally. They are not directed at children, and we do not knowingly collect data from anyone under 18.
14 Automated decisions
We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects. Licence validation is an automated check against your own licence record, not a decision about you.
15 Changes
If we change this policy we will update the date at the top. Where a change materially affects how we use your data, we will tell licence holders by email.