Privacy Policy

The short version

InvFlux is inventory software that runs inside your own WordPress installation. Almost everything it does happens on your server, and we never see it.

Your product, stock, order and customer data never leaves your site. It is not sent to us, it is not backed up to us, and we have no way to read it.
The plugin contains no analytics and no usage tracking. We cannot see which screens you open, what you click, how many products you have or how often you use anything. There is no crash reporting. Once you register a licence, the daily licence check does report the version of PHP and of the database server your site runs on — so we know which versions are still in use and must keep working. That is the whole of it, and it is listed in the table below.
Out of the box, the plugin never contacts us at all. It stays silent until you deliberately register a free licence, activate a paid licence, or open the Licenses & Add-ons screen.
If you do register, we hold very little: your email address, your site's address, and licence bookkeeping.
We never see your card details. Payments are handled by a payment provider that acts as the seller; card data goes to them, never to us.
This website sets no tracking cookies and loads nothing from third parties — no fonts, no scripts, no embeds, no advertising pixels.

The rest of this page is the precise version.

1. What this policy covers

This policy applies to:

this website, invflux.com;
the InvFlux for WooCommerce plugin and its paid add-ons, insofar as they process personal data;
the InvFlux licensing service at license.invflux.com, which issues and validates licences.

It does not cover your own WooCommerce store. When your customers give you their data, you are the controller of it — InvFlux is simply software you run, in the same way your database or web server is.

2. The plugin: what stays on your server

Everything the plugin exists to do — the stock ledger, purchase orders, receiving, the catalog workbench, dispatch, costing, reporting — happens entirely within your WordPress database.

We want to be exact about this, because it is the part that matters most: your products, stock levels, stock movements, suppliers, purchase orders, orders and customers are never transmitted to us, in whole or in part, in any form. No sampling, no aggregate, no hashed digest. The plugin has no code that reads that data and sends it anywhere.

The plugin also contains no analytics, no usage tracking and no error reporting. A fresh install that you never register makes no outbound network request to us, ever — and once you do register, the only thing that leaves your site on a schedule is the daily licence check described below.

3. What the plugin sends, and when

The plugin can connect to exactly one external service: the InvFlux licensing service at https://license.invflux.com.

Nothing is transmitted until you do one of three things: open InvFlux → Licenses & Add-ons, register a free licence, or activate a paid licence key. Until then, the plugin does not contact the service at all.

When	What is sent
You register a free licence — you type an email address and press Register	Your email address, your site's address, and the plugin version
You activate a paid licence key	The licence key, your site's address, the plugin version, two environment signals (whether `WP_DEBUG` is switched on, and what WordPress reports as the environment type: production, staging, development), and the versions of PHP and of the database server — see the row below
Once a day, after you have registered or activated	The activation's identifier, your site's address, those same two environment signals, and the version of PHP and of the database server your site runs on (for example `8.3.12`, and `mariadb 10.11.15`)
You open the Licenses & Add-ons screen	A request for your account's licences and for the price list. Your shop's base country is sent with the price request

That is the complete list. There is nothing else.

Why the environment signals? So that a staging or development copy of your site does not consume a production licence seat. They are two values — one true/false, one short word. They tell us nothing about your shop.

Why the PHP and database versions? So we know what to keep supporting. InvFlux requires PHP 8.1 and WooCommerce 9.0, and one day those floors will move — dropping a version that a real shop is still running is how an update breaks a working store. The only honest way to know is to count what registered installs actually run. Two things we hold ourselves to: the numbers are counted and never used to decide anything about your licence, your seats or what you can install; and we record the make and version only, so 10.11.15-MariaDB-1:10.11.15+maria~ubu2204 is stored as mariadb 10.11.15 — the rest names your hosting provider's build and is discarded.

Why your shop's base country? So the price list comes back in the right currency and for the right region. It is your shop's configured base country, not a geolocation of you or your visitors.

Stopping it. You can un-register at any time from InvFlux → Licenses & Add-ons. That releases the site's licence and stops the daily check, after which the plugin does not contact the service again unless you register once more. Every inventory feature keeps working exactly as it did before.

4. What the licensing service stores

If you register or activate, the licensing service keeps the following.

About you

Your email address.
Your name, if you have given us one (optional).
An identifier issued by our payment provider, if you have bought a paid plan.

About your licences

The licence key, which plan it is for, its status (active, lapsed, cancelled and so on), its billing cadence, and the relevant dates — when it was issued, what it is paid through, any grace period.
Where a price has been locked in for you, the locked rate.

About your activations

Your site's address.
Whether the activation was classified as production or non-production.
When it was activated, when it was last seen, and when it was deactivated.
The version of PHP and of the database server the site last reported. One value each, overwritten by the next daily check rather than kept as a history.

Records

An append-only log of events on your licence — issued, renewed, cancelled, transferred — which is how we can reconstruct and correct your entitlement if something goes wrong.
The notifications our payment provider sends us about your subscription, stored as received.

We do not build a profile of you, we do not enrich this data from other sources, and none of it is used for advertising or for automated decision-making with legal or similarly significant effects.

5. This website

invflux.com is a static site. There is no database behind it and no code running on the server when you visit — the pages were generated in advance and are served as files.

No analytics. We do not use Google Analytics, or any other analytics or visitor-measurement service.
No third-party resources. The site loads no web fonts, scripts, images, embeds, videos or pixels from any other domain. Opening a page here contacts nobody but this server.
No advertising, no tracking, no cross-site tracking.
Cookies. The site sets one cookie, ifx_preview, and only for us: while the site is in pre-launch it lets the operator unlock a preview of unpublished pages on their own device. Ordinary visitors are never given a cookie. There are no analytics or advertising cookies, so there is nothing here for you to consent to.

Our hosting provider, Infomaniak (Switzerland), keeps standard web-server logs — the requesting IP address, the page requested, the time, the user agent — as every web server does. They are used for security and troubleshooting and are retained under Infomaniak's own policy.

If you email us, we keep the email. That is the whole mechanism: this site has no contact form, no newsletter signup and no account area.

6. Payments

We do not process payments ourselves and we never see, receive or store your card number or other payment credentials.

Paid plans are sold through a Merchant of Record — a company that acts as the seller for the transaction, takes the payment, and handles tax:

Creem (creem.io) — for customers in the EU, the United Kingdom, the United States, Canada, Australia and New Zealand.
Dodo Payments (dodopayments.com) — for other markets.

Which one serves you depends on your region. Checkout takes place on their page, not ours. The payment details you enter there go to them; they are the controller of that transaction and their own privacy policy applies to it. You can read it on the checkout page before you pay.

What comes back to us from them is limited to what we need to run your licence: an identifier for you as their customer, an identifier for your subscription, its status, and the country used for billing.

7. Email we send you

We send transactional email only — the message that confirms your email address, and notices about your licence or subscription (renewal, expiry, failure to charge, cancellation).

We do not send marketing email, and you are not added to any mailing list by registering. If we ever start a product newsletter it will be something you opt into deliberately, and every message will let you leave in one click.

Our email is sent through our hosting provider's mail service (Infomaniak, Switzerland). We do not use tracking pixels or click-tracking in email.

8. Why we are allowed to process this (legal bases)

For those covered by the EU or UK GDPR, or by comparable laws elsewhere:

What	Why we may do it
Registering you, issuing and validating licences, running your subscription	Performance of a contract with you (GDPR Art. 6(1)(b))
The environment signals, seat counting, the activation record	Legitimate interests (Art. 6(1)(f)) — enforcing our licence terms and preventing abuse. The data is minimal and reveals nothing about your business
Server logs, security monitoring	Legitimate interests (Art. 6(1)(f)) — keeping the service available and secure
Keeping records of what was sold and paid	Legal obligation (Art. 6(1)(c)) — accounting and tax law requires it
Answering an email you send us	Legitimate interests, or performance of a contract if you are a customer

We do not process any special category data, and we do not knowingly process data about anyone other than the person who registers.

9. Who else sees this data

We do not sell personal data, we do not share it for advertising, and we do not disclose it to data brokers. It reaches only:

our Merchant of Record (Creem or Dodo Payments), for your purchase — see section 6;
our hosting and email provider (Infomaniak, Switzerland), which stores and transmits it on our behalf;
a public authority, where the law actually requires us to disclose it. If we are permitted to tell you first, we will.

If the business is ever sold or merged, licence and account records would transfer with it, and we would tell you before that happened.

10. Where the data is

We are based in Switzerland and our data is hosted in Switzerland.

Switzerland is recognised by the European Commission, and by the United Kingdom, as providing an adequate level of data protection. Personal data moving from the EU or the UK to us therefore needs no additional transfer mechanism.

Our Merchant of Record may process your payment outside your own country. They do so as the controller of that transaction, under their own safeguards and their own privacy policy.

11. How long we keep it

Record	Retention
Your account and licence records	For as long as your account exists, then 12 months — except where accounting law requires longer (see below)
Activation records for a site you have deactivated or un-registered	12 months, so that licence seats and abuse can be investigated
Records evidencing a purchase, payment or refund, including the notifications from our payment provider	10 years, as Swiss accounting law requires (Art. 958f of the Swiss Code of Obligations)
Email correspondence	Up to 3 years after the exchange ends
Web-server logs	Per our hosting provider's policy — short, and measured in weeks

Un-registering stops the daily check and releases the seat immediately; it is not the same as erasing your account, which you can ask for separately under section 12.

12. Your rights

Wherever you are, you may ask us to:

tell you what we hold about you, and give you a copy;
correct anything that is wrong;
delete it — we will, unless accounting law requires us to keep a specific record, in which case we will tell you which and why;
restrict or object to what we do with it, including anything we do on the basis of legitimate interests;
hand it over in a portable, machine-readable form;
withdraw consent, where we relied on consent, without affecting what was lawful beforehand.

Write to privacy@invflux.com. We will answer within 30 days, and we will not charge you for it. We may need to confirm you control the email address on the account before acting — that is a safeguard for you, not an obstacle.

If you are not satisfied, you may complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority for your country of residence; in the UK, the Information Commissioner's Office. We would rather you came to us first, and we will take it seriously.

13. Security

The licensing service is served over HTTPS only. The credential each activated site holds is stored only as a hash, so a copy of our database does not let anyone impersonate your install. Access to production data is limited to those who need it to operate the service. Card data never touches our systems at all, because we never receive it.

No system is perfect. If a breach ever affects your personal data, we will notify the relevant authority and — where the law requires it, or where it is simply the right thing to do — tell you directly.

14. Children

InvFlux is business software. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to privacy@invflux.com and we will remove it.

15. Changes to this policy

If we change this policy we will update the date at the top of the page. If a change materially affects how we handle your personal data, we will email registered users rather than relying on you to notice.

Because it is the question people actually mean when they ask this: if we ever added anything the plugin transmits, it would be disclosed here and in the plugin's own listing before the release that did it, and it would still not be your shop's data.

16. Contact

Data protection questions and requests: privacy@invflux.com

Anything else: support@invflux.com

Who is responsible for your data