Explore Management Limited (“we”, “us”, “our”), trading as Edutainment UK, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose personal information when you visit edutain-certificate-validator.edutainmentuk.com (the “Website”), install or purchase our Edutain Certificate Validator plugin (Free or Pro, together the “Plugin”), or use any of our related services.

This policy is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

• Legal entity: Explore Management Limited
• Trading name: Edutainment UK
• Company number: 14755408 (registered in England and Wales)
• Registered office: 71 Gerald Street, Newcastle Upon Tyne, England, NE4 8QH
• Contact email: buzz@edutainmentuk.com

For the purposes of UK GDPR, Explore Management Limited is the data controller for personal data collected through the Website and our commercial services.

2. Two Important Roles

Please read this carefully — it explains who is responsible for what.

• When you visit our Website or buy from us, we are the data controller for your personal data.
• When you install the Plugin on your own WordPress site and use it to publish certificates for your learners, you are the data controller for that learner data. We are neither the controller nor a processor of it, because that data never leaves your WordPress site and is never transmitted to us. You are responsible for handling your learners’ personal data lawfully (issuing privacy notices to them, honouring their data rights, etc.).

3. What the Free Plugin Does With Data

The Free plugin (edutain-certificate-validator, distributed via WordPress.org) does not phone home. It does not send any data to us, to Freemius, or to any other third party. Specifically:

• Certificate records (course name, student name, completion date, certificate code) are stored only in your own WordPress database.
• The public verification page runs entirely on your server.
• The rate limiter briefly stores visitor IP addresses in your site’s transient cache (60 seconds by default) to throttle abusive verification attempts. This data stays on your server and is auto-expired.
• No analytics, telemetry, or licence checks run from the Free plugin.

4. What the Pro Plugin Does With Data

The Pro plugin (edutain-certificate-validator-pro, sold from our Website and via AppSumo) adds features on top of Free. Here is exactly what changes:

4.1 Data that stays on your WordPress site

Pro processes the following on your own server only — none of it is transmitted to us:

• Certificate expiry dates, revocation and suspension status.
• Custom fields you add to certificates (which may include learner email addresses if you use the email-delivery feature).
• QR codes and PDF certificates, generated locally on your server.
• A verification log (wp_edcv_verification_log) recording each verification attempt: certificate code, whether it was found, its state, and an irreversibly hashed IP address (salted MD5, not the raw IP). This log is pruned automatically according to your retention setting.
• Certificate-delivery emails sent to learners, dispatched from your own WordPress installation.

4.2 Data that Pro transmits to Freemius (and to us)

Pro uses Freemius as its licensing, updates, and checkout platform. When you activate Pro, Freemius transmits:

Always (required for licence validation and updates):

• Licence key
• Plugin version and edition
• Your WordPress site URL
• WordPress and PHP version
• Whether the Plugin is active, deactivated, or uninstalled

Only if you opt in during activation (usage data):

• Site administrator name and email
• Website language
• Non-sensitive environment data such as active theme name and other active plugins

You can skip the opt-in during activation, in which case only the licence-validation data is transmitted. You can opt out at any time from the Pro settings, or by deactivating the Plugin. Freemius acts as our data processor for this information. Full details are in the Freemius Privacy Policy.

5. What the Website Collects

5.1 Information you give us directly

When you contact us, register an account, or buy a licence:

• Name
• Email address
• Billing address and country
• Company or website name
• Support messages and their contents

5.2 Payment information

We do not store full credit or debit card details. Payments are handled by our payment processors (Stripe and PayPal, via Freemius). We only receive limited transaction data such as the last four digits of the card, card brand, and billing country.

5.3 Information collected automatically

When you visit the Website, we and our hosting provider may automatically collect: IP address, browser type and version, operating system, referring URL, pages viewed, and visit timestamps. This is used for security and fraud prevention.

We also use Google Analytics 4 (provided by Google LLC / Google Ireland Limited) to understand aggregated traffic patterns and improve the Website. Google Analytics may set cookies and collect information such as your IP address (truncated), pages viewed, session duration, device and browser data, and approximate location. This data is processed on the lawful basis of consent — Google Analytics only runs after you accept analytics cookies in our cookie banner.

Google may transfer this data outside the UK, including to the United States, under lawful transfer mechanisms (UK IDTA / SCCs). You can opt out at any time by:

• declining analytics cookies in our cookie banner,
• installing the Google Analytics Opt-out Browser Add-on, or
• clearing your cookies for this Website.

More information: Google Privacy Policy and How Google uses information from sites that use its services.

5.4 Information collected when you buy via AppSumo

If you purchase through AppSumo, we receive the information needed to fulfil your order: your name, email address, order ID, and licence entitlement. AppSumo processes your payment and account under its own privacy policy.

6. How We Use Your Information

Purpose	Lawful basis (UK GDPR)
Delivering, activating, and updating the Plugin	Contract
Providing customer support	Contract
Verifying licences and preventing fraud or abuse	Legitimate interests
Sending transactional emails (receipts, renewal reminders, security notices)	Contract
Sending marketing emails about our products (only if you opt in)	Consent
Improving the Plugin and Website through aggregated analytics	Legitimate interests
Meeting legal, tax, and accounting obligations	Legal obligation

We do not sell your personal data.

7. Marketing Emails

We only send marketing emails to people who have opted in. Every marketing email includes an unsubscribe link, and you can opt out at any time by clicking it or emailing buzz@edutainmentuk.com. Opting out of marketing does not stop transactional emails (renewal notices, licence expiry warnings), which are required to deliver the Service.

8. Third Parties We Share Data With

Each of the following acts under a data processing agreement and in line with UK GDPR:

• Freemius, Inc. — licensing, checkout, updates, and (if you opt in) usage analytics for the Pro Plugin.
• AppSumo (Sumo Group, Inc.) — for customers who purchase through AppSumo Marketplace.
• Stripe and PayPal (via Freemius) — for processing transactions.
• Email delivery providers — for transactional and (opted-in) marketing emails.
• Website hosting and CDN providers — for hosting the Website.

We may also disclose information where required by law, court order, or to protect our rights, our users, or the public.

9. International Transfers

Some of our service providers (including Freemius, AppSumo, Stripe, and hosting providers) are based outside the UK. Where personal data is transferred outside the UK, we rely on lawful transfer mechanisms such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

10. How Long We Keep Your Data

• Account and licence data: for the life of your licence, plus up to 7 years afterwards to meet UK tax and accounting requirements.
• Support tickets and emails: up to 3 years after last contact.
• Marketing subscriber data: until you unsubscribe.
• Website analytics logs: typically 14 months.

Data stored inside your own WordPress installation by the Plugin is retained according to your settings and is deleted when you tell it to (or on uninstall, if you enable the delete-on-uninstall option).

11. Cookies

The Website uses cookies for the following purposes:

• Essential cookies — required for the Website to function (e.g. maintaining your login session, remembering your cookie preferences). These do not require consent.
• Analytics cookies — set by Google Analytics 4 to measure aggregated traffic. These run only if you accept them in the cookie banner.
• Checkout cookies — set by our payment and licensing provider (Freemius) during purchase, to keep your cart and session intact.

You can control or delete cookies through your browser settings, and you can change your consent choice at any time using the cookie banner. Blocking essential cookies may stop parts of the Website working.

The Plugin itself sets no cookies on your visitors’ browsers.

12. Your Rights Under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data (“right to be forgotten”), subject to legal retention requirements.
• Restrict or object to processing based on legitimate interests.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, email buzz@edutainmentuk.com. We respond within one month.

If you are a learner whose certificate is being verified on a site running our Plugin, please contact the operator of that site to exercise your rights — they, not us, are the controller of your data.

13. Data Deletion Requests

To request deletion of your account and associated personal data, email buzz@edutainmentuk.com with the subject line “Data Deletion Request”. We will confirm the request, remove your data from our active systems, and instruct our processors (including Freemius) to do the same, except where we are legally required to retain certain records (for example, invoices for tax purposes).

14. Security

We use industry-standard measures to protect your data, including HTTPS in transit, encrypted storage where appropriate, access controls, and regular software updates. The Plugin itself follows WordPress security best practice: prepared database statements, output escaping, nonce-protected AJAX, and per-IP rate limiting on the public verification endpoint. If a data breach affects your personal data and poses a risk to your rights, we will notify you and the ICO within 72 hours where required by law.

15. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will remove it.

16. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top will reflect the latest version. For significant changes, we will notify registered users by email or through the Plugin dashboard.

17. Contact

Explore Management Limited (t/a Edutainment UK) 71 Gerald Street, Newcastle Upon Tyne, England, NE4 8QH Email: buzz@edutainmentuk.com Company number: 14755408