DrPlugin

Privacy Policy

Last updated: 16 October 2026

1. Who we are

DrPlugin is a product brand operated by Virtueplanet Services LLP. Virtueplanet Services LLP controls the personal data described in this policy and is the data fiduciary or data controller where applicable law uses those terms.

Our registered address is:

Virtueplanet Services LLP, 3, Dr. Girindra Sekhar Bose Road, Flat-1B, Block-1, Signum Gardenia, Kolkata 700039, West Bengal, India.

  • Privacy enquiries: Email address, shown when JavaScript runs
  • Customer support: Email address, shown when JavaScript runs

This policy covers drplugin.com, DrPlugin accounts and support, purchases made through the site, and the download, licence, and update services used by our WordPress and Joomla products.

2. Personal data we collect

2.1 Account and sign-in data

When you create or use an account, we may collect your name, email address, password hash, email-verification status, sign-in history, account preferences, and the dates on which your account was created or last used.

If you choose Google or GitHub sign-in, we receive the provider account identifier and profile information needed to sign you in, normally your name and verified email address. We do not receive your Google or GitHub password.

2.2 Order and billing data

We may collect your billing name and address, country, company name, tax status, GSTIN or other tax identifier, order and invoice details, selected product and plan, currency, discounts, payment status, refunds, the IP address and time at which you accepted our terms at checkout, and the customer, subscription, and payment identifiers that Stripe assigns.

You enter your card details on Stripe's checkout page. We do not receive or store your full card number, card security code, or bank credentials.

2.3 Licence, download, and update data

We collect the domains registered to a licence, product and version information, platform information needed to provide an update, request time, IP address, and a limited licence-key identifier used for security and diagnosis. Operational logs use only the last four characters or another non-secret fingerprint of a licence key, not the full key.

2.4 Device, session, and security data

When you visit the site or sign in, our systems and security providers may process your IP address, browser and device information, user-agent string, requested URL, referrer, timestamps, session identifiers, consent choices, and information about failed or suspicious requests.

We use an IP-derived country signal to select the appropriate currency and payment route. This can come from Cloudflare or, where enabled, a separate IP-country lookup. You can change the selected country at checkout.

Cloudflare Turnstile processes technical and interaction information to determine whether a request is made by a person rather than an automated system.

2.5 Support, contact, and review data

When you contact us, open a ticket, reply to a ticket, or submit a review, we collect the information you provide. This can include your name, email address, message, product details, website details, diagnostic information, and attachments.

Please do not send passwords, private keys, full payment-card details, or unrelated personal data in a message or attachment.

2.6 Analytics and consent data

If you consent to analytics cookies, Google Analytics processes cookie identifiers, page and event information, approximate location, browser and device information, referrer information, and similar usage data. We use Google Tag Manager to manage the analytics tag.

Our current consent implementation can load Google Tag Manager with analytics and advertising storage set to denied. In that state, Google tags may receive consent-status and cookieless measurement signals, such as the time, user agent, referrer, page information, and a per-page random value. Analytics cookies are not stored unless you consent.

We do not currently use Google Ads or the Meta Pixel. Before enabling either service, we will update this policy and the Cookie Policy and require the relevant consent.

2.7 Data we do not ask for

Our services are not designed to collect sensitive personal data. Do not send health information, government identity documents, biometric data, financial credentials, or information about children unless we specifically request it for a lawful and necessary reason.

We do not sell personal data. We do not use personal data for automated decisions that produce legal or similarly significant effects.

3. Why we use personal data

We use personal data only where we have a valid purpose and a lawful basis under applicable law.

The lawful bases below are those under the EU and UK GDPR.

  • Create and operate your account. Data: account and sign-in data. Lawful basis: performance of a contract.
  • Process an order, deliver downloads, and provide licence services. Data: account, billing, order, and licence data. Lawful basis: performance of a contract.
  • Issue invoices, credit notes, and tax records. Data: billing and order data. Lawful basis: legal obligation.
  • Provide updates and technical support. Data: account, licence, device, and support data. Lawful basis: performance of a contract.
  • Protect accounts, products, and infrastructure. Data: session, IP, device, licence, and security data. Lawful basis: legitimate interests in security and fraud prevention.
  • Enforce plan limits for official updates and support. Data: account, licence, domain, and request data. Lawful basis: performance of a contract and legitimate interests.
  • Answer enquiries and manage complaints. Data: contact and support data. Lawful basis: performance of a contract or legitimate interests.
  • Send receipts, security notices, licence messages, and service updates. Data: account and order data. Lawful basis: performance of a contract or legal obligation.
  • Send marketing email that you requested. Data: name and email address. Lawful basis: consent.
  • Measure use of the public site. Data: consent, cookie, device, and analytics data. Lawful basis: consent for analytics storage, and legitimate interests only where applicable law permits cookieless signals.
  • Establish, exercise, or defend legal claims. Data: relevant account, order, security, and correspondence data. Lawful basis: legitimate interests or legal obligation.

Where consent is the basis, you may withdraw it at any time. Where we rely on legitimate interests, we consider the effect on your rights and use only the data reasonably needed for the purpose.

4. Cookies and similar technologies

We use necessary cookies for sign-in, security, country selection, and recording your consent choice. Google Analytics cookies are optional and are not stored unless you consent.

Our Cookie Policy identifies the cookies, purposes, and expected durations and explains how to change your choice.

5. Who receives personal data

We use service providers only for the purposes described in this policy. The providers that may receive personal data include:

  • Stripe. Payment processing for every order, including the checkout page, automatic renewals outside India, refunds, and the billing portal where you update a card or address. Typical data: name, email address, billing address, tax identifier, order and plan details, IP address, and the card details you enter on Stripe's page.
  • Resend. Transactional and support email delivery. Typical data: name, email address, message content, and delivery metadata.
  • DigitalOcean. Application and database hosting. Typical data: data stored or processed by the application.
  • Cloudflare, including Cloudflare R2 and Turnstile. Content delivery, web security, file storage, and bot prevention. Typical data: IP address, request and device data, security signals, and stored files.
  • Google. Google sign-in, Google Tag Manager, Google Analytics, and privacy-enhanced YouTube embeds. Typical data: account data when you use Google sign-in; consent, device, and usage data for analytics; request and playback data for an embedded video.
  • GitHub. GitHub sign-in. Typical data: provider account identifier, name, and verified email address.

Stripe processes payment data on our behalf. Stripe also uses some of that data as an independent controller, for example to prevent fraud and to meet its own legal obligations. The Stripe Privacy Policy applies to that use. Card networks, banks, and other payment participants process data under their own legal obligations and terms.

We may disclose information to professional advisers, auditors, insurers, courts, regulators, tax authorities, law-enforcement bodies, or another party where disclosure is required by law or reasonably necessary to protect rights, investigate fraud, or handle a legal claim.

If our business or relevant assets are reorganised, financed, sold, or transferred, personal data may be disclosed under appropriate confidentiality and data-protection safeguards.

6. International transfers

We operate from India. Some providers process data in the United States, the United Kingdom, the European Economic Area, and other countries. Stripe, for example, processes payment data in the United States. This means personal data may be transferred outside your country.

Where the EU or UK GDPR applies, we use a legally recognised transfer mechanism where required, such as an adequacy regulation, the European Commission's standard contractual clauses, the UK international data transfer addendum, or another valid safeguard. You may contact us for information about the safeguard relevant to a transfer.

7. How long we keep personal data

We keep data only for as long as it is reasonably needed for the purpose described, including legal, tax, accounting, security, and dispute-resolution requirements.

  • Account data: while the account is open, then deleted or anonymised when an eligible account-erasure request is completed.
  • Orders, invoices, credit notes, tax and settlement records: for the period required by Indian tax, accounting, and company law and for related claims.
  • Active licence records and registered domains: while needed to provide the licence services, resolve an order, or keep an audit record.
  • Download and update-check logs: normally 90 days.
  • Sign-in attempt logs: normally 90 days.
  • Contact-form submissions: normally 365 days.
  • Sessions: until expiry or revocation, followed by a limited cleanup period; IP and device data are removed on eligible account erasure.
  • OAuth transaction records and password or sign-in tokens: until used or expired, followed by routine cleanup.
  • Support tickets, replies, and attachments: while needed to provide support and for a reasonable period to handle repeat issues or disputes; deleted on eligible account erasure unless retention is legally required.
  • Analytics data: according to the retention setting in our Google Analytics property; related browser cookies can last up to two years unless deleted earlier.
  • Cookie-consent choice: 180 days, unless replaced or deleted earlier.

Backups and provider logs may retain a protected copy for a limited additional period. Data retained for law, fraud prevention, or a legal claim is restricted to that purpose.

8. Account export and erasure

You can download a copy of your account data and delete your account from the "Your data" section of your account settings. Deletion asks you to confirm with your password or, for an account without a password, through a link we email to you. You may also request access, correction, or erasure by contacting Email address, shown when JavaScript runs.

An active paid licence prevents account deletion because the account is needed to provide the service and reconcile payment events. For an order billed outside India, you can cancel the renewal and wait for the term to end. An order billed in India does not renew automatically and ends on its expiry date, so you only need to wait for that date. You can also obtain an eligible refund, or contact support to resolve the active entitlement.

When an eligible account is erased, we anonymise the customer account and remove or anonymise associated sessions, sign-in records, OAuth links, reviews, contact submissions, support tickets, and licence logs. We retain order, invoice, credit-note, payment-provider, and audit records where law or legitimate accounting and fraud-prevention requirements require them. Those retained records are no longer used for marketing.

9. Your privacy rights

Depending on where you live and which law applies, you may have rights to:

  • obtain information about our processing and receive a copy of your personal data;
  • correct or complete inaccurate data;
  • request deletion of data that we no longer have a lawful reason to keep;
  • restrict or object to certain processing;
  • receive data you provided in a portable format where applicable;
  • withdraw consent without affecting processing completed before withdrawal;
  • opt out of direct marketing at any time;
  • nominate another person to exercise rights where Indian law provides for it; and
  • complain to the applicable regulator or data-protection authority.

India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 apply according to the commencement dates notified by the Government of India. We intend to honour applicable requests consistently as those provisions come into force.

If the EU or UK GDPR applies, we normally respond to a valid request within one month. Other laws may set a different period. We may ask for information needed to verify identity and authority. We will not discriminate against you for making a request.

Send a request to Email address, shown when JavaScript runs.

10. Security

We use measures designed to protect personal data, including encrypted transport, password hashing, access controls, session revocation, rate limiting, two-factor authentication for administrative access, restricted storage, security logging, and limited retention for operational logs.

No online service can guarantee absolute security. If a personal-data breach occurs, we will investigate it and notify affected people and authorities where the applicable law requires notification.

11. Children

The site and products are intended for businesses, professionals, and adult website owners. They are not directed to children, and we do not knowingly collect personal data from anyone under 18.

If you believe a child has provided personal data to us, contact Email address, shown when JavaScript runs. We will investigate and delete the data where required.

12. Third-party sites and product installations

The site may link to third-party websites. Their privacy practices are governed by their own policies.

DrPlugin software runs on websites controlled by customers. Unless a product description expressly says otherwise, we do not receive the content, visitors' personal data, or database of a website merely because our software is installed there. The website owner is responsible for evaluating what the installed product does and for giving any notice or obtaining any consent required for that website.

13. Changes to this policy

We will update this policy when our data practices, providers, or legal obligations materially change. The date at the top identifies the current version. We will give reasonable notice of a material change where required.

We will update this policy and the Cookie Policy before enabling Google Ads, the Meta Pixel, or another new advertising technology.

14. Contact and grievances

  • Privacy and legal enquiries: Email address, shown when JavaScript runs
  • Customer support: Email address, shown when JavaScript runs

Grievance Officer:

  • Abhishek Das, Founder and Partner
  • Email: Email address, shown when JavaScript runs
  • Phone: Phone number, shown when JavaScript runs

Postal address:

Virtueplanet Services LLP, 3, Dr. Girindra Sekhar Bose Road, Flat-1B, Block-1, Signum Gardenia, Kolkata 700039, West Bengal, India.

We aim to acknowledge consumer grievances within 48 hours and resolve them within one month. Privacy requests are handled within the period required by the law that applies to the request.