Privacy policy

01 · Data controller

Controller: Fabien NAVABI

Website: https://elefpi.com/

Contact: ELEFPI contact form

02 · Data processed in the ELEFPI plugin

Most of the information displayed by ELEFPI is read and processed locally on the relevant WordPress site. Depending on which modules are activated, settings, analysis results, technical events and history may be stored there.

ELEFPI does not automatically send the full contents of the WordPress database, administrator passwords or the site’s customer data to prepare its reports. Communications required for licensing and updates, and any activated external features, are described separately.

The WordPress site administrator remains responsible for their own privacy policy for visitors and users. This policy describes processing carried out by ELEFPI and its services, rather than all processing on the site where the plugin is installed.

03 · ELEFPI licensing, updates and technical monitoring

Licence verification and distribution: to activate the rights associated with a licence and offer updates, ELEFPI exchanges technical information about the site and installation with its licensing service: the domain or site address, installation and activation identifiers, licence reference, entitlement status and plugin version when communicated.

Minimal version monitoring: when this monitoring is enabled, ELEFPI Update automatically records, during authenticated exchanges, the last ELEFPI version observed for a licensed installation and the date it was received. Older versions, installations whose version remains unknown and the distribution of each release can then be monitored without querying the site’s visitors. An ‘unknown’ version does not mean a failure or an uninstallation.

Update results: when the installed version supports these events, ELEFPI may transmit an attempt identifier, the starting and target versions, the date and a limited technical result: started, installed, new version loaded, or confirmed failure with a predefined code. Receipt of a download is not treated as proof of a successful installation. Earlier versions do not necessarily allow these results to be established retrospectively.

Purposes and legal bases: licence management and the provision of updates support the delivery of the subscribed service (Article 6(1)(b) of the GDPR, where this legal basis applies). Minimal monitoring of versions and results serves ELEFPI’s legitimate interest in ensuring the reliability, security and management of distributed releases (Article 6(1)(f)), while respecting the rights of the individuals concerned.

Retention: the monitoring rules provide a 180-day window for the latest version observation, 90 days for daily observations and version changes, and 90 days for technical attempt events. Physical deletion takes place when cleanup tasks run. These rules do not cover the commercial licence register, accounting records or technical backups, which have their own obligations or retention cycles.

Choices and rights: this monitoring data is separate from detailed diagnostics, which are not enabled by holding a licence or accepting the terms of use. An authorised administrator can view the applicable information and actions in ELEFPI → RGPD – CGU, including objection or erasure requests where provided. An objection does not remove the site’s licence checks or access to the updates to which it is entitled.

04 · ELEFPI Watch

When a user voluntarily activates ELEFPI Watch, information strictly necessary for the service may be sent to ELEFPI servers, including the site’s public URL, technical registration identifiers, service status, availability results and information required for operation and security.

Retention periods vary by category: active configuration, availability checks, incidents, sending queues and security logs. Expired data is cleaned up through the service’s own mechanisms; backup copies follow a separate cycle.

The administrator can pause monitoring or request deletion of the service and its data from ELEFPI. Stopping the service, deleting local data and deleting remote data are not equivalent: the interface distinguishes a confirmed operation from a request that is still pending.

05 · Google PageSpeed Insights

When a PageSpeed analysis is requested, the site’s public URL and the requested strategy (mobile or desktop) may be sent to Google PageSpeed Insights.

ELEFPI does not send WordPress login credentials to Google as part of this process.

Results and some technical information may be cached to reduce repeated requests and prevent abuse. Retention periods depend on the type of cache and the service used. Deleting local results does not delete data that Google may retain under its own policy.

06 · ELEFPI Radar

If Radar is activated, ELEFPI may process information about site changes, performance measurements and observation dates to compare changes with results. Some measurements of public pages may use Google PageSpeed Insights.

Local data and, where the remote service allows it, data associated with this installation may be subject to separate commands to stop processing, remove data or erase it. The displayed result depends on the confirmation actually received; stopping Radar alone does not guarantee deletion of all its history.

07 · Google visibility — Google Search Console

The ‘Google visibility’ feature is optional. It allows a WordPress administrator to connect a Google Search Console property and display official information from Google about the site’s visibility within ELEFPI.

Google permission used:

https://www.googleapis.com/auth/webmasters.readonly

This permission is strictly read-only. ELEFPI does not change the site’s search engine optimisation, content, WordPress settings, sitemaps, robots.txt file or Google settings.

Data that may be processed:

• the WordPress site’s public URL;
• the identifier of the selected Search Console property;
• up to five public URLs selected by the administrator for inspection;
• clicks, impressions, click-through rate and average position provided by Search Console;
• top queries and pages returned by Google;
• URL inspection statuses, last crawl date, fetch status and canonical information where available;
• sitemap information returned by Search Console;
• technical identifiers needed to isolate each ELEFPI installation and secure communications.

Purpose:

This data is used solely to provide the ‘Google visibility’ feature requested by the user: displaying, summarising, comparing and temporarily retaining the latest useful results.

OAuth tokens:

Google authorisation tokens are not sent to the browser or stored in plain text in WordPress. They are held in protected form on the ELEFPI service side to enable authorised requests to Google.

Retention:

• Search Console reports and sitemaps: operational cache of approximately 6 hours;
• URL inspection results: operational cache of approximately 24 hours;
• latest valid results that can be displayed during temporary unavailability: up to 7 days;
• inactive connection: automatic deletion scheduled after 90 days of inactivity;
• expired intermediate and technical data is deleted by periodic cleanup tasks.

Disconnection and deletion:

The administrator can request the site’s disconnection from ELEFPI and, separately, revocation of Google’s authorisation where that action is offered. Associated local data can be removed within the scope indicated by the interface. Confirmation of a remote operation may require additional processing; disconnection does not delete the Google account or Search Console property. Users can also manage access from their Google account.

Sharing and use:

ELEFPI does not sell users’ Google data, use it for advertising or pass it to third parties for advertising profiling. It is processed solely to provide and secure the requested feature.

Use of data obtained from Google APIs is subject to the Google API Services User Data Policy , including the ‘Limited Use’ requirements where applicable.

Google Privacy Policy · Google Terms of Service

08 · ELEFPI Support

When a user explicitly chooses to send a support report, ELEFPI may receive the technical information needed for diagnosis, together with the description supplied by the user.

Before sending, users must check that their request does not unnecessarily include a password, API key, cookie, nonce or another person’s personal data. Correspondence is retained as part of handling the request and for the security or retention periods applicable to the service; deletion and closure follow their own procedures.

Closing a request, revoking access to it or removing a local link does not necessarily erase every copy of the ticket and its attachments.

09 · The elefpi.com website, enquiries and orders

When someone uses the contact form or requests support, ELEFPI processes the contact details and information they voluntarily provide in order to respond. This information is not intended for routine advertising mailings.

When a purchase, subscription or invoice is processed on elefpi.com, information needed for the order, payment, billing and licence management may be processed. Payment arrangements and the information received by the relevant providers depend on the payment method chosen. Records required to meet accounting or tax obligations may be retained for the applicable statutory periods.

The site may use technical cookies needed for WordPress, login, the basket and orders. Any optional trackers, such as analytics or advertising trackers, are subject to the applicable consent requirements. Embedded content from external services may be governed by their own privacy policies.

10 · Hosting and technical logs

ELEFPI uses IONOS hosting. The hosting provider’s technical logs may include the IP address, date and time, HTTP method, requested path, response code and user agent.

These logs are used to operate, secure and diagnose the hosting environment. Their retention is also governed by the hosting provider’s technical policies.

11 · General purposes

• provide the features requested by the user;
• monitor availability when ELEFPI Watch is activated;
• display requested PageSpeed analyses;
• display Google Search Console data when ‘Google visibility’ is activated;
• provide technical support on explicit request;
• manage licences and offer updates;
• identify observed versions and minimal update results to support reliability, security and release tracking;
• maintain security, prevent abuse and diagnose errors where such processing is provided for and authorised.

12 · Legal bases and optional processing

Depending on the processing concerned, the legal bases are performance of a contract or a requested service (Article 6(1)(b) of the GDPR), the legitimate interest in maintaining the security, reliability and technical monitoring of services (point f), compliance with a legal obligation for certain billing data (point c), or consent where required for an optional feature or processing activity (point a).

Data essential to licence verification or a service request must be provided for that service to be delivered. Optional external features such as the Google Search Console connection or Watch monitoring are not activated simply by reading this policy. Where consent is the basis for processing, it may be withdrawn in accordance with the applicable rules.

13 · Recipients and external services

Data is accessible only to the people and providers who need it to operate and secure ELEFPI services.

• IONOS: hosting for the ELEFPI infrastructure;
• Google PageSpeed Insights: only when a PageSpeed analysis is requested;
• Google Search Console: only when ‘Google visibility’ is activated and a user authorises the connection;
• providers involved in orders or payments, if that service is used.

External providers may apply their own privacy policies and, depending on their services and infrastructure, may involve processing outside the European Economic Area. Information applicable to Google is set out in its privacy policy. For any questions about recipients or the safeguards in place, use the contact details above.

14 · Security

ELEFPI implements technical and organisational measures intended to limit unauthorised access, loss, alteration or disclosure.

Where the architecture allows it, service secrets and OAuth tokens are stored outside the public directory, with restrictive server permissions. Sensitive communications use HTTPS and appropriate authentication mechanisms.

15 · Your rights

Under the applicable rules, you may in particular request access, rectification, erasure or restriction of certain processing, object where that right applies, and request portability where the legal conditions are met.

To exercise your rights, use the ELEFPI contact form. Identify the relevant site or licence only to the extent needed to identify the request; do not send any password or secret.

Administrators of sites using ELEFPI also have options to view, export and remove data in ELEFPI → RGPD – CGU. These tools do not replace consideration of a request concerning an individual.

In particular, you may exercise a right to object to processing based on legitimate interests, subject to the conditions of Article 21 of the GDPR. Other rights apply according to their legal basis and any retention obligations. You may also lodge a complaint with the CNIL.

16 · Changes to this policy

This policy may be updated to reflect changes to ELEFPI, connected services, processing activities or the law. The date of the latest update appears at the top of this page.