Privacy policy

wpgraft is operated by Računarsko programiranje GUGUNOVIĆ Saša Gugunović s.p. Kozarska Dubica, a sole proprietorship (samostalni preduzetnik) registered in Bosnia and Herzegovina, JIB 4513290400009, Kodunaška 4, Kozarska Dubica, Bosnia and Herzegovina.

We are the data controller for the personal data described in section 5. For the content you choose to copy we act as your processor. Section 4 explains that distinction, and it matters. Everything reaches us at [email protected]: privacy enquiries, rights requests and product support share one mailbox.

We have no office, branch or other establishment in the EU, the EEA or the UK. Everything is run from the address above. If you are in the EU, the EEA or the UK, write to us directly at [email protected] on any matter relating to your personal data. There is no intermediary to go through, and no request is treated differently for coming from outside Bosnia and Herzegovina. Section 13 sets out the rights you have, how quickly we answer, and which supervisory authority you can complain to if our answer does not satisfy you.

Provided for convenience; the detail below governs.

• We do not store the pages you copy. Captured markup and styles pass through our server in memory, are converted, and are returned to you. They are never written to disk or to a database, by us or by our conversion service.
• We do store a record that a conversion happened, including the URL you copied from, to meter usage and to support you.
• We never receive your cookies, passwords, session tokens, browser storage, or the contents of form fields. The extension does not read them, and field values are stripped from the page before anything is sent.
• We never receive JavaScript from the pages you copy. Scripts are discarded in your browser before anything is transmitted.
• The published extension does not request access to all your sites at install time, and does not carry the debugger or tabs permission.
• There is no artificial intelligence in the product. Conversion is deterministic parsing.
• We do not sell or share personal data, and we run no advertising or cross-site tracking.
• The website uses Google Analytics to count page views, and you can refuse it. In the EEA, the UK and Switzerland nothing analytics-related loads until you say yes; everywhere else it starts on and the Cookie settings link in the footer turns it off. We send Google the page path only, never the query string, and every advertising feature is disabled. Section 8 has the detail.
• Our website, database and conversion service all run on our own servers in Nuremberg, Germany.

3.1 Permissions

The extension published to the Chrome Web Store requests, at install time:

Broad site access is not granted at install. It is declared as an optional permission and requested at your first copy, through Chrome’s own runtime prompt, triggered by your click. You may decline it, and you may withdraw it at any time from your browser’s extension settings.

The published extension does not carry the tabs permission, so it cannot enumerate your browsing history, and does not carry the debugger permission, so it cannot attach to the Chrome DevTools Protocol, intercept network traffic, or bypass browser security restrictions.

A separate development build carrying additional permissions exists for our own automated testing on our own machines. It is not distributed and is not available in any extension store.

3.2 The right-click element tracker

The extension’s manifest declares no content scripts. Until you grant site access, no wpgraft code runs on any page you browse.

Once you have granted site access, the extension registers one small script (right-click-target.js) on the sites covered by that grant. It is registered at runtime and is kept in step with your grants automatically: withdraw the grant and it is unregistered. It runs on the top-level frame only. In full, it:

• adds a single passive right-click listener, so the site’s own context-menu behaviour is unchanged;
• holds a reference to the element under your cursor at the moment you right-click, in the extension’s own isolated JavaScript world;
• reads no page content, sends no message, opens no network connection, and never modifies the page.

It exists because the browser’s context-menu API reports which menu item was clicked but not which element was under the pointer, and by then the event has passed. Nothing it records leaves your browser, and it is discarded when the page is.

3.3 What happens when you copy

1. You confirm in the extension that you have the right to copy from the current domain (section 12).
2. The extension reads the rendered structure and the computed styles of the page, section, or element you chose.
3. Before anything leaves your browser, these node types are discarded: script, style, link, meta, noscript, template, head, base, title. Executable code is never transmitted, and our conversion service accepts none.
4. Before anything leaves your browser, form-field data is removed: the value of every field is dropped, the contents of every textarea are dropped, and a password field additionally loses its name and placeholder. The only value kept is the label of a button, where the attribute is the visible text.
5. The remaining markup and style data are sent over TLS to our backend, which proxies them in memory to our own conversion service.
6. The conversion service produces builder-native JSON deterministically and it is streamed straight back to your browser.
7. At no point are the captured markup, the style data, or the converted output written to disk or to a database on our infrastructure.
8. The converted output is stored locally in your own browser until you insert or discard it.
9. If your Library is switched on (it is by default), the HTML and CSS from step 5 are also written to storage inside your own browser profile, so that the same copy can be converted for a different builder later without visiting the source page again. That local save happens on your device. It is not a second copy on our servers, because there is no first copy on our servers. See section 3.5.

Where an asset, a font or an image, cannot be reached from the page because of cross-origin restrictions, the extension may re-fetch it. Those requests are made with credentials explicitly omitted, so no cookie or authorization header is ever attached, and a URL that names a loopback, private, link-local or cloud-metadata address, or a hostname in one of the reserved internal suffixes, is refused. That check reads the address in the URL; it is not a DNS resolution, so a public hostname that an internal resolver happens to point at a private address is not caught by it.

3.4 What the capture contains, precisely

The capture is the visible structure of the page: element tags, a fixed list of HTML attributes, text content, and computed CSS. It therefore contains the text that is visible on the page you copied. That is the point of the product, and you should keep it in mind when choosing what to copy.

It does not contain cookies, localStorage, sessionStorage, authorization headers, or any credential. Form-field data is not captured either, in both of the ways it could be: text you have typed is held by the browser as a live property, which the extension never reads, and a value the site itself pre-rendered into the markup (a pre-filled email on an account page, a hidden order number, a password field, the contents of a message box) is stripped in the page before transmission (section 3.3).

3.5 Your Library: saved copies stay on your computer

The extension can keep the cleaned HTML and CSS of each copy you make. That is the Library. Its purpose is narrow and practical: the markup is builder-neutral, so a copy saved today can be converted for Bricks now and for Gutenberg in six months, without going back to a page that may by then have changed or disappeared.

The practical consequences, stated plainly:

• Saving is not uploading. A copy you save and never convert never leaves your machine at all. Converting one sends its HTML and CSS through our conversion service exactly as a fresh copy does: in memory, never written down (sections 3.3 and 14).
• It is yours to delete, and only yours. Delete a single copy, empty the Library, or uninstall the extension: any of those removes it from your device. There is no copy of it anywhere else for us to delete on request, which is also why a data-deletion request to us cannot clear it for you.
• Nothing is deleted automatically. The Library has no expiry and no size cap that quietly discards the oldest item. It grows until you remove things, and the extension asks your browser to treat that storage as persistent so it is not evicted under disk pressure.
• It travels only if you move it. The Library page can export a saved copy as a single .html file, or the whole archive as a backup file, to your disk. That export is a browser download; it does not pass through us.
• Clearing browser data clears it. Because it lives in your browser profile, removing the extension, deleting the profile, or clearing site data for extensions will take the Library with it. We cannot restore it.

One thing the Library page does reach the internet for: a preview. The thumbnail on each saved copy, and the full-size preview, render that copy inside a sandboxed frame, and the frame loads the images the copy points at, from the sites they came from. Those are requests from your browser to those sites (the same ones your browser made when you first visited the page), sent with no referrer, no cookies and no scripts, and nothing about them is sent to us. The Previews switch in the Library toolbar turns it off entirely.

Because the content of your Library is content you copied, everything in section 3.4 about what a capture contains applies to it, and keeping such a copy is still copying: the responsibility described in section 12 and in the Terms does not change because the copy is sitting on your own disk.

4.1 Controller, for your account

For the data in section 5 (your account, your billing relationship, your usage records, your support messages), we decide the purposes and means of processing. We are the controller and the rights in section 13 apply to us directly.

4.2 Processor, for the content you copy

When you copy a page, you choose which page, when, and why. If that page contains personal data belonging to other people (a name in a testimonial, a photograph, an author byline, contact details in a footer), then for that content you are the controller and we are your processor, acting only on your instruction, transiently, solely to perform the conversion you asked for. We keep no copy and use it for nothing else: not for analytics, not for product improvement, and never for model training.

4.3 Your responsibilities as controller

You are responsible for ensuring your copying has a lawful basis and does not infringe anyone’s rights. Do not use wpgraft to copy pages containing special categories of personal data under Article 9 GDPR (health, biometric data, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation), nor pages containing financial account data, government identifiers, or other people’s private communications. Our Terms of service set out the same rule as a contractual one.

4.4 Data processing agreement

If you need a written agreement under Article 28 GDPR reflecting the above, write to [email protected] and we will provide one at no charge.

5.1 Account

Authentication is handled by Clerk; we support email sign-in and Google sign-in. We never receive or store your password. Against your account we store: your Clerk user identifier, your email address, your plan, your conversion counter, your Polar customer and subscription identifiers once you subscribe, and creation and update timestamps.

5.2 Extension tokens

Your extension authenticates with a random 32-byte token, shown to you once and never stored by us. We keep only its SHA-256 hash, plus a label, a creation time, a last-used time, and a revocation flag. Nobody with access to our database could derive your token from it. Revoking a token from your dashboard takes effect immediately.

5.3 Conversion metadata

Each successful conversion writes one row containing:

• your account identifier and a capture identifier;
• the URL of the page you copied from;
• the destination page builder, a status, a duration in milliseconds, a timestamp.

The page content is not recorded, only the address it was at. We keep the source URL to meter your usage, to investigate conversions you report as broken, and to respond to intellectual-property complaints (section 12). Because it is linked to your account we treat it as personal data.

5.4 Billing

Polar is our merchant of record and the seller for every purchase. Polar collects and processes your payment details as an independent controller under its own privacy policy, and handles VAT and sales tax. We never see or store your card number, CVV, or bank details.

We store the webhook events Polar sends when your subscription changes, including the customer and billing fields those events carry, as the audit trail that settles whether we were told about a change. This is necessary to keep your entitlement in step with your subscription.

5.5 Free-tier abuse prevention

We explain this in full rather than let you discover it. The free tier is 3 conversions per account, within 7 days of signing up, into any builder we support, limited to element-level copies. Accounts are free to create, so metering by account alone caps nobody. The rule we actually enforce is therefore one free account per device, and 3 free conversions on that device, ever. A second free account converting from a device whose free allowance is already spent is refused and told to upgrade. Signing up remains free and unrestricted; this applies only to converting, and paid accounts never reach it.

Your email address, folded to the inbox behind it. When an account is created we store a normalised form of the address alongside it: lowercased, with a +tag removed, and for Gmail with the dots removed, because all of those reach one inbox. It is compared against existing accounts for one purpose: an inbox that has already had a free tier does not get another. The account is still created and can still subscribe; only the free allowance is withheld. This is a new use of an address you already gave us, not a new thing collected, and it is never used to build a profile or shared with anyone. The free tier also lapses 7 days after signup, which is a date on your account row and nothing more.

Two device signals, and they do different jobs.

• An installation identifier. When you install the extension it generates a random identifier and keeps it in your browser’s extension storage. It is sent to us in a request header on the extension’s authenticated calls, and it is the value the one-account-per-device rule is keyed on. It identifies that installation of the extension, not you, not your account, and not your computer. It is not readable by any website, is never used for advertising, analytics, or tracking you between sites, and is deleted when you uninstall the extension. It deliberately survives signing out: a device that has spent its free conversions has spent them.
• The same identifier secures your seat. Your extension token is a password in string form, so the first computer to use one claims it: we store a salted hash of that installation identifier against the token, and a request from anywhere else is refused and told to connect that computer itself. This stops one subscription being pasted into a forum and used by hundreds of people. It applies on every plan, it holds one computer at a time, and moving it is self-service: connecting the extension on another computer moves the seat there and signs the first one out. This is stated in section 9.1 of the Terms as well, because it is a limit on what you bought, not only a privacy matter.
• A network signal. Your IP address narrowed to its network block, the first three octets for IPv4 (/24) and the first 48 bits for IPv6 (/48), combined with your browser’s User-Agent string truncated to 200 characters. Nothing else. This one is computed on our server from headers your request already carries. Because a whole office, household or mobile network shares it, its threshold is set several times higher than the per-device one: it is there to notice a farm of signups, not to arbitrate between two people at one desk. A request that carries no installation identifier is held to the strict rule on this value instead.

What is stored is a salted SHA-256 digest of each signal, a conversion count, a count of distinct accounts seen, first- and last-seen timestamps, an optional manual allow/block override, and a join table linking the digest to the account identifiers that have converted from it. That link is what makes the rule enforceable and answerable in a support case. The raw IP address, User-Agent and installation identifier are never written to storage; they exist only inside the function that computes the hash. Rotating the secret salt invalidates every stored row by construction, and if the salt is not configured the mechanism disables itself rather than fall back to an unsalted hash.

What we never do: no canvas, font, WebGL or audio fingerprinting, no reading of hardware or system characteristics, and no fingerprinting script of any kind. Neither the extension nor the website probes your browser to identify it. The installation identifier above is a random value we generated, not a measurement of your device, and it is used for this one purpose.

The check fails open: if our database is unreachable your conversion proceeds. If you believe you have been refused wrongly (a shared or reinstalled machine, a second person in one household), contact us and we will clear the device. Legal basis: legitimate interests, Art. 6(1)(f) GDPR, preventing abuse of a free tier. Our balancing rests on the narrowness of the signals, the irreversibility of the stored values, the restriction to free accounts, the fail-open design, and the fact that none of it is used for any purpose beyond this gate. You may object under Art. 21 GDPR.

5.6 Support, reports and the public roadmap

• Contact form: the name, email address, subject and message you type into it.
• Issue reports: category, title, description, priority, the builder involved, an optional source URL, plus your account identifier and email.
• Public roadmap: if you submit an idea we store its title and description, your account identifier, and the name and email address associated with your account. Submitted ideas are shown publicly, including the name attached to them; your email address is not published. If you upvote an idea we store your account identifier against that idea, so that one person votes once. Votes are not published individually.

These are free-text fields we cannot filter. Please do not paste credentials, confidential information, or other people’s personal data into them.

5.7 Version checks

The extension popup asks our backend for the current published version so that it can show you an update notice, and the WordPress plugin does the same for itself (section 7.2). These requests reach our access logs like any other request, with the retention in section 5.8. Nothing about them is written to our database.

5.8 Server and network logs

Cloudflare provides DNS, TLS termination and security filtering in front of our domains, and therefore processes request metadata including your IP address under its own privacy policy. We use no third-party error-monitoring or log-shipping service: no Sentry, no Bugsnag, no external aggregator.

Bunny (BunnyWay d.o.o., Slovenia) serves one thing and only one thing: the WordPress plugin’s installable .zip, from wpgraft.b-cdn.net. Pressing the download button on this site, and your WordPress site fetching an update package, are requests to Bunny rather than to us, so Bunny processes the request metadata (IP address, time, User-Agent) under its own privacy policy. Nothing else on this site is served from it: the pages, the API and the conversion service are all ours.

5.9 Website analytics

Where you have allowed it, our website (not the extension, and not the plugin) sends Google Analytics a measurement event for each page you view: the page path, the page title, the referring URL, your approximate location derived from your IP address, and your browser, device category and language. Google assigns a random identifier, stored in a cookie on your device, so that repeat views within one browser can be counted as one visitor.

The extension sends no analytics event, and no page you copy is measured. Nothing in section 3 or section 7 reaches Google. Section 8 sets out the cookies, the choice you have over them, how to change it, and what we have switched off.

The following is held on your own device by the extension. None of it is transmitted to us, with one exception marked in the table: the installation identifier described in section 5.5.

Uninstalling the extension deletes all of it, the Library included. Nothing in this table is transmitted to us, synced to any account of ours, or recoverable by us. If you clear it, it is gone, and we have no copy to give back. Section 3.5 explains the Library in full.

7.1 What it reads

The plugin has no licence key, no account of its own, and no telemetry. Authentication happens in the extension. To write copied layouts into your builder it reads its own options and your builders’ own data structures (Bricks global classes, Beaver Builder registered fonts, Oxygen class definitions, Breakdance global settings, whether an Elementor Pro licence is present, and the post metadata of the post being edited), and it reads the current user’s WordPress capabilities in order to enforce permissions.

It does not read your visitors’ data, your user table, orders, comments, or form submissions, and it transmits none of that anywhere.

7.2 What it transmits

The plugin contacts us for one purpose only: checking for updates. The request is cached for 12 hours (failures for one hour) and carries your WordPress version and PHP version, used to decide which release to offer and recorded in no database, together with a User-Agent containing the plugin version and your site’s home URL. Your site URL therefore reaches our server on each update check and appears in our access logs under the retention in section 5.8; it is not written to any database. The request carries no licence key, no administrator email and no site content, and update packages are accepted only from an allow-listed host. The package itself is not served by us: the allow-listed host is wpgraft.b-cdn.net, our pull zone at Bunny, so the download is a request from your site to Bunny and its metadata is processed there. See section 11.

7.3 Asset import

When a copy contains images, your WordPress site downloads them directly from the original source into your own media library, gated on the WordPress upload_files capability. That traffic runs from your server to the source site. It does not pass through us and we receive no record of it.

8.1 Every cookie set on this website

The first three are exempt from consent under Article 5(3) of the ePrivacy Directive: they are strictly necessary for a service you asked for, and we disclose them here rather than interrupt you about them. The fourth is not exempt, which is why you are asked.

We set no advertising, marketing or cross-site tracking cookie, and we run no advertising pixel, no Meta pixel, no tag-manager container and no ad tag of any kind. Google Analytics is the only third-party measurement on any wpgraft surface, and it runs on the website only.

8.2 Whether you are asked, and how to change your answer

• In the EEA, the UK and Switzerland you are asked first. Google Analytics does not load, and no analytics cookie is written, until you press a button. Refusing is one click, in the same place, at the same size, as accepting.
• Everywhere else analytics starts on, and Cookie settings in the footer of every page turns it off. If you are covered by EEA or UK law but reached us from elsewhere and were not asked, that link is your refusal and we honour it identically.
• Global Privacy Control is honoured worldwide. If your browser sends the GPC signal we record a refusal without asking you anything, in every country, whether or not local law obliges us to.
• When we cannot tell where you are, we assume you must be asked. An unknown location, or a failure of the check itself, produces the banner and no analytics.
• Your answer is remembered for 6 months, then we ask again. You can change it before then, as often as you like, from the same link. Turning analytics off also deletes the _ga cookies from this browser.

Consent is asked for analytics and nothing else. Refusing has no effect on your account, your plan, the extension, the plugin, or any conversion you run; there is no feature behind it and no reminder afterwards.

8.3 What Google Analytics receives, and what we have switched off

Where it runs, Google receives:

• The page path only, never the query string. Our URLs carry things like ?redirect_url= and an extension identifier, and the standard Google snippet would send them. Ours overwrites the URL with the path before anything is transmitted.
• Page title, referring URL, approximate location derived from your IP address, browser, device category, screen size and language.
• The random cookie identifier in the table above. Nothing else.

Deliberately switched off, and worth naming individually:

• Google Signals: the setting that would let Google join your visit to a signed-in Google profile across sites. Off.
• Advertising features, ad personalisation and remarketing. Off. No Google Ads account is linked to this property, and no audience is exported anywhere.
• User-ID and any identifier of ours. We never send Google your email address, your account identifier, your customer number or any other field that could name you, and we never merge analytics data with your account. Google receives no way to know that two visits are the same wpgraft customer, only that they are the same browser.
• Cross-site tracking. The cookie is first-party to wpgraft.com and is read by nothing else.

Google Analytics keeps two things for two different lengths of time, and they are two separate controls in the Google Analytics admin rather than one:

• Event data: 2 months. This is the shortest the product allows. After that the individual events are deleted and only aggregate reports remain.
• User data: 14 months. This governs the user-scoped record tied to the analytics cookie (how a returning browser is counted as one visitor rather than several), not the individual page views, which are gone at two months.

Google does not log your IP address in Google Analytics 4 reports; it uses it in transit to derive a coarse location and discards it. Refusing analytics, or turning it off later from Cookie settings, stops both of these from being created at all.

8.4 Google’s role, and where analytics data goes

For this measurement we are the controller and Google is our processor, under Google’s Measurement Controller-Controller Data Protection Terms and the Google Ads Data Processing Terms that come with a Google Analytics account. For visitors in the EEA, the UK and Switzerland the contracting Google entity is Google Ireland Limited, in Ireland. Google Ireland transfers the data onward to Google LLC in the United States under the European Commission’s Standard Contractual Clauses; Google LLC is certified under the EU–US Data Privacy Framework and its UK extension. Section 11.1 lists this alongside our other transfers.

What Google does with the data for its own purposes is described in How Google uses information from sites or apps that use our services. We have no ability to make that page say something different, which is the honest reason the choice in 8.2 exists.

8.5 Google Search Console

We use Search Console to see how wpgraft.com appears in Google Search: which queries showed it, how often it was clicked, and which pages Google failed to crawl. It matters to you only in that it is not a tracker:

• It sets no cookie and loads no script. Site ownership is proved by a single <meta name="google-site-verification"> tag, a fixed public string identical for every visitor.
• The reports come from Google’s own search logs, not from your visit. We send Google nothing to produce them.
• The figures are aggregated and anonymous: counts by query, by page and by country. No individual is identifiable in them, and there is nothing about you in there for us to look up.

Because it involves no storage on your device, it needs no consent and appears in no table above. It runs whether or not you allow analytics.

8.6 Other ways to refuse

Beyond the control in our footer: every browser can block or delete cookies for a site, and Google publishes a browser add-on that opts you out of Google Analytics everywhere. Both work here. Blocking us at the network level (an ad blocker, a filtering DNS resolver) breaks nothing: the site, the extension and the plugin are built to work with analytics absent, because that is the state every EEA visitor starts in.

wpgraft contains no artificial intelligence, no machine learning model and no large language model. Conversion is deterministic parsing of document structure and computed styles followed by rule-based mapping into each builder’s schema; the same input produces the same output every time.

• We send your captured content to no AI provider.
• We use your data to train no model, ours or anyone else’s.
• No output of the Service is AI-generated content within the meaning of Article 50 of Regulation (EU) 2024/1689 (the EU AI Act).

For completeness: AI-assisted coding tools were used while writing wpgraft’s source code, in the way an IDE or a compiler is used. That is a development practice and involves no processing of your data.

Where we rely on legitimate interests we have carried out a balancing assessment and will provide a summary on request.

Our database is self-hosted PostgreSQL (Supabase) running on our own Hetzner server in Nuremberg, Germany. It is not a managed cloud service; Supabase, Inc. holds none of your data and has no access to it.

Our conversion service is our own first-party software running on our own server at Nuremberg, Germany, fronted by Cloudflare. It is not a third party, it processes captured content in memory only, and it records nothing.

We use no CRM, no support-desk platform, no error-monitoring vendor and no marketing list provider. Google Analytics is the only measurement vendor, it touches the website alone, and it does not run at all for a visitor who has refused it. Transactional and marketing email is not yet configured; when it is, we will name the provider here before it is used. We will update this table before adding any vendor.

11.1 Transfers outside the EEA

Your data rests in Germany. Two things reach outside the EEA, and they are different in kind.

• Transfers to processors in the United States: Clerk, Google where you choose sign-in with Google, and Google Analytics where you have allowed it (for EEA, UK and Swiss visitors the contracting entity is Google Ireland Limited, which transfers onward to Google LLC). These are transfers within the meaning of Chapter V GDPR and are made under the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Cloudflare operates a global edge network and traffic may be routed through an edge location outside the EEA; Cloudflare is a party to the Standard Contractual Clauses. You may request a copy of the relevant safeguards from [email protected].
• Our own access from Bosnia and Herzegovina. The controller is established in Bosnia and Herzegovina and administers its own servers in Germany from there. Because we are directly subject to the GDPR under Article 3(2), and because a transfer under Chapter V requires a separate exporter and importer, a controller’s own access to its own data is not a restricted transfer. We could not conclude Standard Contractual Clauses with ourselves, and we do not claim to have done so. This follows the European Data Protection Board’s Guidelines 05/2021 on the interplay of Article 3 and Chapter V. The safeguards that do apply are technical: encrypted transport, key-based administrative access with password authentication disabled, and access limited to the sole proprietor.

Captured page content is never transferred anywhere, because it is never stored anywhere.

Before you copy from a domain for the first time, the extension requires you to confirm that you have the right to do so, and there is a one-time acknowledgment when you first use the Service. Both confirmations are stored in your own browser (section 6) and are not transmitted to us. The promise itself is made under our Terms of service and does not depend on them: running a conversion is itself a warranty to us that you have the right to copy that page.

What we hold that is relevant to a complaint is the conversion metadata in section 5.3: which account converted which source URL, and when. Where a rights holder submits a valid complaint, or where we are legally required to do so, we may disclose that record to them or to a competent authority, and we terminate the accounts of repeat infringers. Complaints go to [email protected]; our takedown and repeat-infringer procedures are in section 7 of the Terms, and the rules about what you may copy are in section 6.

If you are in the EEA, the UK or Switzerland you have the right to access your data and receive a copy, to rectify it, to erase it subject to our legal retention obligations, to restrict processing, to data portability, to object to processing based on legitimate interests (including the abuse prevention in section 5.5), to withdraw consent at any time without affecting prior processing, not to be subject to decisions based solely on automated processing producing legal or similarly significant effects, and to lodge a complaint with a supervisory authority.

13.1 California

The CCPA as amended by the CPRA gives California residents rights to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not to be discriminated against for exercising them. We do not sell personal information and we do not share it for cross-context behavioural advertising, and have not done so in the preceding twelve months. The website’s analytics is what makes that statement worth checking rather than assuming, so: Google Signals, advertising features and ad personalisation are switched off, no Google Ads account is linked, no audience is exported, and Google is engaged as our processor. None of that is the arrangement the statute calls a sale or a share. Section 8.3 lists each setting.

We honour Global Privacy Control anyway, worldwide. A browser that sends the signal gets analytics refused before it loads, without being asked anything, in every country, and regardless of whether we would be obliged to read it. Earlier versions of this policy said there was nothing for the signal to act on; now there is, so we act on it.

The categories we have collected in the preceding twelve months, in the statute’s own vocabulary:

Retention for each of the above is in section 14. An authorised agent may make a request on your behalf: send us written permission signed by you, and we will verify it with you directly before acting.

13.2 Elsewhere

Users elsewhere (including under Brazil’s LGPD, Canada’s PIPEDA and Australia’s Privacy Act) have comparable rights. We apply this policy to all users worldwide and will honour any valid request.

13.3 How to exercise them

Write to [email protected]. We are reachable directly wherever you are. We respond within 30 days, extendable by two months for complex requests, in which case we will tell you. We charge no fee unless a request is manifestly unfounded or excessive, and we ask only the minimum information needed to verify your identity. Deleting your account from your account settings triggers the deletion described in section 14.

You may complain to your local supervisory authority. EEA authorities are listed by the European Data Protection Board, in the UK the Information Commissioner’s Office, and in Bosnia and Herzegovina the Agency for Personal Data Protection. We would appreciate the chance to resolve your concern first, but that is not a precondition.

The two rows about your Library are the exception to the sentence below: they are not enforced by a job of ours, because there is nothing of yours on our side to delete. The Library is deleted by you, on your device.

Every other period above except the analytics row is enforced by our own scheduled deletion. The analytics row is enforced by Google, on Google’s infrastructure, from a setting in our account. We can show you the setting, but the deletion is not ours to run.

On account deletion we erase your account record, your token hashes, your conversion metadata and your support content. We keep billing records where tax law requires it, and may keep records necessary for the establishment or defence of legal claims.

We do not profile you and we make no decision about you based solely on automated processing that produces legal or similarly significant effects. The free-tier counter in section 5.5 is an automated usage limit, not a decision about you as a person; if it catches you wrongly, write to [email protected] and we will clear it by hand. There is an override for exactly that.

• All traffic is encrypted in transit with TLS.
• Extension tokens are stored only as SHA-256 hashes.
• Free-tier device signals are stored only as salted hashes; the raw values are never written to storage.
• Requests to non-public network addresses are refused, guarding against server-side request forgery.
• Production access is restricted to the sole proprietor over key-based authentication, with password authentication disabled.
• The extension accepts external messages only from an explicit list of our own named origins (never a wildcard), so no other website can talk to it or reach your session.
• Copies are delivered only to origins you have individually approved, and you can withdraw an approval at any time.
• Captured content is never persisted, so there is no store of it to breach.

No system is perfectly secure. If you believe you have found a vulnerability, write to [email protected]: we welcome responsible disclosure and will not pursue good-faith security research. In the event of a personal data breach likely to result in a risk to your rights and freedoms we will notify the competent supervisory authority within 72 hours of becoming aware of it, as Article 33 GDPR requires, and will notify affected users without undue delay where Article 34 applies.

The Services are not directed to children. You must be at least 16 years old to use wpgraft. We do not knowingly collect personal data from anyone under 16; if you believe we have, write to [email protected] and we will delete it promptly.

In accordance with the Chrome Web Store Developer Program Policies and the Limited Use requirements:

• Our collection and use of data is limited to the practices disclosed in this policy.
• We use the data we collect only to provide and improve the user-facing features described here.
• We do not sell user data, and we transfer it for no advertising, creditworthiness or lending purpose.
• We do not use or transfer user data to serve advertisements, personalised, retargeted or interest-based.
• We do not use user data to train any artificial intelligence or machine learning model.
• The extension contains no analytics, no telemetry and no third-party SDK. The measurement described in section 8 runs on our website only, and never sees a page you copy.
• The extension’s local storage, including the Library of saved copies, is not transmitted to us or to anyone else. It exists to provide the user-facing feature it belongs to, on the user’s own device, and is removed with the extension.
• Human access to user data occurs only with your affirmative consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised for internal operations.

The extension’s use of broad host access is limited to reading the page you explicitly ask it to copy, is requested at runtime from your own click rather than at install, and is revocable by you at any time.

• Store, cache, archive or index the pages you copy
• Upload, read, sync, back up or index your Library: the copies you save stay in your own browser, and we hold nothing to hand over, lose or sell
• Read your cookies, localStorage, sessionStorage or authorization headers
• Capture your passwords or the text you type into forms
• Transmit, execute or convert JavaScript from copied pages
• Attach a debugger to your browser, in the published build
• Record your browsing history or the pages you visit without copying them
• Run any wpgraft code on a site you have not granted access to
• Use any browser-side fingerprinting technique
• Sell, rent or share your personal data
• Serve advertisements or operate advertising trackers
• Turn on Google Signals, advertising features, ad personalisation or remarketing in Analytics, or link it to any advertising account
• Send a query string, an email address or any account identifier of yours to an analytics provider
• Measure anything you copy, or run analytics inside the extension
• Use your data to train any model, or send it to any AI provider

Version 1.9, published 2026-09-02, takes effect the same day. It adds Bunny (BunnyWay d.o.o., Slovenia) to the vendor table in section 11, names it in sections 5.8 and 7.2, and corrects one sentence in section 3.3.

Bunny was already serving the plugin download when this page was published. The plugin’s installable zip has been served from wpgraft.b-cdn.net since the 1.0.0 release on 2026-09-02, and section 11 said we would update that table before adding a vendor. We did not: the vendor went live and the table was updated afterwards. This entry exists because a promise that is missed quietly is worse than one that is missed in writing.

What it does and does not touch. Bunny serves one file, the plugin zip, to anyone who presses download here or whose WordPress site fetches an update. It therefore sees the request metadata for that download: IP address, time and User-Agent. It holds no account of yours, receives nothing you copy, and serves no page, script or API on this site.

Why this is not dated 30 days out. The notice below is owed before a new sub-processor takes effect, and this one already had, which is precisely the failure being recorded here; a date in the future would describe a world that does not exist. What is owed instead is the plain statement above and the correction now in force. Registered users exist as of this version, so the reasoning used in versions 1.4 and 1.5, that there were none to notify, is spent and must not be reused. The next new purpose or sub-processor gets its own date 30 days out and an email that actually goes out.

Section 3.3 is corrected, not changed. It said the extension refuses “any URL that does not resolve to a public internet address”. The guard reads the address in the URL (loopback, private, link-local, cloud metadata and the reserved internal hostname suffixes) and does not perform a DNS resolution, so a public hostname pointed at a private address by an internal resolver is not caught. Nothing about the software changed; the sentence claimed more than the code does, and now says what it does.

Version 1.8, published 2026-08-28, took effect the same day. It withdrew version 1.7, published earlier that day, before that version ever took effect. Polar is our merchant of record, and never stopped being.

Version 1.7 announced that Lemon Squeezy would become the seller for every purchase from 2026-09-27, a date 30 days out, because the notice below is owed to registered users before a new sub-processor. That plan was abandoned the same day it was published. The announced date never arrived, no purchase was ever taken through the other provider, and none of your data reached it. Sections 5.1, 5.4 and the vendor table in section 11 read as they did before 1.7, and so do Terms and the Refund Policy.

This one needs no notice period, and that is not a shortcut. A notice period exists to warn people before something new happens to their data. Nothing new happened: the arrangement described here is the one that was already in force. Running out a 30-day clock for a change that was cancelled would be ceremony rather than protection. The withdrawn version is recorded here rather than deleted, because an announcement that quietly vanishes is worse than one withdrawn in writing, and you may still ask us for the superseded text.

Version 1.6, published 2026-08-25, corrected a retention figure that version 1.5 got wrong earlier the same day. Section 8.3 described retention at Google as a single setting of 2 months. It is two settings: event data is kept for 2 months, and user-level data for 14. Nothing about the configuration changed: the sentence describing it was wrong, and it understated how long Google keeps something, so it is corrected here rather than edited out. The claim that our figure was “shorter than the default” is also gone: Google does not publish a default for a new property, so it was not ours to assert.

Version 1.5, published the same day, brought the Google Analytics measurement introduced in version 1.2 into force. That change was published on 2026-08-22 with an effective date of 2026-09-21; version 1.5 moved that date to 2026-08-25, and section 8 is now a description of what runs rather than of what will run.

Nothing about what it does has changed. Section 8 has set it out in full since 2026-08-22 and still does, down to the query strings we strip before Google sees a URL, the advertising features we have switched off, and the 13-month cookie. Only the start date moved. Section 8.1 says plainly which earlier commitment version 1.2 reverses.

Why we may move it. The 30-day notice below is a promise to registered users, and wpgraft has none in any meaningful sense: it has not launched, has never sold a subscription, and every account on the system was created during development, before this change was announced (checked 2026-08-28). A notice period exists to give people time to react, and running out a clock nobody is watching would protect nobody while leaving this page promising something we no longer intend to do. If you hold an account and were not emailed about this, we got that judgement wrong and want to hear about it: [email protected]. Any future new purpose or sub-processor gets its own date 30 days out and an email that actually goes out.

What did not change with the date: in the EEA, the UK and Switzerland nothing is measured unless you say yes, and everywhere else Cookie settings in the footer of every page turns it off at any time. Refusing costs you nothing.

Version 1.4 documented the free tier’s device rule(one free account per device, described in full in section 5.5) and the random installation identifier the extension sends so that “device” can mean one browser profile rather than everyone sharing an IP address. That identifier is a new thing reaching us, so it was said plainly rather than folded into an existing sentence. It exists for this one gate and for keeping your extension token on one computer: it is not used for analytics, advertising or tracking you between sites, and no website can read it. It took effect on publication because there were no free accounts to give notice to.

Version 1.3 documented the extension’s Library: the HTML and CSS of copies you choose to keep, stored on your own computer (sections 3.5, 6 and 14). It took effect on publication because nothing about it reaches us at all: the Library never leaves your device.

We may update this policy as the Services develop; the version number and effective date at the top of this page change with it. For material changes (a new category of data, a new purpose, a new sub-processor, or any reduction in your rights), we will notify registered users by email at least 30 days before the change takes effect, and where a change requires your consent we will obtain it first. Previous versions are available from [email protected] on request.

[email protected]: privacy enquiries, rights requests and product support all reach the same mailbox. We aim to answer privacy enquiries within five business days and formal rights requests within 30 days.

Controller: Računarsko programiranje GUGUNOVIĆ Saša Gugunović s.p. Kozarska Dubica, JIB 4513290400009, Kodunaška 4, Kozarska Dubica, Bosnia and Herzegovina. There is no separate EU or UK contact point. The controller is reachable directly at the address and the mailbox above.