Privacy Policy

Last updated 25 October 2026 · CloWebs

This policy explains what personal data we collect when you use CloWebs, why we use it, how long we keep it and what your rights are.

1. Who is responsible for your data

CloWebs is the controller of the personal data described here. Our address is United Kingdom. For any privacy question or request, email [email protected].

2. What we collect

Your account

• Your email address, and your name if you add it.
• A password hash if you set a password (we never store the password itself).
• Your email preferences.
• Sign-in history: date and time, IP address, browser details and the sign-in method.

Sites you connect

• The site’s address and name.
• The versions of WordPress, Elementor and the plugin, and when the site last contacted us.
• A key the plugin signs its requests with, stored encrypted (sites connected with an older plugin version: a connection token, stored only as a one-way hash).
• For imports, what they need to know about the site: its theme, installed plugins, Elementor’s settings and widgets, whether your user may install plugins, and the IDs and titles of the pages, posts, templates, terms and menus the import made or matches.

The plugin doesn’t send us your site’s users or orders.

Consent records

Each time you start an import, we store your account, the site, the reference URL, the text and version of the statement you confirmed, the date and time, your IP address and your browser details.

Import history

The reference URLs and page titles you import, the status of each page, warnings, credits used, and the ID and edit link of the page created on your site. For full-site imports, we store how many posts, products, terms, menus and images were imported.

Copied website content

When you import, our service loads the reference pages you chose, with their stylesheets and images, and, for a full-site import, the reference site’s posts, pages, products, terms and menus. It identifies itself as SiteScrapper, naming your site as the one it fetches for, and follows each site’s robots.txt. We keep these copies and the converted pages until your site has imported them, and delete them after the time in the table below. This content comes from the reference site, so it can contain personal data that appeared there, such as names or photos. We use it only to convert and import it for you and to investigate problems or complaints.

Billing

• Your orders: plan, amount, discount, date and status.
• Billing details you add: name, company, VAT number, address and country.
• Payments are handled by Stripe. You enter your card details on Stripe’s page, and we don’t receive or store your full card number. Stripe tells us the payment result and a reference for it.

Support and reports

• Support tickets and the messages in them.
• If you send a copyright or abuse report: your name, email address, the URL you report and your description.

Cookies

We only use cookies that the site needs to work: a session cookie that keeps you signed in, and a cookie that remembers whether you chose the light or dark theme. We don’t use advertising cookies.

3. Why we use it and our legal basis

We don’t sell your personal data, and we don’t use it for automated decisions that have legal or similarly significant effects on you.

4. How long we keep it

5. Who we share it with

We use a small number of service providers (sub-processors) who process data for us under contract:

• Stripe, for payments and fraud checks.
• An email delivery provider, to send codes, sign-in links, receipts and notices.
• Hosting and infrastructure providers, for the servers, database and storage that run the service.

We may also share data when the law requires it, to protect our rights or other people’s, or with a company that takes over the service. When we handle a copyright report, we don’t give your details to the person who reported unless the law requires it or you agree.

6. International transfers

Some providers may process data outside the UK. When they do, we rely on UK adequacy regulations or on safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Security

We use HTTPS for all traffic, and every request between the plugin and our service is signed. Passwords are stored as strong one-way hashes. One-time codes and older connection tokens are stored only as hashes, and signing keys and license keys are encrypted. Access to customer data is limited to staff who need it, and staff actions are logged.

8. Your rights

Under UK GDPR you have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted, where we don’t need to keep it;
• restrict or object to how we use it, including at any time for marketing;
• receive the data you gave us in a portable format;
• withdraw consent where we rely on it.

To use these rights, email [email protected] from the address on your account. We reply within one month. You can update your details and email preferences in the dashboard. An account with no purchases can be deleted from the dashboard; see Account, billing and invoices.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner’s Office at ico.org.uk. If you live in the EU, you can contact your local data protection authority.

9. Children

The service is not meant for anyone under 18, and we don’t knowingly collect their data.

10. Changes to this policy

We will update this page when our practices change. If a change is significant, we tell you by email or in the dashboard before it applies.