Privacy Policy

1. Introduction

This Privacy Policy explains what data Respira for WordPress collects, what stays on your WordPress site, how we use data, and your GDPR rights.

We aim to keep this policy clear and practical.

2. Data Flow at a Glance

2.1 What Stays on Your WordPress Site

• Your actual page/post content and code.
• Your database content and most site-specific data.
• Theme and plugin internals unless explicitly transmitted by your own actions.

2.2 What We Collect

• Account identifiers (such as email).
• License and plan data for paid accounts.
• Site connection metadata (for licensing and account management).
• Operational telemetry (for example, counts of actions and diagnostics).

2.3 Third-Party AI Services

If you connect AI tools (such as Claude, Cursor, Windsurf, or similar), prompts/content you send to those services are handled under their terms and privacy policies, not ours.

You control what you send and are responsible for complying with those third-party AI service terms.

3. Information We Collect

3.1 Information You Provide

• Account details (email and profile details you choose to provide).
• License and billing identifiers for paid plans.
• Site URL and activation metadata needed to manage your plan.

3.2 Automatically Collected Information

• Usage telemetry (for example counts of page/post operations and similar aggregate signals).
• Error and diagnostics logs needed to keep the service reliable and secure.
• Security and access logs for abuse prevention.

4. How We Use Information

• Provide authentication, licensing, and account features.
• Operate and improve platform reliability and support.
• Detect abuse, fraud, and security issues.
• Provide customer support and critical service communications.
• Meet legal and regulatory obligations.

5. Processors and Third-Party Services

We use trusted service providers to run Respira. These providers process data on our behalf for specific purposes:

• Supabase — Authentication, database, and related infrastructure.
• Lemon Squeezy — Payment processing and license commerce workflows.
• Sentry — Error monitoring and diagnostics.
• Vercel — Hosting and runtime infrastructure.

Analytics may also be processed by tools enabled in the product stack (for example GA4 or Vercel Analytics), based on your consent/settings where applicable.

This processor list may change as infrastructure evolves. When it changes materially, this policy will be updated.

6. Data Retention

We keep personal and operational data only as long as needed for service delivery, security, legal obligations, and legitimate business operations.

• Lite (launching soon): Planned shorter telemetry/audit retention windows where applicable.
• Paid plans: Extended retention for operational history where applicable.

Retention periods can be adjusted for legal compliance, fraud prevention, or support obligations.

7. Your Rights (GDPR and Similar Laws)

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or export your personal data.

To request deletion or exercise your rights, email word@respira.press.

We aim to respond within 30 days for standard GDPR requests, unless a lawful exception applies.

8. Security

We use technical and organizational safeguards to protect data in transit and at rest.

No system is perfectly secure. You are also responsible for securing your own devices, WordPress admin accounts, API keys, and hosting environment.

9. Cookies and Tracking

Respira groups every cookie and tracking technology into four categories. EU / EEA / UK visitors see a consent widget at the bottom-right of the screen before any non-essential category fires; visitors outside that region can open the same widget at any time via the "Cookie preferences" link in the footer.

• Essentials — always on. Supabase auth tokens (sb-*-auth-token), affiliate attribution (respira_aff, ls_aff), and the session middleware that keeps you signed in. These can't be switched off because the site wouldn't work without them.
• Analytics — opt-in. Google Analytics 4 (_ga, _ga_F55E0B1KNX) on every page plus PostHog (ph_*) on dashboard pages only. Anonymous-ish session counts so we can tell which pages work.
• Attribution — opt-in. The respira_acq first-touch cookie plus an ai-referral flag. Tells us whether a chatbot, newsletter, or post brought you here, without tying it to identifiable session data.
• Messaging — opt-in. Customer.io (_cio*) for in-app messages and Chatwoot (cw_*) for live chat support. Off by default; on means we can answer you in the app.

The complete sub-processor list with regions, retention, and data-processing addenda lives at /trust-center. Manage your choices any time via the footer link or directly through your browser.

10. International Transfers

Where data is transferred across borders, we use appropriate safeguards required by applicable law.

11. Children

The service is not intended for children under 18, and we do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this policy over time. Material updates are published on this page with a new "Last updated" date.

13. Contact

Service provider: Respira for WordPress, operated by Mihai Dragomirescu (Brașov, Romania).

• Email: word@respira.press
• Website: https://www.respira.press