TW Form Guard Privacy Policy

In one table

Who is responsible for what

For form submissions on your WordPress site, you are the controller in every configuration. What changes with the AI backend is our own role:

• Your own provider key ("Use my own AI provider"): StoreFixKit is not a processor of the submission content at all. The plugin is software running on your server; the request goes from you to the provider you chose. We receive nothing, so there is nothing for us to process, and we add no sub-processor to your data flow. The provider you configured is your processor (or, depending on their terms, an independent controller) under your contract with them. Our DPA does not apply to that path because there is no processing by us to cover.
• Hosted judging (Premium): StoreFixKit is your processor, acting on your instructions (the settings you choose), with the model provider as our sub-processor. That is what the data processing agreement sets out.
• Your own account data (checkout, license, support) — StoreFixKit is the controller, in every configuration.

The plugin's settings page states, next to the AI judge switch, exactly what turning it on sends and to whom. The switch is off after installation. If your form collects data from people in the EU, UK or other jurisdictions with transfer rules, add whichever AI provider you actually use to your own privacy notice before switching it on; see international transfers.

Free plugin data (stays on your site)

TW Form Guard writes a log table in your own WordPress database. For each Elementor Pro form submission it stores: verdict, reasons, the sender's name, email address and message as submitted, the visitor's connection address, the page the form was on, and the time. Popup source pages are recorded through Elementor's own referrer metadata. The plugin never modifies your Elementor submission tables.

• Retention: you choose it under Settings (default 90 days; 0 keeps rows forever). A daily task deletes older rows.
• Visitor address: by default the plugin records the direct connection address. It only trusts proxy headers such as CF-Connecting-IP when you switch on "Site is behind a trusted proxy".
• Rights requests: the plugin registers with WordPress' built-in privacy tools, so Tools → Export Personal Data and Erase Personal Data include TW Form Guard rows for a given email address.
• Uninstall: removes the log table, every plugin option and every cached value on each site of a network.

The free build contains no address of ours: it does not check for updates, does not verify anything, and does not send a single request to StoreFixKit. The only outbound request it can make at all is the one you configure yourself in the next section, and that one goes to your provider.

AI judge on your own provider key — we are not in the path

This section covers the backend called "Use my own AI provider", which is available in every build including the free one, and is off until you switch it on and enter your own credentials.

When it is on, a submission that the traps and rules could not decide is posted by your own web server, over https, to the Base URL you entered, authenticated with the API key you entered. The request contains the sender's name, the email address as typed, and the message text cut to 1,500 characters. It does not contain the visitor's IP address, your other form fields, uploaded files, or anything about your WordPress users.

• Your contract is with your provider. Whatever they say about retention, logging, human review and model training applies to your enquiries, and their published policies govern. We make no representation about any provider's behaviour — read the terms of the one you pick, and add them to your own privacy notice and records of processing.
• Your key stays on your site. It is stored in your WordPress database sealed with your site's own salts, is never transmitted to us, and appears in no log of ours.
• A model you host yourself (Ollama, vLLM, LM Studio behind an https address your server can reach) keeps the text inside your own network entirely. That is the strictest option this plugin offers.
• Only https endpoints are accepted, so the key and the message are not sent in clear text.
• On your site nothing changes: the log row, its retention and the WordPress export and erase tools work exactly as described above.

Premium license data

When you activate a license the plugin sends the license key and your site's host name to guard.storefixkit.com. We store the key as a hash, the last characters of the key for support, a hash of the bound host name, the checkout email, and Stripe identifiers. Roughly every 12 hours the plugin re-checks the license state; each check carries the key, host name and plugin version and is signed with a per-license secret. Our web server logs the request time and your server's address, not your visitors' addresses.

Activation attempts, deactivations, and quota counts per calendar month are stored per license. These records contain no form content. They are kept for the life of the license plus 24 months for accounting and dispute purposes.

Hosted AI judge data (Premium, off by default)

This section covers only the backend called hosted judging, where we run the model call for you. It does not apply if you chose "Use my own AI provider" — see the section above, where none of this happens because nothing reaches us.

With hosted judging on, the plugin sends a submission to our relay only when the invisible traps and the rules found nothing to decide on, the sender is not on your trusted list, and the plugin's own rate limits allow it. The request contains:

• the message text, cut to 1,500 characters;
• the sender's name and email address as typed into the form;
• your license key, site host name, a timestamp and a one-time nonce, with an HMAC signature.

It does not contain the visitor's IP address, other form fields, uploaded files, or anything about your WordPress users.

On the relay the content is held in memory for the length of the request. The relay formats name, email and message into a short text, sends it with a fixed instruction to the model provider, and returns spam, ham or null to your site. Nothing else the model says is ever forwarded. The relay writes a log row per request containing license id, time, verdict, latency and token counts; it writes no name, email or message to disk. Nonce hashes are kept for ten minutes to prevent replay. The plugin caches the verdict for 24 hours on your site so an identical resubmission is not sent again.

Model provider: Hangzhou DeepSeek Artificial Intelligence Co., Ltd. ("DeepSeek"), Hangzhou, China, through its Open Platform API. DeepSeek receives the formatted text and returns a one-word answer. Under DeepSeek's Open Platform Terms of Service (effective 29 April 2026) the developer keeps rights in submitted inputs, and DeepSeek's consumer privacy policy expressly does not cover end-user data processed through developer applications; the developer is the controller and must inform end users. This page is that notice for TW Form Guard.

Sources, read on 2 September 2026: DeepSeek Open Platform Terms of Service (section 4.2 "Inputs and Outputs", section 5.5 on downstream end users); DeepSeek Privacy Policy (last updated 10 February 2026); Model Mechanism and Training Methods of DeepSeek.

Minimisation. The relay also supports a reduced mode that forwards only the message text and the domain part of the email address. On our September 2026 benchmark that mode kept every genuine enquiry (19/19) but caught one to two fewer spam messages per 69, so the full mode is what ships today. If you need the reduced mode for your own compliance position, ask us and we will enable it for your licence; this page will name the mode your licence uses.

Checkout and billing data

Premium is sold through Stripe Checkout. You enter your name, email and payment method (card, or Alipay / WeChat Pay for the yearly plan) on Stripe's pages under Stripe's privacy policy. Stripe sends us the checkout session id, your email and name, the plan, and later subscription events (paid, failed, canceled, refunded, disputed). We never receive or store card numbers or wallet credentials. Billing records are kept for as long as tax and accounting law requires.

Emails we send

We email the license key after checkout, and later only about the license itself: a failed renewal, an activation conflict, a suspension for abuse, or a security notice. These are sent through Google's Gmail SMTP service. We do not send newsletters from this address and we do not share your email with anyone for marketing.

This website

guard.storefixkit.com sets no cookies and loads no analytics or third-party scripts. The language switch on the home page stores your choice in your browser's local storage only. Our web server keeps standard access logs (address, time, page, user agent) for security and capacity purposes for up to 30 days.

Sub-processors

These are the providers we use, for hosted judging and for our own account data. If you run the AI judge on your own provider key, we add no sub-processor to your data flow at all — the provider you configured is yours, engaged by you under your own contract, and it does not appear here because it is not ours to engage or to name.

We will update this table before adding a sub-processor that receives form content, and note the change in the changelog.

International transfers

Hosted judging. The relay runs in the United States and forwards form content to a model provider in China. If your site collects data from people in the EU, UK or Switzerland, this is a transfer to countries without an adequacy decision. We do not currently hold Standard Contractual Clauses with the model provider. Until we do, we recommend that sites subject to GDPR or UK GDPR keep hosted judging off, or switch it on only after documenting their own transfer assessment and updating their privacy notice.

Your own provider key. There is no transfer to us, so nothing here is ours to assess: the destination is the endpoint you chose, and any transfer question is between you and that provider. This is also the setting that lets you avoid a transfer entirely — pick a provider in your own jurisdiction, or run the model on your own hardware, and the text never leaves it.

The traps and rules layers need no transfer at all, in any configuration.

Retention summary

• Submissions judged on your own provider key: never on our systems in the first place, so we hold nothing to retain. Ask your provider about theirs.
• Form content on the relay (hosted judging): memory only, discarded when the request ends.
• Judgement log rows on the relay (no content): 13 months, for quota and abuse investigation.
• Nonce hashes: 10 minutes. Rate-limit counters: the current window only.
• License, activation and Stripe event records: life of the license plus 24 months.
• Support emails: 24 months after the last message.
• Web-server access logs: up to 30 days.
• Your own plugin log: your retention setting, on your server.

Your rights and contact

For data about a person who submitted a form on your site, use the WordPress privacy tools on your site; nothing about that person exists on our side after a hosted request ends, and nothing ever existed on our side if you used your own provider key. For your own license and billing data, email support@storefixkit.com from the checkout address to access, correct, export or delete it, or to ask a question about this policy. We answer within 30 days. EU and UK residents may also complain to their supervisory authority.

Changes

We change this policy when the data flow changes, for example when the minimised AI mode goes live or when a sub-processor of ours changes. Material changes are dated here and listed in the changelog. We will not widen what the AI judge sends without announcing it first on this page and in the plugin's release notes.