TW Form Guard Privacy Policy

In one table

Who is responsible for what

For form submissions on your WordPress site, you are the controller and StoreFixKit is a processor acting on your instructions (the settings you choose). Our data processing agreement sets this out and lists sub-processors. For your own account data (checkout, license, support), StoreFixKit is the controller.

The plugin's settings page states, next to the AI judge switch, exactly what turning it on sends and to whom. The switch is off after installation. If your form collects data from people in the EU, UK or other jurisdictions with transfer rules, add the AI judge and its provider to your own privacy notice before switching it on; see international transfers.

Free plugin data (stays on your site)

TW Form Guard writes a log table in your own WordPress database. For each Elementor Pro form submission it stores: verdict, reasons, the sender's name, email address and message as submitted, the visitor's connection address, the page the form was on, and the time. Popup source pages are recorded through Elementor's own referrer metadata. The plugin never modifies your Elementor submission tables.

• Retention: you choose it under Settings (default 90 days; 0 keeps rows forever). A daily task deletes older rows.
• Visitor address: by default the plugin records the direct connection address. It only trusts proxy headers such as CF-Connecting-IP when you switch on "Site is behind a trusted proxy".
• Rights requests: the plugin registers with WordPress' built-in privacy tools, so Tools → Export Personal Data and Erase Personal Data include TW Form Guard rows for a given email address.
• Uninstall: removes the log table, every plugin option and every cached value on each site of a network.

The free build contains no address of ours: it does not check for updates, does not verify anything, and does not send a single request to StoreFixKit.

Premium license data

When you activate a license the plugin sends the license key and your site's host name to guard.storefixkit.com. We store the key as a hash, the last characters of the key for support, a hash of the bound host name, the checkout email, and Stripe identifiers. Roughly every 12 hours the plugin re-checks the license state; each check carries the key, host name and plugin version and is signed with a per-license secret. Our web server logs the request time and your server's address, not your visitors' addresses.

Activation attempts, deactivations, and quota counts per calendar month are stored per license. These records contain no form content. They are kept for the life of the license plus 24 months for accounting and dispute purposes.

AI judge data (Premium, off by default)

With the AI judge on, the plugin sends a submission to our relay only when the invisible traps and the rules found nothing to decide on, the sender is not on your trusted list, and the plugin's own rate limits allow it. The request contains:

• the message text, cut to 1,500 characters;
• the sender's name and email address as typed into the form;
• your license key, site host name, a timestamp and a one-time nonce, with an HMAC signature.

It does not contain the visitor's IP address, other form fields, uploaded files, or anything about your WordPress users.

On the relay the content is held in memory for the length of the request. The relay formats name, email and message into a short text, sends it with a fixed instruction to the model provider, and returns spam, ham or null to your site. Nothing else the model says is ever forwarded. The relay writes a log row per request containing license id, time, verdict, latency and token counts; it writes no name, email or message to disk. Nonce hashes are kept for ten minutes to prevent replay. The plugin caches the verdict for 24 hours on your site so an identical resubmission is not sent again.

Model provider: Hangzhou DeepSeek Artificial Intelligence Co., Ltd. ("DeepSeek"), Hangzhou, China, through its Open Platform API. DeepSeek receives the formatted text and returns a one-word answer. Under DeepSeek's Open Platform Terms of Service (effective 29 April 2026) the developer keeps rights in submitted inputs, and DeepSeek's consumer privacy policy expressly does not cover end-user data processed through developer applications; the developer is the controller and must inform end users. This page is that notice for TW Form Guard.

Sources, read on 2 September 2026: DeepSeek Open Platform Terms of Service (section 4.2 "Inputs and Outputs", section 5.5 on downstream end users); DeepSeek Privacy Policy (last updated 10 February 2026); Model Mechanism and Training Methods of DeepSeek.

Minimisation. Our relay supports a mode that forwards only the message text and the domain part of the email address to the provider. We are validating on our benchmark that it keeps the same zero-false-positive result before switching it on; this page will say so when it is active.

Checkout and billing data

Premium is sold through Stripe Checkout. You enter your name, email and payment method (card, or Alipay / WeChat Pay for the yearly plan) on Stripe's pages under Stripe's privacy policy. Stripe sends us the checkout session id, your email and name, the plan, and later subscription events (paid, failed, canceled, refunded, disputed). We never receive or store card numbers or wallet credentials. Billing records are kept for as long as tax and accounting law requires.

Emails we send

We email the license key after checkout, and later only about the license itself: a failed renewal, an activation conflict, a suspension for abuse, or a security notice. These are sent through Google's Gmail SMTP service. We do not send newsletters from this address and we do not share your email with anyone for marketing.

This website

guard.storefixkit.com sets no cookies and loads no analytics or third-party scripts. The language switch on the home page stores your choice in your browser's local storage only. Our web server keeps standard access logs (address, time, page, user agent) for security and capacity purposes for up to 30 days.

Sub-processors

We will update this table before adding a sub-processor that receives form content, and note the change in the changelog.

International transfers

The relay runs in the United States. The AI judge sends form content to a provider in China. If your site collects data from people in the EU, UK or Switzerland, this is a transfer to countries without an adequacy decision. We do not currently hold Standard Contractual Clauses with the model provider. Until we do, we recommend that sites subject to GDPR or UK GDPR keep the AI judge off, or switch it on only after documenting their own transfer assessment and updating their privacy notice. The traps and rules layers need no transfer at all.

Retention summary

• Form content on the relay: memory only, discarded when the request ends.
• Judgment log rows (no content): 13 months, for quota and abuse investigation.
• Nonce hashes: 10 minutes. Rate-limit counters: the current window only.
• License, activation and Stripe event records: life of the license plus 24 months.
• Support emails: 24 months after the last message.
• Web-server access logs: up to 30 days.
• Your own plugin log: your retention setting, on your server.

Your rights and contact

For data about a person who submitted a form on your site, use the WordPress privacy tools on your site; nothing about that person exists on our side after the request ends. For your own license and billing data, email support@storefixkit.com from the checkout address to access, correct, export or delete it, or to ask a question about this policy. We answer within 30 days. EU and UK residents may also complain to their supervisory authority.

Changes

We change this policy when the data flow changes, for example when the minimised AI mode goes live or when the provider answers the training question. Material changes are dated here and listed in the changelog. We will not widen what the AI judge sends without announcing it first on this page and in the plugin's release notes.