Privacy Policy

This website and the Attributes User Access plugin are operated by Codex Riverain S.E.N.C., a partnership registered in Quebec, Canada. Throughout this policy, “we”, “us” and “our” mean that company.

Because we are established in Quebec, we are subject to Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and to Canada’s PIPEDA. Where you are in the United Kingdom or the European Economic Area, the UK GDPR and the GDPR apply to you as well, and this policy is written to respect them.

It is a short list, and the shortest part of it is worth stating first.

What this website does not do

This site runs no tag manager and no session recording, and every font and asset is served from our own domain. It asks you two questions, described under Cookies & Tracking: may it measure its audience with Google Analytics, and may it measure its ads with Meta’s pixel. Until you allow one, it sets no cookies, and loading a page makes no request to any third party and gives no third party the chance to observe you.

What Google receives, if you allow audience measurement

Only if you allow it, your browser sends Google, directly:

• check_circle
  Which pages of this site you view, when, and the page you came from.
• check_circle
  How far you scroll and which links out of the site you follow — what Google calls enhanced measurement.
• check_circle
  Your browser and device details, and your IP address, from which Google estimates your city and country; Google states that Analytics does not store IP addresses.
• check_circle
  Google’s cookie identifier for your browser.

What Meta receives, if you allow advertising

Only if you allow it, your browser sends Meta, directly:

• check_circle
  Which pages of this site you view, when, and the page you came from.
• check_circle
  The buttons you press and the descriptive information a page carries, such as its title — what Meta calls automatic events.
• check_circle
  Your IP address and your browser and device details, as with any request.
• check_circle
  Meta’s cookie identifiers for your browser and, if you arrived from one of our ads, for that ad click.
• check_circle
  If you then use the support form, your email address in hashed (scrambled) form, which Meta matches against its own accounts — what it calls automatic advanced matching.

What you give us, when you choose to

The support form is the only place on this site that asks you for anything. If you use it, you provide:

• check_circle
  Your name, as you enter it.
• check_circle
  Your email address, so a reply can reach you.
• check_circle
  The subject category you pick, and the message you write.

When you submit it, your message is sent to our support mailbox as ordinary email, with your address as the one a reply goes to. This site keeps no copy: it passes the message to our WordPress site, which sends it through our email provider, and from then on it is support correspondence, kept as described under How Long We Keep It. If sending fails, the form hands the message back to your own email client instead, pre-filled, and nothing reaches us until you send it yourself.

What the server sees in passing

To stop a script from hammering the form, the server keeps a short-lived list in memory of which IP addresses have submitted recently — five submissions per ten minutes are allowed. Entries expire on their own and the list does not survive a restart. It is never written to disk and never linked to anything else about you.

Our hosting provider, like any web host, keeps its own server logs. Those are operational records held by that provider under its own retention rules.

We use what you send us for these purposes and no others:

• check_circle
  To answer your request and diagnose the issue you report.
• check_circle
  To manage your account and licence, where you hold one, including activation and the sites you have registered.
• check_circle
  To send you service email you have asked for or that your purchase requires — updates and security notices, not marketing.
• check_circle
  To keep the service working: to maintain, secure and improve the plugin.
• check_circle
  If you allow audience measurement: to see which pages people use and where they give up, and to improve them.
• check_circle
  If you allow advertising: to measure which of our ads bring visitors and buyers, and to let Meta show our ads to you and to people with similar interests.

We do not sell your personal information. Apart from Meta’s pixel, and only if you allow advertising, we disclose none of it for advertising — ours or anyone else’s. We do not make decisions about you by automated means alone.

If you allow audience measurement, Google’s script loads from www.googletagmanager.com and sets two cookies on attributeswp.com:

• check_circle
  _ga identifies your browser to Google Analytics. It lasts 13 months.
• check_circle
  _ga_ followed by an identifier keeps track of your visit. It lasts 13 months.

If you allow advertising, Meta’s script loads from connect.facebook.net and sets two cookies on attributeswp.com:

• check_circle
  _fbp identifies your browser to Meta. It lasts 90 days and is renewed on each visit.
• check_circle
  _fbc is set only when you arrive from one of our ads, and records that ad click. It lasts 90 days.

If you allow either, Google Tag Manager also loads from www.googletagmanager.com. It is a loader: on its own it sets no cookie and collects nothing about you. It starts only tools named on this page, each under the answer that covers it, and is told your answers so that it can.

Whatever you answer, one more cookie keeps your answers, so that you are not asked on every page: attrwp_consent, which holds nothing but your two yes-or-no answers. It lasts six months, after which you are asked again.

All these cookies are set on attributeswp.com, so our WordPress site at user.attributeswp.com — where you sign in, manage your account and buy a licence — reads them too. It asks the same two questions with the same banner, and an answer given on either site holds on both. With advertising allowed there, a purchase is also reported to Meta by our server — the order number, the amount and the currency, your IP address, your browser details and Meta’s cookie identifiers, with your email address and name in hashed form — so that it is counted even when a browser blocks the pixel.

You can change your answers at any time: Privacy choices, at the bottom of every page, asks the questions again. Withdrawing stops the tool at once and deletes its cookies. What Google or Meta has already received, it keeps under its own privacy policy — Google’s and Meta’s.

Should we ever add anything else — another tool, another advertising network — this section will say so before it happens, and it will ask you first, as these do.

Apart from Google and Meta, and only as far as you allow them, we share your personal information with nobody for their own purposes. It is passed on only in these circumstances:

• check_circle
  Google, if you allow audience measurement: your browser sends it what is listed under What We Collect, and Google processes it to produce our Analytics reports.
• check_circle
  Meta Platforms, if you allow advertising: your browser, and at checkout our server, sends it what is listed under What We Collect. Meta uses it to measure and deliver our ads, and also for purposes of its own, under its own privacy policy.
• check_circle
  Service providers who run parts of our operation on our behalf — hosting, email delivery, and the payment and licensing provider — each bound to use it only for the service they provide us.
• check_circle
  Where the law requires it: a court order, a lawful request from a public authority, or the defence of a legal claim.
• check_circle
  To a successor entity, if the business is ever sold or reorganised, under the same commitments as this policy.

Purchases and licences for the Pro plugin are handled by our commerce and licensing provider, which processes the payment and holds the order record. We never see or store your full card details.

We keep personal information only as long as the purpose it was collected for requires, and then for whatever period the law obliges us to.

You may ask us to delete your personal information at any time, and we will do so except where the law requires us to keep it.

Whatever your jurisdiction, you may ask us to:

• check_circle
  Tell you what personal information we hold about you, and give you a copy.
• check_circle
  Correct anything inaccurate or incomplete.
• check_circle
  Delete it, where we have no overriding legal reason to keep it.
• check_circle
  Stop or limit a particular use, including withdrawing a consent you gave earlier.
• check_circle
  Receive it in a structured, commonly used format, or have it sent to another organisation.

Write to support@attributeswp.com and we will answer within 30 days. Exercising these rights costs nothing and we will not treat you differently for it.

If our answer does not satisfy you, you may complain to the Commission d’accès à l’information du Québec, to the Office of the Privacy Commissioner of Canada, or to your own supervisory authority if you are in the UK or the EEA.

We are based in Canada and your information is handled there. Some of the providers we rely on operate servers elsewhere, which means your information may be stored or processed outside your country, including in the United States. What you allow Google Analytics and Meta’s pixel to collect, your browser sends to them directly, and they process it in the United States and elsewhere.

Where we transfer personal information out of Quebec, we assess beforehand whether it will receive adequate protection, as Law 25 requires, and we use contractual safeguards — standard contractual clauses where those apply — to hold the recipient to it.

Everything travelling between your browser and this site is encrypted in transit over HTTPS. Access to what we hold is limited to the people who need it to do their work.

The strongest protection here is structural rather than technical: this site stores almost nothing. There is no visitor database, no analytics warehouse and no message archive, so there is very little to lose.

We should still be honest about the limit. No method of transmission over the internet and no method of electronic storage is completely secure, and we cannot guarantee absolute security. If a breach ever affects your personal information and presents a risk of serious injury, we will notify you and the appropriate authorities as the law requires.

This is a product for people who build and run websites, and it is not directed at children. We do not knowingly collect personal information from anyone under 14. If you believe a child has given us their information, write to us and we will delete it.

We may update this policy. The date at the top is the date of the current version. If a change materially affects how we handle your personal information, we will say so prominently rather than rely on you noticing the date.