This AddoCore privacy policy explains which personal data we process when you visit addocore.com, create an account, order a product or use our software, why we do that, who receives it and what rights you have under the General Data Protection Regulation (GDPR).
Who is responsible for your data
The controller for the processing described here is:
- Name: AddoCore (addocore.com), part of Digibitz
- Email: [email protected]
- Chamber of Commerce (KvK): 73075906
- VAT number: NL002275766B20
For questions about your data or to use your rights, email [email protected].
What we process, why, and on what legal basis
Account, orders and invoices
When you create an account or place an order, we process your name, email address, billing address, company name and VAT number (if you enter them), your order history, the invoices we send and the messages we exchange with you. We use this to deliver your order, run your account and subscriptions, send service emails (order confirmations, invoices, renewal reminders, payment-failed notices and trial reminders) and comply with our tax and accounting obligations.
Legal basis: performance of the contract (art. 6(1)(b) GDPR) and our legal obligation to keep accounting records (art. 6(1)(c) GDPR).
Payments
Payments are handled by Mollie. We receive the payment status, a Mollie customer reference and, for subscriptions, a reference to the payment mandate and the type of payment method. Mollie processes your payment details (for example card or bank account details) itself; we do not store full card numbers.
Legal basis: performance of the contract.
VAT number check
If you enter a VAT number at checkout, it is checked against the European Commission’s VAT Information Exchange System (VIES) to decide whether reverse charge applies.
Legal basis: our legal obligation under VAT law.
License checks by MCP Self-hosted
An MCP Self-hosted installation contacts our server at least every 72 hours to check its license. Each check sends:
- the license key and a random installation ID generated by the installation itself;
- technical diagnostics: the MCP Self-hosted and Node.js versions, the operating system, the type of installation, the authentication method, which tools are active, uptime, the number of tool calls and errors per tool since the last check, and recent error codes;
- for installations with several seats: usage per seat, identified only by the seat ID we issued.
MCP Self-hosted never sends the content of your requests, prompts, query results, hostnames, IP addresses, API tokens or seat labels in the diagnostics. Our server receives your IP address as part of the request; it uses that address for rate limiting and stores only a hashed (one-way encrypted) version with the activation.
We use this to validate your license, enforce the number of activations and seats in your plan, inform you about updates and improve the software. Legal basis: performance of the contract (license check) and our legitimate interest in keeping the software reliable and preventing misuse (diagnostics).
AddoBase WordPress plugin
A WordPress site that uses the AddoBase plugin and is connected to your account, or uses a license key, checks in with our server. A check sends the site address, the WordPress, PHP and AddoBase versions, the list of AddoCore plugins on the site (folder name, version, active or not) and, where used, the license key. Connecting a site also sends the site name. We store the site address, the WordPress and AddoBase versions, the time of the last check and which add-ons are switched on for which site. We do not store the PHP version. Your server’s IP address is used for rate limiting only. AddoBase never sends posts, pages, users, orders, customer data or other plugins.
Legal basis: performance of the contract.
MCP Hosted seats
For an MCP Hosted seat we store the credentials you enter for your own systems (such as API tokens) in encrypted form and use them only to run the tools you selected. We also record usage per seat. Data that passes through your tools is processed only to carry out your instructions. If you are a business customer, we process that data as a processor on your behalf.
Legal basis: performance of the contract.
Contact form, add-on requests and the withdrawal form
When you use the contact form or the custom add-on request form, we store what you enter (name, email address, company if given, subject and message), the page you sent it from and, if you are logged in, the link to your account. Entries are stored in our website’s administration. When you use the withdrawal form, we record the withdrawal and your optional reason with the order.
Legal basis: our legitimate interest in answering your question, or steps at your request before entering into a contract (art. 6(1)(b) GDPR); for withdrawals, performance of the contract and our legal obligations.
Newsletter
If you sign up for our newsletter, we store your email address and the date of signing up. You can withdraw your consent at any time by emailing us.
Legal basis: your consent (art. 6(1)(a) GDPR).
Product reviews
If you write a product review, we publish your name, rating and review text with the product. We also store your email address and IP address with the review to prevent spam and misuse; these are not published.
Legal basis: our legitimate interest in showing genuine reviews and preventing spam.
Spam and bot protection
Forms that visitors who are not logged in can use (contact, newsletter, add-on requests, withdrawal, login, registration, checkout and reviews) are protected by Cloudflare Turnstile. When you use such a form, Cloudflare receives your IP address and technical information about your browser to tell people and bots apart. Turnstile does not run for logged-in users.
Legal basis: our legitimate interest in protecting our website and customers against abuse.
Website security
Our website logs security events, such as failed login attempts, together with the IP address involved, to detect and block attacks.
Legal basis: our legitimate interest in securing our website and your account.
Cookies
We only use cookies that are needed for the website to work. We do not use analytics or marketing cookies. The cookie banner lets you review this and save your choice.
- mcpl_cookie_consent (this website): stores your cookie preferences. 6 months.
- woocommerce_cart_hash, woocommerce_items_in_cart (WooCommerce): keep track of your cart. Session.
- wp_woocommerce_session_* (WooCommerce): identifies your shopping session. 2 days.
- mcpl_vat_display (this website): remembers whether you view prices including or excluding VAT. 1 year.
- wordpress_logged_in_*, wordpress_sec_* (WordPress): keep you signed in. Session.
- pll_language (Polylang): remembers your language. 1 year.
If we start using other cookies, we add them to the cookie banner and this list, and we only place non-essential cookies after you consent.
Who receives your data
We do not sell your data. We share it only where that is needed for the purposes above:
- Mollie B.V. (the Netherlands): payment processing.
- Cloudflare, Inc.: bot protection on forms (Turnstile).
- The European Commission (VIES): VAT number checks.
- Our hosting and email providers: they store our website and database and deliver our emails, as processors under an agreement with us.
- Authorities, such as the tax authorities, where the law requires it.
Transfers outside the EEA
Cloudflare is based in the United States and may process the data from Turnstile there. Such transfers take place on the basis of the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Our other recipients process your data within the European Economic Area.
How long we keep your data
- Orders, invoices and the related customer data: at least 7 years, as required by Dutch tax law.
- Account, license, seat and subscription data: for as long as you have an account or a running contract, and after that for as long as needed for our accounting obligations.
- Raw license-check data from MCP Self-hosted: deleted automatically after 90 days. After that, only aggregated daily statistics remain.
- MCP Hosted credentials and payment mandates: until your last running contract has ended and you ask us to delete them, or until you remove them yourself.
- Contact form and add-on request entries: as long as needed to handle your question or request and any follow-up.
- Newsletter: until you unsubscribe.
- Reviews: as long as the review is published.
- Cookies: see the durations above.
Security
All traffic to our website and between our software and our server is encrypted with HTTPS. Requests from MCP Self-hosted and AddoBase are additionally signed. Credentials for MCP Hosted and seat tokens are stored encrypted. Access to personal data is limited to people who need it for their work.
Your rights
You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to receive your data in a structured, machine-readable format (data portability). Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal.
To use your rights, email [email protected]. We may ask you to confirm your identity. We answer within one month, as the GDPR requires. When you ask us to delete your data, we always delete license-check history, hashed installation IP addresses and notification preferences. Data we need to deliver a running contract, or that we must keep for tax purposes, is deleted once that need ends.
We do not use automated decision-making that has legal or similarly significant effects for you.
You need to provide the data marked as required at checkout to enter into a contract with us; without it we cannot deliver your order.
Complaints
If you have a complaint about how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in the EU country where you live or work.
Applicable law
Dutch law applies to this privacy policy and to the use of addocore.com, together with the GDPR. Purchases and contracts with us are also governed by Dutch law, as set out in article 18 of our terms and conditions. If you are a consumer living in another EU country, you keep the protection that the mandatory law of your country gives you.
Changes
We may update this privacy policy when our services or the law change. The current version is always on this page.