Privacy Policy
This privacy policy explains how WP Cloud Plugins (“we”, “us”, “our”) collects, uses, and protects your data when you visit wpcloudplugins.com (including demo.wpcloudplugins.com), and when you use our WordPress plugins: Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box.
Last updated: 24-05-2026
1. Our principles
We follow three simple rules:
- We collect as little personal information as possible.
- We only share personal information when it is needed to provide our services, comply with the law, or protect our rights.
- We do not use analytics, advertising pixels, or other marketing trackers on our website.
2. Who we are
3. Website: wpcloudplugins.com
Server logs
When you visit wpcloudplugins.com, our hosting provider automatically collects standard server log data, including:
- Your IP address
- Browser type and version
- Operating system
- Date and time of your visit
- Pages visited
This data is collected for security and stability purposes. It is not combined with other data sources and is not used to identify you. Server logs are automatically deleted within 30 days.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in maintaining website security and stability.
Cookies and trackers
wpcloudplugins.com does not use analytics cookies, advertising cookies, or marketing trackers.
We rely on Cloudflare as our network and security provider to protect and deliver the website. Cloudflare may process technical data such as your IP address, browser information, and security-related request data on our behalf.
If you purchase a license through Freemius checkout on our website, Freemius may set cookies or similar technologies on their own domain during the payment process. See section 9 for details.
Contact and support
If you contact us by email or open a support ticket, we collect the information you provide to us, including your name, email address, the content of your message, and any diagnostic information you choose to share (such as site URL, screenshots, configuration details, log excerpts, or sample files). We use that information only to respond to your inquiry, provide support, and follow up when needed.
Support is handled through Zendesk (accessible via support.wpcloudplugins.com, which redirects to a Zendesk-hosted help center). Zendesk processes your message and contact details on our behalf as a data processor.
We retain support correspondence for as long as needed to handle your request and maintain a useful support history, after which it is deleted or anonymized.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in responding to customer inquiries and providing support.
4. Interactive demo: demo.wpcloudplugins.com
The demo lets you try the plugins in a temporary sandbox WordPress environment. When you start a demo, we collect your email address so we can send you the sandbox details.
Your email address and the sandbox itself are kept for approximately 48 hours, after which the sandbox is destroyed and the email is deleted. We do not use this address for marketing.
Legal basis: Performance of a service requested by you (Art. 6(1)(b) GDPR).
5.The plugins
This section applies to all four plugins: Use-your-Drive (Google Drive), Out-of-the-Box (Dropbox), Share-one-Drive (OneDrive & SharePoint), and Lets-Box (Box).
The plugins run on your own WordPress server. Once configured, all file and account communication is direct, encrypted, and between your server and your chosen cloud storage provider. With one exception described below, this communication does not pass through WP Cloud Plugins servers, and we do not have access to your files.
IMPORTANT: The OAuth-proxy described in this section only applies when you use the plugin’s built-in app for authentication. If you configure the plugin to use your own app (your own client ID and secret), all authentication is handled directly between your server and your cloud provider, and this section does not apply.
Server data collected during OAuth (built-in app only)
When you use the built-in app to authorize a plugin with your cloud account, the OAuth flow briefly passes through our authentication server. During that flow we record:
- Your IP address
- Browser type and version
- Operating system
- Date and time
- Your WordPress site URL
- Your plugin license code
- A short-lived authorization code generated by the OAuth flow
The authorization code can only be used once and becomes inactive after it has been exchanged for an access and refresh token, or within minutes if it is not used. The license code is validated for licensing purposes. None of this data is sold, shared, or transferred to third parties. It is deleted within 7 days unless required for an active investigation.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in operating the built-in authentication app and validating licenses.
How the OAuth-proxy works
After you grant the plugin access on the cloud provider’s consent screen, you are redirected to wpcloudplugins.com, which then redirects you back to your own site to finalize the authorization. The short-lived authorization code is exchanged on your own server for an access token and refresh token, which are stored encrypted on your server. From that point on, all communication runs directly between your server and the cloud storage provider.
This redirect via wpcloudplugins.com exists so that you do not need to create your own cloud app, configure redirect URIs, or maintain your own client credentials.
What WP Cloud Plugins does not have
We do not have access to, store, or transfer:
- Your files or file contents
- The list of files in your cloud account
- The access tokens or refresh tokens (these stay encrypted on your server)
- Personal data about visitors to your WordPress site
Use of Google API Services
The use and transfer of information received from Google APIs by Use-your-Drive is subject to the Google API Services User Data Policy, including the Limited Use requirements.
6. Cloud provider permissions
Each plugin requests specific OAuth scopes when you connect a cloud account. These scopes are granted by you during the standard OAuth consent flow on the cloud provider’s own consent screen.
Use-your-Drive — Google Drive
- (optional) Google Drive — Application folder —
https://www.googleapis.com/auth/drive.file
Lets the plugin see, download, edit, create, and delete only the Google Drive files you use with the plugin. The plugin cannot access content on your Google Drive that was not uploaded via the plugin. - (optional) Google Drive — Read-only —
https://www.googleapis.com/auth/drive.readonly
Lets the plugin list and download files from your Google Drive. - (optional) Google Drive — Full access —
https://www.googleapis.com/auth/drive
Lets the plugin see, download, edit, create, and delete all of your Google Drive files. Required for full management of your files through the plugin modules (uploading, renaming, editing, deleting, sharing). - Google User Profile —
https://www.googleapis.com/auth/userinfo.profile
Used for locale detection and to display your name and profile picture in the plugin dashboard. - Google User Email —
https://www.googleapis.com/auth/userinfo.email
Used for locale detection and to display your email in the plugin dashboard.
See also the Google Privacy Policy.
Out-of-the-Box — Dropbox
- files.content.read — read file content and metadata. Used to list, preview, and download files.
- files.content.write — create, edit, and delete files.
- sharing.write — create and manage shared links and sharing settings.
- account_info.read — read your name, email, and profile picture for account identification in the plugin dashboard.
See also the Dropbox Privacy Policy and the Dropbox Terms of Service.
Share-one-Drive — OneDrive & SharePoint
- offline_access — Allows the plugin to maintain access to the content on behalf of the user. Required so that the plugin can refresh its access without prompting you on every action.
- User.Read — Used for locale detection and to display your name, email, and profile picture in the plugin dashboard.
- (optional) Files.Read — Allows the plugin to read the signed-in user’s files.
- (optional) Files.Read.All — Allows the plugin to read all files the signed-in user can access.
- (optional) Files.ReadWrite — Allows the plugin to read, create, update, and delete the signed-in user’s files.
- (optional) Files.ReadWrite.All — Allows the plugin to read, create, update, and delete all files the signed-in user can access.
- (optional) Sites.Read.All — Allows the plugin to read documents and list items in all site collections on behalf of the signed-in user.
- (optional) Sites.ReadWrite.All — Allows the plugin to edit or delete documents and list items in all site collections on behalf of the signed-in user.
See also the Microsoft Privacy Statement and the Microsoft APIs Terms of Use.
Lets-Box — Box
- root_readwrite — read and write access to all files and folders in your Box account. Used for the plugin’s core functionality: listing, previewing, downloading, uploading, renaming, editing, deleting, and sharing files through the plugin modules.
- User profile — used to display your name, email, and profile picture in the plugin dashboard.
See also the Box Privacy Notice.
7. Data processed on your WordPress server
The plugins also process data locally on your WordPress server. As the site operator using one of our plugins, you are the data controller for your visitors’ data, and you are responsible for documenting this in your own site’s privacy policy.
In summary, the plugins may process:
- Cloud account credentials. Encrypted access tokens and refresh tokens are stored on your server.
- File metadata. File names, sizes, modification dates, paths, and share links are cached temporarily and cleared based on your configured cache settings.
- Visitor interactions. Browsing, downloading, uploading, and searching by your visitors is handled through your own WordPress REST API and your own server logs.
- Statistics (optional). If you enable the Statistics feature, file events (downloads, uploads, previews, searches) are logged in your WordPress database. This data stays on your server and is never transmitted to WP Cloud Plugins.
- Uploads. Files uploaded by visitors are transferred from the visitor’s browser to your WordPress server, then to your cloud storage. Temporary upload data is deleted after the transfer completes.
8. Licensing and payments
Envato / CodeCanyon
If you purchased a plugin through CodeCanyon (Envato), Envato is the merchant of record for that purchase. The license is tied to your Envato purchase code, which the plugin validates against our license server. We receive your site URL and license code; we do not receive your name, email, or payment details from Envato. Envato’s handling of your data is governed by the Envato Privacy Policy.
Freemius
If you purchased a plugin directly through the Freemius checkout on wpcloudplugins.com, Freemius handles the transaction, license management, customer account, and plugin updates. Freemius is the merchant of record and processes the data needed to complete the purchase and provide ongoing licensing, including:
- Name and email address
- Billing details
- Payment-related information processed through Freemius and its payment providers
- License key, site URL, plugin version, and PHP/WordPress version (used for license validation and update delivery)
Your use of Freemius is also subject to the Freemius Privacy Policy.
9. Third parties
We share information with third parties only:
- With our processors and providers listed in this policy (Cloudflare, Zendesk, Freemius), each handling data on our behalf for the purposes described above.
- When required by law, such as to comply with a subpoena or similar legal process.
- When we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
Some of our service providers may process personal data outside the European Economic Area. Where required, we rely on appropriate contractual, technical, or organizational safeguards.
10. Children
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will delete it promptly.
11. Security
We take appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. This includes:
- HTTPS encryption for all communication with wpcloudplugins.com, our authentication proxy, and the demo site.
- Encrypted storage of plugin credentials (access tokens, refresh tokens) on your server.
- Access controls and operational safeguards appropriate to the data we process.
No system is completely secure. If you discover a security vulnerability, please report it.
If you have questions about this privacy policy or how your data is handled, contact us at [email protected]