Privacy Policy

Last updated: February 2026

BackupRidge is a product of Stava Tech (“we”, “us”), a registered business in Norway. This policy explains what data we collect, how we use it, and your rights.

The short version: We collect the minimum data needed to provide our service. We don’t sell your data. Your backups stay on your server and your chosen cloud storage — we never have access to them.

What the Plugin Collects

The plugin operates entirely on your server. It does not send site data, backups, or database information to us. Outbound connections:

  • License validation (Pro/Agency only) — sends license key and site domain to verify activation.
  • Update checks — queries WordPress.org for updates.
  • Cloud storage — connects directly to your configured provider. Credentials are stored locally.

See our External Services disclosure for provider-by-provider details, terms, and privacy policies.

What the Website Collects

  • Analytics — we use Umami, a self-hosted, cookie-free analytics tool that runs on our own server (no data goes to a third party). It assigns your browser a random, anonymous id, stored in local storage rather than a cookie, to connect page views and interactions — such as button clicks and, for purchases, plan and revenue — within a session. That id isn’t linked to your name, email, or any other personal identifier. On select pages we also record anonymized session replay and click/scroll heatmaps through the same Umami instance, with form fields and other sensitive elements masked, to understand where visitors run into friction.
  • Email address — if you subscribe to our newsletter. Unsubscribe anytime.

Payment Processing

Payments are processed by LemonSqueezy. They collect payment information for transactions and EU VAT. We receive your name, email, and license details — not payment card info.

Business outreach email

We sometimes email businesses that build or run WordPress sites to introduce BackupRidge and a free restore-test guide.

  • Who we are: Stava Tech (ENK), Org. no. 930 740 829, Mosbronvegen 39, 4270 Åkrehamn, Norway. Email tor@getbackupridge.com.
  • What we hold: your company’s name, website and the business email address published on it; for UK companies, your Companies House number and status; one public detail from your website that we mention in the email; and the dates we emailed you, whether you replied, and any request to stop.
  • Where it came from: your company’s own website, and for UK companies the public Companies House register.
  • Why, and on what basis: to tell your business about a product relevant to its work, on the basis of our legitimate interests (UK GDPR and GDPR Art. 6(1)(f)). We only write to company addresses, never named personal ones, and send at most two emails.
  • Who else sees it: nobody for their own use. Google (Gmail) sends our email, and Bouncer (Bouncer Sp. z o.o., Poland) checked that the address accepts mail; data is processed in the EU (AWS, Frankfurt) and deleted within 60 days.
  • How long we keep it: 12 months from our last email to you, then we delete it. If you ask us to stop, we keep only your address on a do-not-contact list, so we never email you again.
  • Your rights: you can object at any time. Reply “no thanks” or email us and we stop immediately. You can also ask to see, correct or delete what we hold, and you can complain to the ICO (UK), Datatilsynet (Norway) or your local data protection authority.

What We Don’t Do

  • Sell, rent, or share personal data with third parties
  • Use tracking cookies or fingerprinting
  • Access your backups, site content, or database
  • Serve ads or share data with advertisers
  • Run telemetry or usage tracking in the plugin

Data Retention

  • License data: Subscription duration plus 30 days
  • Support emails: 2 years
  • Newsletter: Until unsubscribed
  • Analytics: Anonymous session and event data, retained indefinitely in our self-hosted Umami instance
  • Business outreach: 12 months from last contact; do-not-contact entries kept permanently

Your Rights (GDPR)

EU/EEA/Norway residents: access, correct, delete, or port your data, withdraw consent, or lodge a complaint with your local DPA. Contact us via our contact form.

Contact

For privacy requests, use our contact form — Entity: Stava Tech, Norway.