Data Controller

• Controller: Oleg Kolesnyk (NagataPress)
• Registered office: Konečná 902/19, 360 05 Karlovy Vary, Czech Republic
• Business ID (IČ): 26336481
• Contact: [email protected]
• Website: https://nagatapress.com

What data we process

Depending on the interaction, we may process:

• identification/contact data (name, email),
• order/customer data (order ID, license status, plan metadata, activation usage),
• communication data (support emails, contact form messages),
• technical data (IP, browser/device, logs, diagnostics),
• website analytics/cookie-related data (where applicable).

What the NagataPress plugin processes

NagataPress runs on your own WordPress installation. Content you translate is sent directly from your server to the AI provider you configured (e.g. Anthropic, OpenAI, Google, Mistral, OpenRouter) under your own API key. It does not pass through our servers. OpenRouter additionally receives your site address as the referer of each request.

The plugin contacts our licence API (api.ffs.cz) to activate and deactivate a licence, to check the licence status once a day and to check for updates. The API is a proxy in front of our payment provider Creem.io, which acts as Merchant of Record. The plugin sends the licence key, your site address, the activation ID and the plugin version. It never sends page content, visitor data or your AI key.

The plugin sets no cookies for the visitors of your site. Its only cookie, nagatapress_edit, is set for an administrator who switches on the frontend editor and expires after one hour.

The language flags and the font of the plugin screens are bundled with the plugin, so neither the language switcher on your public pages nor the plugin screens in the WordPress admin make requests to an external CDN or to Google Fonts.

Sources of personal data

We obtain data:

• directly from you,
• from transaction/payment infrastructure operated by Creem.io (merchant of record),
• from your interaction with our website/plugin systems.

Purposes and legal bases (GDPR)

We process personal data for:

• Contract performance (Art. 6(1)(b) GDPR): order handling, license activation/validation, digital delivery, support.
• Legal obligations (Art. 6(1)(c) GDPR): accounting, tax, legal compliance, fraud prevention obligations.
• Legitimate interests (Art. 6(1)(f) GDPR): service security, abuse prevention, diagnostics, service improvement.
• Consent (Art. 6(1)(a) GDPR), where required: e.g., specific non-essential cookies/marketing communication.

Payments and third parties

Payments and transaction processing are provided by Creem.io as Merchant of Record. Creem.io may process billing/payment/tax data under its own legal terms and privacy policy.

We may also use infrastructure/service providers (hosting, email delivery, analytics, security) acting as processors or independent controllers where applicable.

International transfers

Some providers may process data outside the EEA. Where relevant, we rely on appropriate safeguards (e.g., standard contractual clauses) and legal mechanisms required by GDPR.

Data retention

We retain personal data only as long as necessary for the purposes above, typically including:

• contract and support lifecycle,
• legal/accounting retention periods,
• security and fraud prevention windows.

After retention ends, data is deleted or anonymized unless further retention is legally required.

Your rights

Under GDPR, you may have rights to:

• access your personal data,
• rectification,
• erasure,
• restriction of processing,
• data portability,
• objection to processing based on legitimate interest,
• withdraw consent (where processing is based on consent).

To exercise rights, contact: [email protected]

You also have the right to lodge a complaint with a supervisory authority (in the Czech Republic: Úřad pro ochranu osobních údajů – https://www.uoou.cz/).

Cookies

Our website may use essential cookies and, where applicable, non-essential cookies (analytics/preferences). Where required by law, non-essential cookies are used only after consent.

Security

We implement reasonable technical and organizational safeguards to protect personal data against unauthorized access, loss, misuse, or alteration.

Children

Our services are not intended for children and we do not knowingly collect personal data from children.

Policy updates

We may update this Privacy Policy from time to time. The latest version is published with the effective date shown above.