Privacy Policy

Last updated: 27 October 2026

1. Introduction

Daga.pl sp. z o.o., the company that provides Caching Out (“we”, “our”, or “us”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website cachingout.com, use our plugin, or purchase our services. The plugin is a performance tool: it does not need your content, your visitors, or your identity to do its job, and it is designed not to collect them.

2. Information We Collect on This Website

Account and order information: When you buy a licence, our store (WooCommerce, running on our own server) keeps your name, billing address, email address, the licence you bought and your order and renewal history, and the account you use to manage them. Card details are entered on our payment processor’s (Stripe) form and are never stored on our servers; Stripe keeps your payment method so that yearly renewals can be charged, and we hold only a reference to it.

Messages you send us: the forms on our Contact and Partners pages collect your name, your email address and whatever you write, and email them to our support address. We keep them for as long as we need to answer you and to keep a record of the conversation.

Website analytics: Only if you accept in the cookie banner, we use Google Analytics 4 to count visits and see which pages are useful. It sets the cookies _ga and _ga_XLW9DB3YX3, and tells Google the pages you view, how you arrived, and your device, browser and approximate location; Google Analytics 4 does not log or store IP addresses. We keep this data for 14 months. If you decline or ignore the banner, nothing is loaded and no cookie is set, and you can change your choice at any time with Cookie settings at the foot of every page. Our web server also keeps standard access logs (IP address, page requested, user agent) for security and troubleshooting, and deletes them after 30 days.

Referral cookies: once the affiliate programme is open, arriving through an affiliate’s link sets a referral cookie so that the affiliate is credited if you buy. We ask for your consent before it is set. Beyond those and the Google Analytics cookies you accept, the only cookies this website sets are the ones needed to run the store, keep you signed in to your account, and remember your cookie choice for 12 months (co_consent).

3. What the Plugin Sends From Your Site

From version 1.21.0 Caching Out is two plugins. The free plugin on WordPress.org sends nothing. It needs no licence, has no telemetry sender, and makes no outbound request of its own; the only requests it makes are to your own site. Everything in this section belongs to Caching Out Pro. With Pro not installed, none of it can happen.

With the Pro add-on installed, the plugin makes four kinds of transmission to our own servers, each described below. None of those four ever contains page URLs, page content, post data, visitor data, your email address, or your user database. Section 3.5 lists the third-party services the plugin contacts only when you switch them on and give it your own credentials.

3.1 Smart Config and the AI Assistant

Nothing is sent unless you ask. A site configuration summary leaves your server on exactly two explicit, user-initiated actions: when you click the Run scan button on the Setup Wizard’s Smart Config step (nothing is transmitted on merely opening the step), and each time you submit a question in the AI Diagnostic Chat. There is no background or scheduled transmission.

What each question sends: the text of your question; a summary of your site’s configuration (the installed plugin slugs with their major version only, the active theme’s template slug, the PHP version, and the server type); where you have enabled the filesystem check, that check’s results; where the Page Audit has run, its findings; and, while "Let the AI Assistant see recent changes" is on (Cache tab, on by default), a short summary of the plugin’s own most recent settings changes, with credentials and licence fields redacted. Your license key accompanies the request to authenticate it. The transmission never includes your site URL, page content, or any user or visitor data.

3.2 Who Processes AI Requests

When you use the AI features, our license server passes parts of your request to external AI providers to compute an answer. No provider ever receives your page content, visitor data, or user database — only the items listed in section 3.1.

• Retrieval embeddings (matching your question against our knowledge base): OpenAI (text-embedding-3-small).
• Answer generation (composing the reply): Anthropic, PBC (Claude Haiku 4.5, via the Anthropic Messages API). Your question and the summary described in section 3.1 are processed on Anthropic’s infrastructure in the United States.

3.3 Performance Telemetry (Opt-In Only)

With your explicit opt-in consent — a checkbox that ships unticked — the plugin may send pseudonymous performance telemetry: a hashed site identifier (never the URL itself), PageSpeed score numbers, feature on/off state, environment versions, your active theme, a count (not a list) of active plugins, and, when Smart Config applies a rule or you later change one, which rule and setting changed. On the licensed send path your licence key travels with the request so our server can authenticate it, and is stripped before anything is stored. Exclusion lists, API keys, credentials, and any user-entered value are never included. You can withdraw consent from the same screen at any time, and adding define( "CACHINGOUT_DISABLE_TELEMETRY", true ); to wp-config.php disables all telemetry for every user regardless of the checkbox. It does not affect licence validation (section 3.4) or the summary that travels with a question you type (section 3.1).

3.4 License Activation and Validation

When you enter a license key, and once a day thereafter while the licence is active, the plugin sends our license server exactly three things: the site URL, the license key, and the plugin version. This is license management, not telemetry — it is what binds the key to your site — and it is not covered by the telemetry opt-in or kill switch.

3.5 Services You Switch On Yourself

Three optional features call services outside our own, under your own account and only once you have enabled them. Google PageSpeed Insights: when you run an audit or a scheduled re-test, the URL of the page being tested is sent to Google under the API key you supplied. Cloudflare and Sucuri: when a purge runs and you have entered that add-on’s credentials, the zone or site identifier and the paths being purged are sent to that provider. Google Fonts: once, when you switch font self-hosting on, the plugin fetches the font families your theme requested. These are your accounts with those providers, and each provider’s own privacy policy governs them.

The full data-transmission reference lists every field in every payload, the endpoint it goes to, and how to switch each one off.

4. How We Use Your Information

We use your information to: provide and maintain our services, process your transactions, send licence keys, renewal reminders and payment notices, charge renewals through Stripe, respond to your support requests, answer the questions you ask the AI Assistant, and send product updates (which you can opt out of at any time).

5. Data Retention

We retain your account information for as long as your licence is active. Order and invoice records are kept for as long as tax and accounting law requires, which in Poland is five years from the end of the tax year of the transaction. Upon license expiration or account deletion, your personal data is removed within 30 days. Anonymized, aggregate usage data may be retained indefinitely for product improvement purposes. To request deletion of licensing or telemetry records, contact us at the address in section 8.

6. Your Rights (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the right to: access your personal data, correct inaccurate data, request deletion of your data, restrict or object to processing, data portability, and withdraw consent at any time. Every telemetry opt-in in the plugin is explicit and pre-unchecked. To exercise any of these rights, contact us at privacy@cachingout.com.

The data controller is Daga.pl sp. z o.o., ul. Zbożowa 7/9, 09-410 Płock, Poland (KRS 0001093024), the company that provides Caching Out. We process your data to perform our contract with you (licensing, support and billing), on your consent (website analytics, telemetry, referral cookies and the AI Assistant), and on our legitimate interest in running and securing the website. You also have the right to complain to a data protection authority — in Poland, the Prezes Urzędu Ochrony Danych Osobowych (UODO).

7. Third-Party Services

Alongside the AI sub-processors in section 3.2, we use the following services to run the website and licensing: Stripe (payment processing), SendGrid (transactional email), Supabase (license management) and, only with your consent, Google Analytics (website analytics, provided by Google Ireland Limited). Each has its own privacy policy and data processing agreement. Some of these providers process personal data outside the European Economic Area and the United Kingdom, including in the United States. Where that happens we rely on the European Commission’s standard contractual clauses, with the UK addendum where the UK GDPR applies. We do not sell, trade, or rent your personal data to third parties.

8. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at privacy@cachingout.com.