https://www.wordfence.com/privacy-policy/

Hello,

Our privacy page covers the use of our website and the Wordfence plugin and site cleaning service.

-Kerry

• This reply was modified 6 years, 6 months ago by Kerry.

Thanks Kerry.

To me, reading it, it is unclear what relates to the plugin itself, and what to your website or services. Part of the question is, does the plugin complies with the GDPR?

This means for example:
– Does it use Google Fonts?
– Does it track any personal data, like IP address, location, browser type etc.?
– If so also from visitors to the site?
– Is there any other type of tracking happening?
– Do you have a Privacy Shield certification (if you are outside the EU and in the US, I ask as I do not know where you are based)?
– Do you have a Data Processing Agreement for EU customers?
– Do you have a supervisory authority (if you don’t have a presence in the EU?
– Does it ‘phone home’?
– Etc.

All this is important to know in regards to the new European data protection laws.

Thanks again for engaging.

There are lots of questions here but they can best be answered by reviewing our data processing agreement. We are in the process of getting certified for Privacy Shield but there is a backlog. In the meantime, we implemented a lawful solution for data transfer by using Standard Contractual Clauses along with our data processing agreement. If you review our dpa found here: https://www.wordfence.com/help/general-data-protection-regulation/#data-processing-agreement
scroll down to Categories of Data to see what data is collected from site visitors on your site when the Wordfence plugin is installed. We don’t keep data as long we feel like and I’m not sure how what we have stated could be interpreted as such. We keep the data collected per our dpa until it’s no longer useful. Most attack data is no longer useful after 90 days and is deleted. If the data is still associated with malicious behavior, we keep that malicious data until it’s no longer attacking then delete it. It would not be possible to set a firm deletion date for all attack data as attackers would wait until the following day to start up again. That’s why we word the dpa as deleting data when it’s no longer useful because it’s not possible to know when attack data stops being malicious. I hope that provides the answers needed.

I’ve removed the replies from people who are a) not helping the original poster and b) got into a side conversation.

These are support forums not discussion forums and this is not a topic about the software on this site. I’m closing this topic, please follow Kerry’s advice.