Last updated: 28 April 2026
1. Who we are
This privacy policy describes how Dudaster Studio, an independent WordPress tools studio, processes personal data collected through dudaster.com and the WordPress plugins ECS and AICOM. Data controller: Dudaster Studio, contactable at assist@dudaster.com.
2. Data we collect on dudaster.com
- Server logs: IP address, user agent, requested URL, response status, timestamp. Retained for thirty (30) days for security and abuse monitoring. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR).
- Newsletter (optional): if you subscribe, your email address is stored to deliver release notes and tutorials. You can unsubscribe with one click in any email. Lawful basis: consent (Art. 6(1)(a)).
- Comments and forum posts (optional): name, email, comment body, IP. Visible publicly on the site if you submit them. Lawful basis: consent.
- Purchase information: handled by Gumroad. We receive name, email, country, and license metadata; we do not see or store payment-card data. Lawful basis: contract performance (Art. 6(1)(b)).
3. Data the plugins process on your site
ECS and AICOM are self-hosted plugins. Both run on your own WordPress server. We do not collect telemetry, usage statistics, or personal data from sites running our plugins. License-key validation calls (for ECS Pro) send only the license key and the site URL to our license server, which logs the request for audit but does not collect end-user data.
AICOM specifically: exposes a private API endpoint on your site that AI agents can call. AICOM does not transmit data to Dudaster Studio. Communication happens between the AI agent, your site, and any AI or infrastructure providers you choose. The data your agent reads, sends, stores, deletes, or modifies depends on your configuration, the agent, the API key permissions, and the prompts you provide.
4. Your responsibility for connected systems
You are responsible for the personal data, credentials, API keys, prompts, content, users, roles, backups, logs, and third-party integrations on your own WordPress site. If you connect AICOM to an AI provider, automation tool, hosting provider, analytics service, email system, CRM, payment provider, or any other external system, you are responsible for reviewing that provider’s privacy practices, legal basis, security controls, and data-processing terms.
Dudaster Studio is not responsible for personal data processed, exposed, altered, deleted, stored, transmitted, or misused by your WordPress site, your users, your AI agents, your prompts, third-party services, compromised credentials, misconfigured permissions, or tools you connect to the plugins.
5. Cookies
dudaster.com uses minimal cookies: a session cookie when you log in (logged-in admins only), and an anti-spam cookie on comment forms. We do not use third-party advertising cookies or analytics that track you across sites.
6. Data sharing
We do not sell, rent, or share your personal data with third parties for marketing. We use the following processors strictly for service operation:
- Gumroad (payments) — processes payment data and issues invoices.
- The hosting provider for dudaster.com.
- Email delivery — newsletter and transactional emails.
We disclose data only when required by law (court order, valid legal process).
7. Security and no absolute guarantee
We use reasonable technical and organizational measures for the systems we control, but no website, plugin, server, API endpoint, AI workflow, email system, or internet transmission can be guaranteed to be perfectly secure. You are responsible for securing your own WordPress installation, administrator accounts, hosting environment, API keys, backups, permissions, and connected services.
To the maximum extent permitted by law, Dudaster Studio is not liable for security incidents, data loss, unauthorized access, disclosure, corruption, deletion, downtime, or other privacy-related harm caused by systems or access outside our control.
8. Your rights under GDPR
You have the right to access, correct, or delete your personal data, restrict or object to processing, and request portability. To exercise any right, email assist@dudaster.com with the subject “GDPR request”. We respond within thirty days. You also have the right to lodge a complaint with your local supervisory authority.
9. Retention
Server logs: 30 days. Newsletter subscribers: until you unsubscribe. Purchase records: 10 years (applicable fiscal record requirements). Comments: until you ask us to remove them.
10. Children
The site and the plugins are not directed at children under 16. We do not knowingly collect personal data from minors.
11. Changes to this policy
Material changes to this policy will be announced on the Journal and the “Last updated” date above will change. Subscribers will be notified by email.
12. Contact
Questions, requests, or complaints: assist@dudaster.com.