GDPR for WPBay sellers: what WPBay handles and what you still need to do
WPBay handles personal data connected to the marketplace, customer accounts and marketplace transactions under its own privacy framework. You remain responsible for the personal data your own plugin, theme, service, website or external integrations collect and process.
- WPBay Privacy Policy
- Cookie Policy
- Data access requests
- Erasure requests
- Legal retention rules
- Seller privacy obligations
- Product disclosure requirements
- Marketing privacy rules
WPBay cannot make every seller’s product GDPR compliant
GDPR responsibilities follow the processing of personal data.
When WPBay processes information to operate the marketplace, maintain accounts, administer orders or meet its own legal obligations, that processing belongs to WPBay’s privacy framework.
But if your plugin sends analytics to your server, connects to an AI API, collects email addresses, stores IP addresses, loads advertising technology, uses telemetry or processes customer information for support, that processing remains your responsibility.
Selling through a compliant marketplace does not automatically make code running on your customer’s WordPress site compliant.
How WPBay handles marketplace privacy
WPBay publishes the policies and processes governing personal information processed through the marketplace.
Privacy Policy
WPBay publishes information explaining how personal information is processed through the platform and the rights available to users.
Cookie Policy
WPBay documents its use of strictly necessary, performance, functionality and advertising or targeting cookies and explains browser-level cookie controls.
Personal data export requests
Users with WPBay accounts or submitted content can request an exported copy of eligible personal data held by WPBay.
Erasure requests
Users may request erasure of personal information held by WPBay, subject to records WPBay must retain for administrative, legal or security purposes.
Account information controls
Registered users can manage personal information associated with their account, subject to platform and legal limitations.
Legally required seller data
As an EU marketplace, WPBay may need to collect, verify, retain and report certain seller information where legal obligations such as DAC7 apply.
Limited public seller disclosure
Where marketplace law requires seller identity information to be shown, WPBay states that it limits disclosure to the information legally required.
Centralized transaction processing
Standard marketplace purchases are processed through WPBay as Merchant of Record instead of requiring each developer to operate a separate customer checkout.
Legal retention exceptions
The right to erasure is not absolute. Some information may need to remain stored when retention is required for tax, legal, security or other statutory obligations.
Users can ask WPBay about the personal data it holds
WPBay’s Privacy Policy provides mechanisms for users to request access to eligible personal information and request erasure where the information is not required to be retained.
Certain regulated information can have additional rights and restrictions. For example, WPBay’s DAC7 privacy section covers access, rectification, restriction, portability where applicable and the right to complain to a supervisory authority.
Read the Privacy PolicyWhat WPBay handles — and what you still handle
Privacy responsibility depends on who controls the processing, not simply where the product was purchased.
WPBay handles
Personal information processed for WPBay’s own marketplace functions.
- WPBay account information
- Marketplace orders and transaction records
- Customer billing information processed by WPBay
- Marketplace refund administration
- Seller account and payout information
- Marketplace fraud and security processing
- Required marketplace tax reporting
- WPBay website cookies and tracking
- WPBay’s own newsletter and platform communications
- Requests concerning personal data held by WPBay
Sellers still handle
Personal information independently processed through your own product, website, service or business.
- Analytics built into your plugin or theme
- Product telemetry
- Your own website cookies
- External API calls made by your product
- AI provider data transfers
- Your own mailing lists and promotional emails
- Contact forms operated outside WPBay
- Customer information copied into external support tools
- Cloud storage or SaaS services used by your product
- Any other processing you independently control
If your product sends data somewhere, tell the customer
WPBay requires sellers to disclose personal data collection and external processing where relevant.
A WordPress product should not quietly transmit data simply because the connection is technically necessary for one of its features.
If you use analytics, telemetry, licence verification, a remote API, cloud processing, AI services or another external system, clearly explain what is sent, why it is needed and which provider receives it.
Hidden tracking and undisclosed personal-data transmission are not permitted on WPBay.
Seller privacy responsibilitiesA WPBay purchase is not automatic permission for your own marketing
WPBay sellers may promote their products through lawful newsletters and other channels, but promotional communications must comply with applicable privacy and electronic-marketing rules.
Do not scrape WPBay customer information or assume that purchasing your product gives unlimited permission to add that customer to an external marketing list.
If you independently collect subscribers, maintain evidence of the lawful basis you rely on and provide the disclosures and unsubscribe controls required for your situation.
Don’t forget the services behind your plugin
Privacy obligations often come from external services rather than data stored directly inside WordPress.
Analytics
Disclose analytics or telemetry that sends usage information away from the customer’s WordPress installation.
Licence verification
If licensing transmits a domain, IP address, account identifier or other information, explain the processing where applicable.
AI APIs
Explain when prompts, content or other customer data are sent to external AI providers and identify important provider dependencies.
Cloud storage
Tell users when files, backups, media or other information leave their WordPress installation for remote storage.
Remote SaaS features
Clearly disclose hosted services that are required for core product functionality or process customer information remotely.
Support tools
Protect credentials, customer data, site backups and other information customers provide during support interactions.
Some records must be retained because the law requires it
GDPR provides important deletion rights, but it does not require a business to erase information that it must still retain under another legal obligation.
WPBay’s Privacy Policy explicitly excludes information that must be kept for administrative, legal or security purposes from unrestricted erasure requests.
Seller information processed for DAC7 is one concrete example. WPBay states that DAC7-related records are generally retained for the period required by Romanian tax law and may be retained longer where audits or disputes require it.
Before publishing a product on WPBay
You do not need a 50-page privacy document for every plugin. You do need to understand and disclose what your product actually does.
GDPR and WPBay seller questions
Is WPBay responsible for personal data collected by my plugin?
Not automatically. If your plugin independently collects, stores, accesses, transmits or otherwise processes personal information, you are responsible for ensuring that processing complies with applicable privacy and data-protection law.
Does selling through WPBay make my plugin GDPR compliant?
No. WPBay handles privacy obligations for its own marketplace activities. Your product’s own analytics, telemetry, APIs, AI providers, forms, cookies, remote services and other processing remain separate issues that you must evaluate.
Do I need to disclose external API connections?
Where your product sends personal information or other customer data to an external provider, WPBay’s seller guidance requires relevant data-processing and external connections to be clearly disclosed.
Can I collect product telemetry?
Telemetry is not automatically prohibited, but you need an appropriate legal basis, suitable disclosure and appropriate privacy controls where required. Hidden tracking or undisclosed data transmission is not permitted by WPBay seller policy.
Can I add WPBay customers to my marketing list?
A WPBay purchase should not be treated as unlimited permission to send external promotional marketing. Seller communications must comply with applicable privacy and electronic-marketing law, and customer information must not be scraped or misused.
Can a WPBay user request their personal information?
Yes. WPBay’s Privacy Policy states that users with an account or submitted content can request an exported file containing eligible personal information WPBay holds about them.
Can a user ask WPBay to delete their data?
Yes, subject to exceptions. WPBay’s Privacy Policy allows erasure requests but excludes information WPBay is required to retain for administrative, legal or security purposes.
Why might WPBay keep seller data after a deletion request?
Legal obligations can require continued retention. Tax, accounting, anti-fraud, dispute or marketplace-reporting requirements can override immediate deletion of specific records. WPBay’s Privacy Policy provides DAC7 seller information as one example of legally required retention.
Does WPBay have a Cookie Policy?
Yes. WPBay publishes a Cookie Policy describing the categories of cookies and similar technologies used on the marketplace and browser-based methods for controlling cookies.
Where can privacy requests be sent?
Privacy and data-protection requests concerning information held by WPBay can be directed to WPBay support using the contact information provided in the Privacy Policy.
Sell through WPBay while keeping control of your product’s own privacy practices
WPBay provides the marketplace, checkout, account and transaction privacy framework. You stay responsible for understanding and disclosing the data processing built into the software and services you create.