Legal Terms
Privacy Policy
Effective Date: October 14, 2026
1. Who We Are
iPow Core (“we”, “us”, or “our”) is a software brand operated by IPOW HOSTING LLC, a Wyoming Limited Liability Company registered at 30 N Gould St, Ste R, Sheridan, WY 82801, United States. We are the data controller for the personal data described in this policy. This policy explains how information is collected, used, and safeguarded when you visit ipowcore.com, create an account, or purchase a software licence.
You can reach us about any privacy matter at support@ipowcore.com or +1 (917) 764-9437.
2. Information We Collect
- Account data. Your name, email address, and a securely hashed password. If you sign in with Google, we receive your name, email address, and profile picture from Google instead of a password.
- Order data. Your billing name, email address, billing country, tax status, purchased plan, and order or invoice number. We never receive or store your full card number, expiry date, or security code — those are handled entirely by our payment provider.
- Licence and activation data. Your licence key (stored encrypted), the website domains on which you activate the plugin, activation timestamps, and download records. This is how we enforce your plan’s site limit and deliver updates.
- Support data. Your name, email address, optional order number, and the content of any message you send through our contact form.
- Technical data. IP address, browser user agent, and timestamps recorded in server and security logs, including rate-limiting records used to prevent brute-force attacks on sign-in.
3. Why We Use It, and Our Legal Basis
- To deliver the software, licence keys, and updates you have paid for, and to provide support — performance of a contract.
- To operate accounts, verify email addresses, and reset passwords — performance of a contract.
- To detect fraud, abuse, and licence-sharing, and to keep the service secure — legitimate interests.
- To keep invoices and tax records — legal obligation.
- To measure aggregate site traffic, where analytics are enabled — legitimate interests, using cookie-less aggregate counts only.
We do not sell or share personal information for cross-context behavioural advertising, and we do not use your data to train machine-learning models.
4. Cookies & Local Storage
We use authentication cookies and limited browser storage for account security and site preferences. The listed site storage is not used for advertising profiles. Hosted payment and Google sign-in services may use their own cookies and storage under their notices. Any non-essential tracking we introduce will be subject to the information and choices required by applicable law.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| Authentication session cookie | Strictly necessary | Keeps you signed in to your account and protects forms against cross-site request forgery. Set by Auth.js when you sign in. | Until you sign out, or 30 days |
| Announcement dismissal (local storage) | Preference | Remembers that you closed the site announcement banner. | Until you clear browser storage |
5. Service Providers and Payment Providers
We disclose the data needed for hosting, account operation, payments, email, and any optional Google sign-in you choose. Hosting and email providers process service data for us under their applicable agreements. PayPal acts as an independent controller for its payment activities. Stripe acts as a processor and/or independent controller depending on the activity, including its own fraud-prevention and legal obligations.
| Provider | Purpose | Processing location |
|---|---|---|
| Oracle Cloud Infrastructure | Website hosting, infrastructure and request logs | France (Paris region) |
| Stripe | Payment processing, subscriptions, fraud prevention and refunds; processor and/or independent controller depending on activity | United States and other locations under its privacy notice |
| PayPal | Payment processing, subscriptions and refunds; independent controller for its payment activities | United States and other locations under its privacy notice |
| Self-hosted PostgreSQL on Oracle Cloud Infrastructure | We operate the account, order, licence and activation database | France (Paris region) |
| Resend (Plus Five Five, Inc.) | Transactional email, licence delivery and support messages | United States; provider infrastructure may use other locations |
| Optional Google sign-in under its own privacy terms | United States and other locations under its privacy notice |
See the Stripe Privacy Policy and PayPal Privacy Statement for their own data use, retention, rights, and international transfers. These providers may process payment details, transaction data, device information, and identifiers under their own notices. We receive the transaction status and identifiers needed for your order, licence, refunds, and accounting.
We may also disclose data where required by law, court order, or to establish or defend legal claims. If our business is sold or merged, customer records may transfer to the acquirer under the terms of this policy.
6. How Long We Keep Data
| Data | Retention period |
|---|---|
| Account record (name, email, hashed password) | While your account is active. Closing an account disables access; it does not automatically erase all records. We assess erasure requests and delete or anonymise data no longer needed, subject to legal, accounting, security, and dispute requirements. |
| Licence keys, activations, and download logs | For the service entitlement and for as long afterwards as needed to resolve activation, refund, security, or legal claims. |
| Order and invoice records | For the periods required by applicable tax and accounting rules, and as needed to handle refunds, disputes, and legal claims. |
| Support and contact form correspondence | While needed to resolve the enquiry and related complaints or legal claims; no longer-needed personal data is deleted or anonymised, subject to required retention. |
| Password reset and email verification tokens | Password-reset links expire after 1 hour; email-verification links after 24 hours. Used tokens cannot be reused. |
| Server and security logs | For as long as needed for operating the service, detecting abuse, and investigating security incidents; longer only where required for a specific legal or security matter. |
7. International Data Transfers
IPOW HOSTING LLC is based in the United States. Our website and self-hosted account and licence database run on Oracle Cloud Infrastructure in France. Payment, email, and optional sign-in providers may also process data in the United States or other countries described in their notices. International transfers are subject to applicable data-protection law and the transfer terms of the relevant provider agreements. Contact support@ipowcore.com for information about the safeguards applicable to your data and how to request a copy where available.
8. Your Rights
Depending on where you live, you may have the right to access a copy of your data, correct inaccurate data, delete your data, restrict or object to processing, withdraw consent, receive your data in a portable format, and — for California residents under the CCPA/CPRA — to know what is collected and to opt out of sale or sharing (we do neither). We will not discriminate against you for exercising any of these rights.
You can close your account from your account settings. To request access, correction, erasure, or another data right, email support@ipowcore.com. Account closure and a personal-data erasure request are separate. We normally respond to rights requests within one month, subject to legally permitted extensions, and may verify your identity. Records needed for tax, accounting, security, or legal claims may be retained where permitted or required by law.
If you are in the EEA or UK and believe we have handled your data improperly, you may complain to your local supervisory authority.
9. Security
The website uses HTTPS. Passwords are stored using salted one-way hashes, licence keys are encrypted at rest, and signed plugin download links are time-limited. Sign-in and password-reset endpoints are rate limited, and relevant administrative actions are logged. No system is perfectly secure. If a personal-data breach occurs, we assess and make notifications required by applicable law.
10. Children
Our products are sold to businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
11. Changes & Contact
If we make a material change to this policy we will update the effective date above and, where the change significantly affects you, notify account holders by email.
Privacy enquiries: IPOW HOSTING LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States · support@ipowcore.com · +1 (917) 764-9437
This policy is published in English and Dutch. In the event of any discrepancy between the two versions, the English version prevails.
iPow Core is a software brand operated by iPow Hosting LLC.