1. Who we are
“ModuleFest” (“we”, “us”, “our”) makes WordPress plugins, WHMCS modules and add-ons, and is based in the United Kingdom. For the personal information described on this page, we are the controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). People use our sites and software from all over the world; we apply the same standard to everyone’s information, wherever they are, and section 8 explains the extra rights some countries give.
Questions about this policy, or about your information: get in touch, or email support@modulefest.com.
2. What this policy does not cover: data inside our products
Our products run on your own website or installation. Anything you or your users put into them (club members, clients, pets, pupils, bookings, invoices and so on) is stored in your own database, on your own hosting. We do not host it, cannot see it and do not receive it. For that data, you (or your organisation) are the controller, and your own privacy notice applies.
This matters most for SEN School Manager, which holds information about pupils. That information stays on the school’s own site, and the school is responsible for it.
If you buy hosting with a product, your site runs on servers provided through our hosting service, Keen2Host, under its own terms.
3. What we collect, and why
Your account. Your name and email address, so you can sign in, buy a plan, see your licences and downloads, and raise support requests. You sign in with a password, or with a one-time code sent to your email address. Lawful basis: contract.
Orders and billing. Your email address, the product and plan you chose, your licence key, and records of your payments, subscriptions and refunds. Card payments are taken by Stripe: we never see or store your card details. Lawful basis: contract, and our legal obligation to keep accounting records.
Licences and updates. When one of our products is installed and connected to the Hub, it sends the site’s address, the product and its version, the licence key and plan, and a site token, so we can check the licence, offer updates and show you your sites. We record when each site last checked in. Lawful basis: contract, and our legitimate interest in stopping licences being misused.
Support requests and enquiries. Your name, email address, what you write to us, any files you attach, and our replies. You can reply by email, and we may ask whether your request was resolved. Lawful basis: contract where you are a customer; otherwise our legitimate interest in answering you.
Help from AI with support requests. To sort support requests and suggest replies, the text of a request may be sent to Google’s Gemini service. Email addresses and phone numbers are removed first, and our internal notes are not sent. A person reads and sends every reply. Lawful basis: our legitimate interest in answering support requests quickly.
Live demos. To open a demo you give your name and email address. Most demos record which screens you open, so we can see how the demo is used. Your name and email address are only linked to that activity if you tick the box to agree; otherwise it stays anonymous. Demo activity is deleted after 90 days. Lawful basis: consent for the link to your name; otherwise our legitimate interest in improving the demos.
Free trials. Your business name, email address and the kind of business, so we can set up your trial site and send reminders about when it ends. The trial site and everything in it are deleted when the trial ends, after any export window we have told you about. Lawful basis: contract.
Hosting and domains. If you order hosting or a domain with a product, the order details are passed to our hosting service to build the site, and your details are given to the domain registry as registration requires. Lawful basis: contract.
The website itself. Our web servers keep standard logs (IP address, browser and pages requested) for security and to keep the sites running. Lawful basis: our legitimate interest in keeping the sites secure.
We only email you about your account, orders, licences, trials and support requests. We do not sell your information or share it for advertising, and we do not use advertising or analytics tracking.
4. Cookies
We only use cookies that are needed for the sites to work, so there is no cookie banner to accept.
- WordPress sign-in cookies (names beginning
wordpress_) keep you signed in to your account. They last for your session, or longer if you choose to stay signed in. mf_sso_statelinks the sign-in page to the browser that asked for it. It lasts a few minutes.mfh_productandmfh_bare, on the Hub, remember which product’s help you were looking at and how the page should display. They last a day.mfh_sid, on the live demos, tells one visit apart from another. It lasts for the visit.
5. Who we share it with
We use a small number of service providers, who process information for us under contract and only as we instruct:
- Stripe: card payments, subscriptions, invoices and refunds.
- Google (Gemini): help with sorting support requests and suggesting replies, as described above.
- Our hosting and email providers: the servers that run modulefest.com, the Hub, the demos and our support mailbox.
- Keen2Host and domain registries: only if you order hosting or a domain.
We may also share information where the law requires it, or to protect our rights if there is a dispute.
6. International transfers
We are based in the United Kingdom, so if you use our sites or services from another country, your information is transferred to and held in the UK, which the European Union recognises as giving personal information adequate protection. Some of our providers, such as Stripe and Google, may also process information outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by approved contractual safeguards, such as the UK International Data Transfer Agreement or Addendum.
7. How long we keep it
- Account information: while your account is open.
- Payment and accounting records: six years, as UK tax law requires.
- Support requests: for as long as they help us support you and your products. Ask us and we will delete them, unless we need them for a dispute or a legal obligation.
- Demo activity: 90 days.
- Trial sites: deleted when the trial ends, after any export window.
8. Your rights
Wherever you live, you can ask us for a copy of your information, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. To use any of these rights, get in touch. We will reply within one month, and we will not treat you differently for asking.
Depending on where you live, local law may give you further rights, for example under the EU GDPR, the privacy laws of US states such as California, Canada’s PIPEDA or Australia’s Privacy Act. We will honour those rights as the law requires. We do not sell personal information, or share it for cross-context behavioural advertising, as those terms are used in US state privacy laws.
If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority in the country where you live. We would appreciate the chance to put things right first.
9. Keeping it safe
Our sites only use encrypted connections. Passwords are stored only in scrambled (hashed) form, sign-in codes work once and expire after 15 minutes, and access to customer information is limited to the people who need it to support you.
10. Children
Our sites and services are for businesses, clubs, schools and other organisations, not for children, and we do not knowingly collect information from anyone under 16, or under the age of digital consent where they live if that is higher.
11. Changes to this policy
We may update this policy from time to time; the “last updated” date at the top will change. If a change affects how we use information you have already given us, we will tell you before it takes effect.
12. Related pages
Our Terms of Service, Refund Policy and Disclaimer.