Privacy Policy

1. Who we are

Stagatlast is an independent software brand operated by an individual developer based in China. Stagatlast develops and distributes StagLingo, a WordPress plugin that extends multilingual workflows used with TranslatePress.

For applicable data-protection law, Stagatlast is the controller of personal data collected through the Stagatlast website and our direct communications. You can contact us at hello@stagatlast.com.

2. Scope of this policy

This policy applies when you:

• visit the Stagatlast website or a page that links to this policy;
• contact us by email, a website form, or a support form;
• purchase, activate, renew, or manage a StagLingo license;
• opt in to product communications or plugin usage tracking; or
• use StagLingo Free or Premium.

This policy does not govern websites operated by StagLingo users. Each website owner is responsible for its own privacy notice, legal basis, and handling of the content and personal data it processes with WordPress, TranslatePress, StagLingo, and any selected AI provider.

3. Personal data we collect

Information you provide

• Contact and support data: your name, email address, website URL, license or order information, message, attachments, diagnostic information, and any other information you choose to send.
• Account and transaction data: contact details, billing details, purchase history, subscription status, license keys, activated websites, invoices, and related support records handled through Freemius.
• Communications: emails, replies, product feedback, survey responses, and your communication preferences.
• Newsletter data, if introduced: your email address, consent record, subscription status, and engagement data. We will identify the newsletter provider and update this policy before enabling that service.

Information collected automatically

• Server and security logs: IP address, date and time, requested URL, response status, browser or device information, referrer, and information used to detect abuse and maintain website security.
• Website usage data: pages viewed, session and interaction data, approximate location derived from IP address, referral source, campaign data, conversions, and cookie or similar online identifiers, subject to your consent where required.

4. Cookies, analytics, advertising, and embedded media

Cookies and similar technologies can store or read information on your device. We use necessary technologies to operate and secure the website. With your consent where required, we may also use the following categories.

We use Google Analytics 4 to understand website use and Google Ads conversion tracking to evaluate advertising performance. Google may process IP address, device and browser data, page activity, campaign information, cookie identifiers, and conversion events under its own policies. Where required, analytics, advertising, and external-media technologies remain disabled or limited until you make a choice through our consent tool.

You can change or withdraw your choice at any time through the “Cookie Settings” control displayed by our consent tool. You may also control cookies through your browser. Refusing non-essential cookies will not prevent basic use of the website, although analytics, campaign attribution, or embedded media may not work as intended.

Learn more in the Google Privacy Policy and Google’s explanation of data from sites that use Google services.

5. How the StagLingo plugin handles data

Local WordPress processing

StagLingo is installed on and primarily operates within the user’s own WordPress environment. Translation source rows, translated strings, URLs, import files, job state, history, validation reports, and backups are processed or stored on that WordPress site or streamed to the administrator’s browser. Stagatlast does not run a separate cloud database that receives this content as part of normal plugin use.

Direct AI-provider requests

If an administrator enables automatic translation, the WordPress server sends a request directly to the provider selected and configured by that administrator. StagLingo currently supports OpenAI, Google Gemini, Anthropic, and administrator-defined HTTPS endpoints that implement an OpenAI-compatible interface.

Depending on the feature used, a request may contain:

• selected source text and, during review, first-pass translations;
• the requested target locale, content type, and internal row identifiers;
• protected markup, placeholders, URLs, numbers, and structural context needed to preserve the page;
• rendered page text and compact verification results for scoring or enhanced review; and
• system instructions, quality rules, model name, and generation settings.

The API credential is sent directly from the user’s WordPress server to the selected provider for authentication. Stagatlast does not proxy these requests and does not receive the API key, prompts, source content, or model output. The selected provider’s terms, regional availability, retention, and data-use rules apply. Website owners should avoid sending personal, confidential, regulated, or third-party data unless they have an appropriate legal basis and provider agreement.

API-key storage

A saved API key is stored in the user’s WordPress database in encrypted form. The encryption key is derived from that WordPress installation’s authentication salts. StagLingo uses AES-256-GCM when available and falls back to Sodium secret-box. If neither supported encryption method is available, StagLingo does not save the key. New writes are not stored as plain text, and API keys are excluded from translation exports, reports, logs, and learned quality rules.

Manual download and upload workflow

Administrators may export translation files, process them manually or with a service of their choice, and upload the reviewed files to their WordPress site. Stagatlast does not control where an administrator sends a downloaded file. The administrator is responsible for reviewing the destination service’s privacy terms and protecting the exported content.

Local plugin retention and safeguards

• Staged CSV files and resumable import state expire after up to 48 hours.
• Protected diagnostic preview files expire after 30 minutes and are removed after commit or failure.
• Automatic-translation resume snapshots are limited to the five most recently updated jobs.
• Private pre-import translation backups are limited to the 20 most recent backups; older backups are removed as new ones are created.
• Learned quality rules are limited and designed to contain abstract conditions rather than page text, URLs, titles, names, row IDs, or model responses.

Plugin data is preserved on uninstall by default so an accidental removal does not destroy workflow state. A site owner can enable StagLingo’s explicit destructive uninstall option when permanent local cleanup is intended. WordPress database backups or host-level backups may retain deleted data for longer.

AI-provider policies

• OpenAI Privacy Policy and API data privacy information
• Google Privacy Policy and Gemini API Additional Terms
• Anthropic Privacy Policy and Anthropic Privacy Center

6. Purchases, accounts, licensing, and plugin telemetry

We use Freemius to provide checkout, payment processing, tax handling, subscriptions, invoices, customer accounts, license activation, software updates, and product support. Freemius and its payment processors collect and process the information needed for those services. Stagatlast receives customer, transaction, license, and support data needed to fulfil purchases and support customers, but does not receive or store full payment-card numbers.

The plugin may offer an optional Freemius opt-in for usage tracking. If accepted, Freemius may receive contact details and technical or usage information such as the site URL, plugin version and state, WordPress and PHP versions, site language, and information about the active environment. Where the plugin presents an opt-in, declining it does not disable StagLingo Free features. Information strictly required to validate and manage a paid license may still be processed when a paid license is used.

See the Freemius Privacy Policy and Freemius data-practices explanation.

7. When we share data

We disclose personal data only as reasonably necessary to:

• operate the website and provide the product, checkout, licenses, updates, and support;
• measure website use and advertising performance, subject to consent where required;
• protect users, investigate abuse or fraud, and secure our systems;
• comply with law, legal process, or enforceable government requests; or
• complete a reorganization, acquisition, or transfer of the business, with appropriate notice and safeguards.

If we later add a newsletter platform or live-chat provider, we will update this policy and our consent controls before the provider begins collecting visitor data. Hostinger’s practices are described in its Privacy Policy.

8. Legal bases for processing

Where the GDPR, UK GDPR, or a similar law applies, we rely on:

• Contract: to process an order, provide a license, deliver updates, and respond to service requests.
• Legitimate interests: to operate and secure the website, prevent fraud, improve StagLingo, and provide non-marketing customer communications, where those interests are not overridden by your rights.
• Consent: for non-essential cookies, analytics, advertising technologies, optional usage tracking, and marketing email where consent is required.
• Legal obligation: for tax, accounting, consumer-protection, sanctions, fraud-prevention, and lawful disclosure requirements.

9. International data transfers

Stagatlast is operated from China, and the website is currently hosted on servers in the United States. Freemius, Google, Hostinger, email providers, payment processors, and user-selected AI providers may process information in the United States and other countries. These countries may have privacy laws different from those where you live.

Where required, we rely on provider contractual protections, approved transfer mechanisms, consent, or another lawful transfer basis. Users of StagLingo are responsible for assessing international transfers created by the AI provider and service plan they choose for their own website content.

10. How long we keep data

We retain personal data only for as long as reasonably necessary for the purpose described in this policy, including to provide licenses and support, maintain security, resolve disputes, enforce agreements, and comply with tax, accounting, and other legal duties.

• Account, purchase, invoice, and license records are kept while the account or license is active and afterwards as required for business and legal records.
• Support and contact records are kept while the issue is active and for a reasonable period afterwards to maintain service history and handle disputes.
• Marketing contact data is kept until you unsubscribe, withdraw consent, or the list is retired; a minimal suppression record may be retained to honour your opt-out.
• Analytics and advertising data is retained according to our configured settings and the relevant provider’s retention rules.
• Server logs and backups are retained according to operational security and hosting schedules, then deleted or overwritten.
• Local StagLingo plugin files and records follow the limits described in Section 5 and remain under the website owner’s control.

We may retain data longer when required by law, necessary for a legal claim, or needed to investigate fraud, abuse, or a security incident. When retention is no longer needed, we delete, anonymize, or securely overwrite the data where reasonably practicable.

11. Security

We use reasonable technical and organizational measures intended to protect personal data, including access controls, encrypted connections where supported, restricted plugin file locations, credential encryption, data minimization, and service providers selected for operational security. No internet transmission or storage system can be guaranteed to be completely secure.

StagLingo users remain responsible for securing their WordPress installation, hosting, administrator accounts, backups, API accounts, and exported translation files. Please do not send passwords, full API keys, or unnecessary personal data in support messages.

12. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• request access to and a copy of your personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests or direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting earlier lawful processing;
• opt out of the sale, sharing, or use of personal data for targeted advertising where applicable; and
• complain to a competent data-protection authority.

To exercise a right involving data controlled by Stagatlast, email hello@stagatlast.com. We may request proportionate information to verify your identity and locate the relevant records. You may also need to contact Freemius, Google, an AI provider, or another independent controller directly for data held in that provider’s own account or systems.

We will not discriminate against you for exercising an applicable privacy right. Authorized agents may submit a request where permitted by law, subject to verification.

13. Children’s privacy

The website and StagLingo are general software resources for website owners and are not designed to solicit personal data from children. We do not knowingly collect personal data from a child below the minimum age at which the child may independently consent to online data processing under applicable law. This statement does not impose a blanket adult-only rule on reading the website or learning about WordPress.

If you believe a child provided personal data to us without the consent required by law, contact hello@stagatlast.com and we will review and delete it where appropriate. Third-party account and API services may apply their own age and eligibility requirements.

14. Third-party sites and services

The website and plugin may link to or integrate with third-party sites and services. Their privacy practices are governed by their own notices, not this policy. We encourage you to review those notices before creating an account, submitting data, purchasing a service, or sending website content to an external AI provider.

15. Changes to this policy

We may update this policy when the website, StagLingo, service providers, or legal requirements change. We will post the revised policy on this page and update the date at the top. If a change materially affects how we use personal data, we will provide additional notice where required, such as by email, account notice, or a prominent website message.

16. Contact us

Questions about this policy, a privacy request, or a concern about StagLingo data handling? Contact Stagatlast and include enough information for us to understand your request. Please do not include passwords or complete API keys.