Privacy Policy

Last Updated: January 1, 2026

This Privacy Policy describes how Paapi Product Search for Amazon ("we", "our", or "us") collects, uses, and protects your information when you visit our website (paapiplugin.com) or use our WordPress plugin.

Last revised May 16, 2026 to add a "Managed API data flows" section covering our optional managed Amazon API service.

Information We Collect

Website Visitors

When you visit our website, we may collect:

• Usage Data: Pages visited, time spent, browser type, device information, and referring URLs
• Cookies: Essential cookies for website functionality and analytics (see Cookies section below)

Plugin Users

When you use our WordPress plugin:

• API Credentials: Your Amazon Product Advertising API credentials (Access Key, Secret Key, Associate Tag) are stored locally in your WordPress database. We never have access to these credentials.
• Plugin Settings: Your theme preferences, customization options, and shortcode configurations are stored locally in your WordPress installation.
• License Information: If you purchase a premium license, your license key and site URL are processed through Freemius (see Third-Party Services below).

Customers

When you purchase our plugin:

• Account Information: Name, email address, and billing information
• Transaction Data: Purchase history, license keys, and subscription status
• Support Communications: Messages and tickets submitted through our support channels

How We Use Your Information

We use the collected information to:

• Provide and maintain our services
• Process transactions and manage subscriptions
• Send important updates about your purchase or license
• Respond to support requests
• Improve our website and plugin
• Comply with legal obligations

Third-Party Services

Freemius

We use Freemius to handle:

• Payment processing
• License management
• Plugin updates
• Customer support ticketing

Freemius is a trusted platform powering thousands of WordPress plugins and themes. When you purchase our plugin, your payment and account information is processed by Freemius. Your payment details are never stored on our servers.

For more information, see Freemius Privacy Policy.

Amazon Product Advertising API

Our plugin connects to Amazon's Product Advertising API to search and display products. When users search on your site:

• Search queries are sent directly from your server to Amazon's API
• No user data is transmitted to us
• Product data comes directly from Amazon

For more information, see Amazon Privacy Notice.

Managed API data flows

If you opt into the PaapiPlugin Managed API instead of supplying your own Amazon API credentials, search and product calls travel from your WordPress server to our proxy service rather than directly to Amazon. The Managed API is server-to-server. Your site visitors never connect to our infrastructure and we never see them.

What we receive on a Managed API call:

• The search keywords and ASIN identifiers your site requested.
• The Amazon Associate tag you registered when setting up the Managed API. We use it to tag outbound product links on your behalf.
• Your WordPress site URL, so we can attribute traffic to your account and enforce per-site quotas.
• The IP address of your WordPress server. This is the public IP of your hosting account, not the IP of any visitor on your site.
• Plugin version and a per-site API key we issue when you connect.

What we do not receive:

• End-visitor IP addresses.
• End-visitor cookies, browser fingerprints, or device identifiers.
• Email addresses, names, or any other end-visitor personal data.
• Form submissions, comments, account data, or any other content your visitors create on your site.

How we use this data: to deliver the requested product results to your site, to inject your Associate tag on outbound links so commissions flow to you, to enforce your quota, to operate our shared cache (which lowers cost and latency for everyone), to detect abuse, and to debug operational issues.

Retention. Operational logs that include the items above are retained for 30 days. After 30 days, only aggregated, non-identifying statistics are kept (for example: total calls per day across the service, aggregate cache hit rate, error counts by category). Aggregated data does not identify your site or your visitors.

Lawful basis. Where the EU General Data Protection Regulation applies, we process the items above under our legitimate interests in operating the service you have signed up to use (Article 6(1)(f) GDPR). The data we hold for the Managed API is, in our view, business operational metadata rather than personal data of natural persons in their private capacity. We have nevertheless documented retention, purpose, and contact channels here so you can evaluate that interpretation against your own compliance posture.

GDPR posture. Because the Managed API is server-to-server and we receive no end-visitor data, the privacy profile is materially lower than that of a typical software-as-a-service product that talks directly to visitor browsers. We do not act as a data processor on behalf of your site for end-visitor data, because we never receive any. If your jurisdiction requires you to maintain a record of processors, the Managed API does not typically need to appear there. If you would like a written confirmation of this for your records, please contact support.

The full usage terms for the Managed API are at paapiplugin.com/api-terms.

Analytics

We may use analytics services (such as Google Analytics) on our website to understand how visitors interact with our site. These services may collect:

• IP address (anonymized)
• Browser and device information
• Pages visited and actions taken

Cookies

Our website uses cookies for:

You can control cookies through your browser settings. Disabling certain cookies may affect website functionality.

Data Security

We implement appropriate security measures to protect your information:

• All data transmission uses HTTPS encryption
• Payment information is processed by PCI-compliant providers (Freemius)
• API credentials are stored locally on your own WordPress installation
• We do not store sensitive payment details on our servers

Data Retention

• Account Data: Retained while your account is active and as required for legal purposes
• Transaction Records: Retained for accounting and tax compliance (typically 7 years)
• Support Communications: Retained for reference and service improvement
• Analytics Data: Retained in anonymized form

Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at support@paapiplugin.com.

Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable laws.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date
• Sending an email notification for material changes (if you're a customer)

Contact Us

Additional Information for EU/EEA Users (GDPR)

If you are located in the European Union or European Economic Area:

• Legal Basis: We process your data based on consent, contractual necessity, legitimate interests, or legal obligations
• Data Controller: Paapi Plugin is the data controller for information collected through our website and services
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority

Additional Information for California Users (CCPA)

If you are a California resident:

• You have the right to know what personal information we collect and how it's used
• You have the right to request deletion of your personal information
• You have the right to opt-out of the sale of personal information (we do not sell personal information)
• We will not discriminate against you for exercising your privacy rights