EVOSOLVE KFT.
Privacy policy
Effective 3 October 2026 · Updated 31 October 2026 · Information for the current website.
Who is responsible
Evosolve Korlátolt Felelősségű Társaság (Evosolve Kft.), 6722 Szeged, Kálvária sugárút 19., Hungary, is the controller of personal data processed through aipluginfactory.com. Contact [email protected] for privacy questions or to exercise your rights. Company registration: 06-09-024422.
Browsing and security
Our hosting and security services process technical information such as your IP address, requested URL, time of access, browser information and, when supplied by your browser, the referring page. We use it to deliver the website, detect abuse and investigate failures or attacks. The legal basis is our legitimate interest in operating a reliable and secure website (GDPR Article 6(1)(f)). Technical data is needed to deliver the page you request.
When you contact us
If you email us, we receive your email address, message and any details or attachments you choose to send. Our plugin idea form sends your description, optional workaround, optional email address and your acceptance of the Ideas and suggestions section of our Website terms to [email protected], and our support form sends your email address, the topic you choose and your message to the same address. Neither form saves a separate submission record in WordPress or adds IP addresses or browser details to the email. Hosting and security logs still apply as described above. We use your information to answer you or consider the idea, and respond where appropriate, not to add you to a mailing list. General correspondence relies on our legitimate interest in handling business enquiries and product suggestions (GDPR Article 6(1)(f)); steps you request towards a contract, and the licence you give us for an idea under those terms, rely on Article 6(1)(b). Keeping a record of ideas we receive, to show what was sent and agreed if a claim about an idea arises, relies on our legitimate interest in establishing and defending legal claims (Article 6(1)(f)). Providing information is voluntary; a description is needed to submit an idea, and we cannot reply without an email address. Please do not send passwords, access keys, sensitive personal information or client data.
Store: customer accounts and orders
When you create a customer account or buy a licence, we process your name, email address, billing address and country; your company name and VAT or tax number if you buy for a company; your login details (the password is stored only as a one-way hash); your orders, licence keys, downloads and invoices; your confirmation at checkout that delivery may start immediately; and the IP address and browser identifier (user agent) recorded with each order. When you download Pro from My account, the time and your IP address are recorded.
We use this data to conclude and perform the contract, deliver the licence and support, and manage your account (GDPR Article 6(1)(b)); to issue invoices, keep accounting records and prove the VAT treatment, as Hungarian accounting and VAT law requires (Article 6(1)(c)); and to prevent fraud and misuse and to establish or defend legal claims, which are our legitimate interests (Article 6(1)(f)). The details marked as required at checkout are needed to conclude the contract and issue the invoice; without them we cannot sell to you.
We send the emails your order and account need: the order confirmation, the licence and download, the invoice, password resets and replies to your messages. They are sent through our hosting provider’s mail service. We do not send newsletters or marketing emails.
Store: payments through Revolut
Payments are processed by Revolut: for merchants in the European Economic Area, such as us, by Revolut Bank UAB (Lithuania), part of the Revolut group. Revolut processes your card or Revolut Pay details as an independent controller under its own privacy notices. Its card payment form is loaded from Revolut’s servers into the checkout page, so Revolut also receives technical data from your browser for security and fraud prevention; for its fraud checks it uses the service kaptcha.com, which sets a cookie (see the Cookie policy). We receive the payment result and a payment reference, and may receive the card type and its last four digits; we never receive your full card number or security code.
Revolut Pay checkout privacy notice ↗ Revolut customer privacy notice ↗ Cookie policyStore: invoices through Számlázz.hu, reported to NAV
Invoices are issued and stored electronically through Számlázz.hu, a service of KBOSS.hu Kft. (1031 Budapest, Záhony utca 7., Hungary), which processes the invoice data on our behalf and emails the invoice to you. An invoice contains your name and address, your tax or VAT number if you buy for a company, the items and the amounts. Invoice data is reported to the Hungarian tax authority (Nemzeti Adó- és Vámhivatal, NAV) as Hungarian VAT law requires (GDPR Article 6(1)(c)); NAV processes it as a separate controller.
Számlázz.hu privacy notice ↗Store: VAT number checks (VIES)
If you enter an EU VAT number, it is checked automatically with the European Commission’s VIES service, which asks the tax authority of the issuing country. The check sends the VAT number, with our own VAT number as the requester. We keep the result and the VIES consultation number with your order as proof of the VAT treatment (GDPR Article 6(1)(c)). The check only decides whether VAT is added to your order.
VIES VAT number check ↗Pro: licence activation and updates
When you activate a Pro licence, your website sends our licence service the licence key, the site address, and the plugin name and version. It sends the same data once a day and when WordPress checks for updates, and the key and site address when you free a site. While Pro’s reliable timing is on (it is unless you switch it off in Marketing Studio > Settings > Reliable timing), your website also sends the key, the site address and the time its next scheduled post is due, whenever that time changes and once a day. Our server then calls your site’s WordPress scheduler (wp-cron.php) at that time. We keep only the latest time for each site and delete it when the site is freed. With each request we also receive the IP address of the server your website runs on and its technical identifier (user agent), which names the WordPress version and the site address. Pro sends nothing else: not your posts or other content, and not your visitors’ data.
We keep the activation records (site address, server IP address, user agent, plugin name and version, and dates) to manage the number of activated sites and deliver updates (GDPR Article 6(1)(b)), while the licence is valid and for one year after it ends; then we delete them. To stop abuse of the licence service, which is our legitimate interest (Article 6(1)(f)), we also keep a log of the latest 200 requests. Each entry holds the time, the action and its result, a shortened (anonymised) server IP address, an 8-character fingerprint derived from the key (never the key itself), the site address and the plugin name and version. Older entries are overwritten automatically. Counters that limit the number of requests expire within an hour.
Each copy of Pro you download carries two values derived from your licence, so that we can tell which licence a copy came from if it appears elsewhere. The plugin sends nothing because of them. We keep the link between these values and your licence and order for as long as we keep the order records (8 years under accounting law), as our legitimate interest in protecting our software (Article 6(1)(f)).
Cookies and tracking
We use necessary storage for security and to remember acknowledgement of our cookie notice. In the store, necessary cookies keep your cart, checkout and login session working. We do not use analytics, advertising trackers or marketing cookies on this site. The Cookie policy explains the storage and controls. Apart from the automatic VAT number check described above, which only decides whether VAT is added to an order, we do not use personal data for automated decisions or profiling. We do not sell personal data.
Who receives data
Hetzner Online GmbH provides website hosting, our mail service and the server that wakes Pro sites for reliable timing. Cloudflare, Inc. delivers and protects the website as a content delivery and security network and processes the technical data of every request. For the store, Revolut, KBOSS.hu Kft. (Számlázz.hu), the Hungarian tax authority (NAV) and the European Commission’s VIES service receive the data described above, and our external accountant receives invoice and payment records to keep our books. Wordfence, provided by Defiant Inc., supplies website security and may receive technical and security information when its services detect or investigate threats. Correspondence is handled through our business email service and by authorised company personnel. Professional advisers or authorities may receive information where needed to meet a legal obligation or establish or defend a legal claim. We limit information to what the purpose requires.
International processing
Defiant Inc. is based in the United States, so Wordfence security processing may involve a transfer outside the European Economic Area. Defiant publishes standard contractual clauses for its customers. Cloudflare, Inc. is also based in the United States; its data processing addendum includes standard contractual clauses. You can ask [email protected] for information about the safeguards applicable to your data. Our use of service providers is subject to the GDPR requirements for processing and international transfers.
Marketing Studio: connecting Facebook and Instagram
Evosolve Marketing Studio is a free WordPress plugin that runs on your own website. This section applies only if you choose its optional “Connect with Facebook” button. That connection service is planned for a later version, after Meta’s app review, and is not available yet. When you press the button, a small service on aipluginfactory.com, run by Evosolve Kft., completes the Facebook login for you using our Meta app “Evosolve Marketing Studio”, so you do not need to create your own Meta app. For this one step, Evosolve Kft. is the controller of the data described below. What your site does with its Facebook Page afterwards is under your control: posts are published directly from your site to Meta, not through our server.
Marketing Studio: what passes through our relay
Only when you press the button, our service handles: your Facebook user ID; the IDs and names of the Facebook Pages you choose to connect, and the ID of a linked Instagram professional account if you connect one; the Page access token that allows your site to publish to the Page; your website address; and a one-time key, generated by your site, to which the token is sealed so that only your site can open it. It also receives the temporary login code that Facebook issues for this login. We do not receive your Facebook password, your messages, your friends list or your posts.
Marketing Studio: purpose and legal basis
We use this data only to complete the connection you asked for and to hand the result straight back to your website. The legal basis is that processing is necessary for steps taken at your request (GDPR Article 6(1)(b)). Providing the data is voluntary: if you do not want to use the service, use your own Meta app instead. We do not sell the data, use it for advertising or profiling, or use it for any other purpose.
Marketing Studio: what we keep
Nothing is stored. The data above is held in memory for the length of one request, passed back to your website and then discarded. It is not written to a database, a file or an application log, and access tokens are never logged. Like every request to this website, a request to the service appears in standard web-server access logs kept by our hosting provider, which record the IP address, time and requested URL. They are kept under the rotation described in “How long information is kept”. Your access token is returned to your site in a form submission, not in a web address, so it does not appear in those logs. The one-time Facebook login code is part of a web address and may appear there; it can be exchanged only once.
Marketing Studio: who receives it
Meta Platforms Ireland Limited operates the platform you connect to. It receives your Facebook login and the requests made through the connection, and it handles that data under its own terms and privacy policy as a separate controller. Our hosting provider and security service process technical request data as described under “Who receives data”. No one else receives the data, and we do not share it for any other purpose.
YouTube and TikTok connection (Marketing Studio Pro)
Marketing Studio Pro is adding publishing to YouTube and TikTok (in development). When you connect your YouTube channel, Marketing Studio uses YouTube API Services to upload the videos you approve to your own channel. By connecting, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's Privacy Policy (https://policies.google.com/privacy) applies to Google's processing. We ask only for permission to upload videos (youtube.upload). When you connect your TikTok account, Marketing Studio uses TikTok's Login Kit and Content Posting API to post the videos you approve, under TikTok's Terms of Service and Privacy Policy, and you choose the privacy settings of each post in TikTok's posting screen.
The connection works like the Facebook connection above: the access Google or TikTok gives is encrypted for your own website and handed to it; our server does not store it, and posts go from your website straight to YouTube or TikTok. We do not use this data for advertising, sell it or use it to train AI models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in Marketing Studio, and revoke access in your Google Account (https://myaccount.google.com/permissions) or in TikTok under Settings, Security, Manage app permissions.
Marketing Studio: your own Meta app, and your own site
The connection service is optional. If you create and use your own Meta app, no data from that connection reaches us. Either way, Marketing Studio stores your access tokens only in your own WordPress database, encrypted, and nowhere else. You can remove them with Disconnect in the plugin or by deleting the plugin. Our Data deletion page at https://aipluginfactory.com/data-deletion/ explains the steps, including how to remove the app’s access in Facebook.
Marketing Studio: your rights and who to contact
Your rights are described in “Your rights” below and apply to this service too. Because the connection step keeps nothing, we normally have nothing to give you or delete beyond ordinary server logs. You can still ask: email [email protected] and we will answer within one month. The controller is Evosolve Kft., 6722 Szeged, Kálvária sugárút 19., Hungary.
Marketing Studio: audit log on your website
Marketing Studio keeps a time-stamped log of actions taken with it, such as content being generated, edited, approved, scheduled or published, and by which user. The log is stored in the database of your own website. It keeps fingerprints (hashes) of content rather than the content itself. As website owner you control the log. It is kept for 5 years by default, and you can change that period in the plugin settings. Nothing from this log is sent to us.
Marketing Studio: AI providers you connect
Marketing Studio can use an AI provider that you connect yourself, for example OpenAI, Google Gemini or others. When you use one, the prompts, page facts and images you choose to send go directly from your website to that provider, under that provider’s terms and privacy policy. They do not pass through our servers, and we do not receive them. Which provider you use, and what you send to it, is your choice.
How long information is kept
Our retention policy is to review ordinary enquiries and delete them within 12 months after the matter is closed, unless an ongoing relationship, legal obligation or dispute requires longer retention. Technical logs are retained according to the hosting and security services’ rotation settings and the period needed to investigate an incident. Relevant records may be isolated and kept for an active investigation or legal claim; they are deleted when that purpose ends. Backups expire through the normal backup cycle. Plugin ideas, with the acceptance of the Ideas and suggestions terms, are kept for 5 years after they are sent, the general limitation period under the Hungarian Civil Code (Act V of 2013, Section 6:22), and then deleted. Cookie notice acknowledgement expires after 180 days. In the store, account data is kept while your account exists. Orders, invoices and the accounting records based on them are kept for at least 8 years, as the Hungarian Accounting Act requires (Act C of 2000, Section 169), and then deleted; the IP address, user agent and checkout confirmation stay with the order for the same period. Complaint records and our replies are kept for 3 years (Act CLV of 1997, Section 17/A). Licence activation records and the request log are kept as described above. We do not keep correspondence merely to build a marketing list.
Your rights
Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction of processing and portability. You may object to processing based on legitimate interests, including for reasons relating to your particular situation. Where consent is used, it can be withdrawn without affecting the lawfulness of earlier processing. Email [email protected]; we may ask for proportionate information to verify your identity. Erasure does not cover invoices and order records that we must keep by law; we keep those until the legal period ends and then delete them. To close your customer account or receive a copy of your account data, write to [email protected]. We normally respond within one month and will explain any lawful extension or reason a request cannot be fulfilled.
Complaints
You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary; postal address: 1363 Budapest, Pf. 9.; website: https://www.naih.hu/. You may also contact the supervisory authority in the EU country where you live or work, or where an alleged infringement occurred, and seek a judicial remedy.
Updates
This policy covers this website, its store and customer accounts, the licence service used by our paid add-ons, the plugin idea and support forms and the optional Marketing Studio connection service described above (planned for a later version). We will update it before introducing analytics or another material change to data processing.