Last updated: September 21, 2026

This Privacy Policy explains how PaywallProject (“we”, “us”, “our”) processes data when a WordPress site uses the PaywallProject plugin, and when a site owner uses our Stripe Connect service (the “Connect hub”).

1. Who we are

Who we are PaywallProject, MEDIAMAKR LLC DBA PAYWALLPROJECT. Contact: [email protected]

2. Sites that use their own Stripe API keys

If a site uses its own Stripe API keys, the plugin sends no data to us. Payments go directly from the site to Stripe.

3. Sites that use “Connect with Stripe”

When a site owner connects, disconnects or refreshes the Stripe connection, we receive:

  • the site URL;
  • the Stripe connection credentials and the connected Stripe account ID.

Before the site connects, the plugin asks the Connect hub for the platform fee rate, and it sends the site URL with this request.

While the site is connected, its Stripe API requests go through the Connect hub. The hub sends them on to Stripe and applies the 10% platform fee. These requests can contain data about the site’s readers: name, email address, and subscription and payment details (for example the plan, the amount and the payment status). We never receive full card numbers. Stripe collects card data directly.

4. Why we process this data

  • To connect the site to Stripe and keep the connection working.
  • To process payments and apply the platform fee.
  • To find and prevent fraud and abuse.
  • To meet our legal, tax and accounting obligations.

5. Legal basis

For site owners, we must process this data to perform our agreement with them. For readers of a connected site, we are a processor for the site owner. The site owner is the controller of their readers’ data and is responsible for telling their readers about it.

6. Who we share data with

We share data only with:

  • Stripe, to process payments (https://stripe.com/privacy);
  • our hosting and infrastructure providers, who keep the Connect hub running;
  • authorities, when the law requires it.

We do not sell data.

7. How long we keep data

  • Connection data: while the site is connected, and for 90 days after it disconnects.
  • Request logs: 30 days.
  • Financial records: for the period that the law requires.

8. Security

We send all data over HTTPS. Only authorised staff can access it.

9. International transfers

We can process data outside your country, including in the United States. When we do, we use appropriate safeguards, for example Standard Contractual Clauses.

10. Your rights

You can ask to see, correct, delete or export your data, and you can object to how we process it. To do this, use our contact page. If you are a reader of a site that uses PaywallProject, you can also contact that site’s owner. You can also complain to your local data protection authority.

11. Changes to this policy

If we change this policy, we will put the new version on this page and change the “Last updated” date.