Privacy policy

Scope and effective date

Effective 2 November 2026. This policy applies to PMScripts.com, PMS customer accounts, orders, licence activation, downloads, PMS Cookie Banner Lite and Pro classification, PMS Performance Lite and Pro update/licensing services, PMS Chat AI Lite and Pro update/licensing services, the PMS Chat AI assistant on this website, the partner programme, and support. This revision adds the Polish and Swedish versions of the website (the language stored with an order for subscription emails and the record of the language suggestion) and the hCaptcha check that Stripe runs inside its payment form (2 November 2026). The 30 October 2026 revision added the partner programme with its Agency plan and the download identifier and campaign recorded with consented downloads and orders, with a daily advertising report without personal data, and Pro code fingerprints and refused website addresses used against misuse of licences. The policy also describes the consent-based Google Analytics 4 and Meta measurement on this website (introduced on 27 October 2026), anonymous download and active-installation statistics, the website addresses we keep for installations of our plugins, and data transfers by Stripe, and names the free editions Lite throughout. Using the site does not constitute consent to optional processing; optional cookies and similar technologies require the choice presented in the consent interface.

Controller and contact

PMScripts is operated by Pikus Media AB, Stjärnbildsgatan 120 lgh 1002, 415 67 Göteborg, Sweden. Organisation number: 559478-7821. VAT number: SE559478782101. Email: help.pms@pikus.media. Telephone: +46 76 109 52 40. Pikus Media AB is the controller for the PMS store, accounts, licensing service and its own security logs. We have not appointed a data protection officer because our present processing does not require one; privacy enquiries can be sent to the contact above. A customer using PMS Cookie Banner on another website remains responsible for that website’s visitor data.

Data sources

We receive data directly from you when you create an account, place an order, enter company or VAT details, activate a licence, request support or submit a withdrawal or privacy request. Technical security data is generated when your browser or plugin connects to PMS. Stripe sends us payment status and transaction references; it does not give us your full card number.

Orders, payment and accounts

We process identity and contact details, account credentials, billing address, country, company and VAT information, order contents, amounts, currency, payment status and transaction references to enter into and perform the purchase contract. Accounting and tax data is also processed to comply with legal obligations. Required checkout data is necessary to accept and fulfil an order; without it we cannot complete the purchase. When you order from the Polish or Swedish version of the website, we store that language with the order so emails about your subscription are written in it.

EU VAT-number validation

When an EU business VAT number is supplied, we send the country code, VAT number and requester information required by the European Commission VIES service to validate it. We store the number, validation result, time, request identifier and hashes of any returned name or address as tax evidence; we do not use the returned business details for marketing. VIES is operated by the European Commission and the relevant national tax authority. See VIES.

Digital-delivery evidence

For a digital purchase we record whether the buyer expressly requested immediate delivery and acknowledged the applicable withdrawal consequence, the wording version and a UTC timestamp. This is retained with the order as contract and legal-claims evidence.

Licensing and downloads

Licence records contain the purchased product, website allowance, validity and activation details, including the website address of each activated installation. When WordPress on a website installs or updates a Lite plugin through PMScripts.com, WordPress itself includes the website address in its request; we keep that address with the product, version and date of last contact so we know which websites use our plugins (legitimate interest in supporting and securing our software). Pro plugins with PMS License Manager 1.1.22 or later also send their installed version with licence checks; we keep it with the installation so we can see which websites need an update. Downloaded packages may include a distribution identifier linked to the delivery record so we can investigate misuse. We process these records to deliver and protect the service; an identifier alone is not proof that a customer shared a file.

PMS Performance and customer installations

Optimization runs on your own hosting. WordPress.org Lite updates through WordPress.org without a PMS licence manager. Store Lite updates and Pro activation contact PMS with installation and licensing details, server IP and technical request information. Performance does not scan or classify cookies. Optional Pro Google Fonts preparation downloads fonts from Google on your server; Google receives the server IP and request headers. Existing remote font links can still contact Google until local preparation succeeds. You control these settings and remain responsible for your website privacy information.

PMS Chat AI and customer installations

PMS Chat AI runs on your own website. Visitor messages and answers go from your server to the AI provider you choose (OpenAI or Anthropic) with your own API key; PMS does not receive these conversations. Conversations stay in your WordPress database for the period you set, 90 days by default. Optional reCAPTCHA contacts Google. WordPress.org Lite updates through WordPress.org without a PMS licence manager; Lite downloaded from PMScripts checks a public update file on pmscripts.com. Pro activation, licence refresh and signed updates contact PMS with the product, site address, installation ID, licence key, installed version, a fingerprint of the Pro plugin code (to detect modified copies; it contains no site content) and technical request information. You remain responsible for your website privacy information; the plugin suggests text for your privacy policy.

Cookie classification

Cookie classification helps identify which services a website uses. It works with cookie names and script addresses, not cookie values, form entries or visitor consent records. In Lite it stays off until the administrator turns it on. In Pro it is on by default while the Pro licence is active, as a separately controllable service setting; saved administrator choices, including a disabled setting from Lite or an older Pro version, are preserved. The administrator can switch it off in Settings and help at any time. Disabling it stops new submissions and pending retries; the local inventory and visitor choices remain. A request contains a limited number of cookie names and resource addresses (Pro may include paths, without query strings or fragments), a pseudonymous installation ID and credential and, for Pro, the product, website address and licence credential. Cookie values, page content, form data and visitor consent records are not intentionally included. Cookie names and paths can nevertheless contain personal data; the receiving server also sees the request IP address and technical headers. We first compare observations with our own catalogue. If a cookie is still unknown and the AI fallback is enabled, a small batch of unknown cookie names, resource origins and the folder names of WordPress plugins or themes found in paths is sent to the OpenAI API in the background — without the licence credential or consent records, with response storage turned off (store=false, which does not by itself mean zero data retention). Before researching a name reported only by Lite installations, we check that it comes from more than one independent network, using a keyed one-way hash of part of the IP address; the IP address itself is not stored for this purpose. Accepted signed classifications are imported automatically after a completed scan; customers do not have to confirm each returned classification. Missing retention periods or provider privacy URLs remain explicitly unknown. Unresolved identities or categories remain private. Classification does not itself create a blanket script-blocking rule, and each customer remains responsible for reviewing their integrations and their own privacy policy. Raw requests are not stored in the licence database. Refused licence requests (for example a key used on another domain or beyond its site limit) are recorded with the licence ID and reason to prevent misuse. Recognised cookie descriptions stay in our shared technical catalogue for ongoing matching without automatic age or entry-count expiry; temporary request caches are kept separately.

Website chat assistant

PMScripts.com offers an AI chat assistant (PMS Chat AI). It starts only when you open it. When you write to it, we process your messages, the assistant’s answers and the time of each message to answer questions about our products, licences and policies. To answer, the assistant uses our public pages and shop catalogue. Please do not share sensitive data, payment details or licence keys in the chat.

Your messages, recent conversation history and the matching excerpts from our pages and products are sent to OpenAI, which generates the answer as our service provider. Requests are sent with response storage turned off (store=false); OpenAI may still keep abuse-monitoring logs as described in the retention section. Answers are produced automatically and can be wrong; prices and availability come from our shop. If you leave your name, email address or phone number in the chat, after agreeing to it in the chat, we save them with a short summary of the conversation and email them to our team so we can reply or call you back.

To protect the service against spam and excessive costs, we keep short-lived request counters based on a keyed hash of your IP address (for IPv6, its network part), and we can pause the chat for 30 minutes after repeated abuse. The legal basis is our legitimate interest in answering visitors’ questions and protecting the service, steps you request before a contract and, for the contact form, your consent, which you can withdraw at any time.

If you add a product to your cart, the assistant may read the cart on our own server to suggest one matching product, shown as a dot on the chat button; the cart is not changed and is not sent to OpenAI unless you write to the assistant. The chat keeps small markers in your browser for the current visit so that its greeting, hints and suggestions are not repeated too often.

Analytics and advertising measurement

With your consent we measure how visitors find and use PMScripts.com and which campaigns lead to Lite downloads and Pro purchases. With analytics consent, Google Analytics 4 (Google Ireland Limited) receives page views, the product page viewed, clicks on downloads and Pro plans, confirmed Lite downloads, cart and checkout steps and, for paid orders, the order number, amount, currency and products, together with an online identifier, approximate location derived from your IP address, device and browser information and campaign parameters such as utm_source or ad identifiers. With marketing consent, the Meta Pixel and the Meta Conversions API (Meta Platforms Ireland Limited) receive the same events. For the Conversions API our server sends them directly to Meta with your IP address, browser user agent, the _fbp and _fbc identifiers and, for orders, hashed contact details (email, phone, name, city, postcode and country) so Meta can match the event. Browser and server copies share an event ID so each event is counted once. A purchase is reported once per paid order; unpaid, failed and free orders are not reported. We send these events with PixelYourSite on our own server. Without consent these tools do not load, no server events are sent and downloads work normally. With the same consent, a Lite download from PMScripts.com carries a random download identifier and the campaign parameters of your visit, and an order records the campaign that brought you (source, campaign and ad identifiers and the landing page, or “unknown”); this is not linked to your name or email. Separately, we compile anonymous daily download statistics (counts per country and page) from our server logs, and we count active installations of Lite plugins downloaded from PMScripts.com from their daily update checks (counts per product and version, one per server address per day); the addresses are used only during counting and are not stored. Our host keeps these access logs for about seven days. We share a daily report with the agency that runs our advertising: per day, product and campaign it contains counts of downloads, paid orders, revenue and refunds — no names, email or IP addresses, order numbers or website addresses. You can change or withdraw consent at any time in Cookie settings. The legal basis is your consent. Google Analytics data is kept for the retention period set in our Google Analytics property, at most 14 months; Meta keeps data under its own terms. See the Google privacy policy and the Meta privacy policy.

Partner programme

If you take part in our partner programme, we process your name, email, company and tax details, address, bank account, partner code, referral statistics, commissions, payouts and the invoices or statements we issue, to run the programme, pay you and meet bookkeeping and tax obligations. The legal bases are the partner contract and our legal obligations. Invoices and payout records are kept for seven years after the end of the accounting year; other partner data until the partnership ends and any claims are settled. Partners sign in at pmscripts.com/partner and see only totals and their own commissions. If we invite an agency to the Agency plan, we keep the invited email address, our internal note and the status of the invitation until it is used or expires, and then with the order; the invitation link itself is not stored. Agencies with the Agency plan see only the client licences they issued; we keep the client name and website the agency enters with each licence for as long as the licence exists, so agencies should not enter personal data as a client name.

When you open a partner link or use a partner code, we save the partner code with your order so the right partner is credited; if you used several partners, the last one before your purchase is credited. Visits through partner links are counted per partner and day without storing IP addresses or other identifiers. The pms_ref cookie, which remembers the partner code and the time of your visit for up to 60 days, is set only with marketing consent; without it, the code is kept only during the current visit in page links and your cart session. Partners receive no personal data about customers. The legal basis is our legitimate interest in crediting and paying partners correctly and, for the cookie, your consent.

Support, withdrawals and security

Support correspondence, withdrawal notices and privacy requests are processed to perform the contract, comply with law and handle the request. IP address, timestamps, endpoint, device or browser information, error details and security events can be processed for our legitimate interests in operating, diagnosing and protecting the service. Optional analytics is processed only after consent.

Legal bases and required data

Contract is the basis for accounts, orders, delivery, licence activation, Pro classification and requested support. Providing the requested Lite classification and proportionate security, abuse prevention and legal claims rely on our legitimate interests in operating and protecting the service, balanced against the deliberately minimised technical data, limited retention for installation and security records, and your right to object. Legal obligation is the basis for accounting, VAT and statutory consumer records. Consent is the basis for optional analytics or marketing and can be withdrawn at any time. Fields marked as required at checkout are needed to conclude and perform the contract or determine tax; optional company and VAT fields are used only when supplied.

Recipients and international transfers

Authorised Pikus Media AB personnel and providers receive only the data needed for their role. LH.pl hosts the PMS service in the European Union. Stripe receives payment, device and fraud-prevention data under its own privacy policy and may process it in the United States under the EU–US Data Privacy Framework and standard contractual clauses. When the optional WooCommerce usage analytics is active and consented to, Automattic receives the anonymous identifiers described in the cookie policy. The European Commission VIES service and relevant tax authority receive VAT-validation data. With your consent, Google (Google Analytics 4) and Meta (Meta Pixel and Conversions API) receive measurement data as described under Analytics and advertising measurement; Google and Meta may process it in the United States under the EU–US Data Privacy Framework. Google (Gmail API, Google Workspace) delivers the emails we send, such as order, licence and support messages, and processes their recipients and content under its own privacy policy. Professional advisers may receive information needed for support, legal claims or compliance. When the optional AI classification fallback is enabled, OpenAI receives bounded unmatched cookie names and resource origins as described above. When you use the website chat assistant, OpenAI receives your chat messages and the data needed to answer them. OpenAI processing may involve locations outside the EEA; see the OpenAI data processing addendum and subprocessor list. Where personal data is transferred outside the EEA, an applicable adequacy decision or transfer safeguard such as standard contractual clauses is required. Contact us for details of the safeguards applicable to a particular processing activity.

Retention

Orders, invoices, VAT evidence, refunds and associated digital-delivery evidence are retained for seven years after the end of the relevant accounting year, or longer where a legal hold requires it. Licence and activation records are kept during the entitlement and afterwards only where needed for accounting, support, security or legal claims. Inactive account-free classification credentials are deleted after 180 days; keyed unique-fact limit records expire within 40 days and short-term request-limit records within about one hour. Recognized technical cookie descriptions are retained in the shared catalogue for ongoing matching without automatic age or entry-count expiry. Queued technical observations are deleted once researched; cookie names the model could not identify are not resubmitted for 30 days. Keyed network hashes used to count independent Lite reports are deleted after 90 days, and refused licence-request records, including the website address that was refused, after 90 days. Scheduled cleanup removes only temporary copies, not the catalogue. Incorrect or obsolete descriptions can be corrected after review. OpenAI API store=false does not exclude abuse-monitoring retention; its published data controls allow such logs for up to 30 days, subject to applicable account controls and exceptions. Support correspondence and privacy-request evidence are reviewed and normally deleted or anonymised within 24 months after closure unless a longer period is necessary. Application security logs are normally retained for up to 90 days unless an incident requires preservation. Website addresses of installations of our plugins are kept while the installation contacts PMS and deleted 12 months after its last contact. Website chat conversations and chat contact requests are deleted automatically 90 days after the last message in the conversation; chat request counters expire within about one hour, and usage-cost records kept for budgeting contain no message content. Browser consent choices expire after 180 days. We erase or anonymise data when its stated purpose and any mandatory retention period end.

Automated decisions

Pikus Media AB does not use customer data for solely automated decisions producing legal or similarly significant effects. Stripe can use automated fraud-prevention systems when processing a payment. Contact us if you want a failed or disputed payment reviewed.

Rights and complaints

Depending on the legal basis and applicable exceptions, you may request access, correction, erasure, restriction or portability, object to processing, or withdraw consent without affecting earlier lawful processing. We may need proportionate information to verify identity. We normally respond within one month and will explain any lawful extension or refusal. Contact us using the details above. You may complain to the Swedish Authority for Privacy Protection at imy.se or, where applicable, the supervisory authority in your EEA country.

Children

The PMS store is intended for adults and business users. We do not knowingly solicit personal data from children or offer products directly to children. Contact us if you believe a child supplied personal data without appropriate authority.

Changes to this policy

We publish material changes on this page with a new effective date. A change does not retroactively alter the legal basis for processing or the terms that applied to a completed order.

Cookies and customer installations

See the cookies section below. Visitor consent records created by the plugin on a customer website remain in that customer’s WordPress database and are separate from the PMS licensing service.

Browser privacy-choice persistence

On PMScripts.com, category consent is valid for 180 days. The localStorage record is not automatically deleted when validity ends; it is ignored as an expired consent and replaced on a new decision, or removed when browser storage is cleared. Separate privacy opt-out and Global Privacy Control preferences have no automatic expiry and remain until changed or browser storage is cleared. A live Global Privacy Control signal continues to apply.

Local consent and privacy-request records

Our WordPress database records privacy choices using a random decision identifier, action, category choices, time, policy version and language. Decision records become eligible for scheduled deletion after 180 days. Separate privacy-request records are kept for at least 24 calendar months and become eligible for cleanup after 730 days. These plugin records do not include an IP address, browser user agent, email or account identity; hosting security logs are handled separately. Local abuse-protection hashes expire after 120 seconds. Scheduled cleanup can run later if WordPress scheduling is delayed.

Cookie policy

Review date

Reviewed 2 November 2026. This inventory covers cookies and localStorage, which have different expiry mechanisms. Expiry of consent validity is not the same as automatic deletion of a stored record.

How this website uses storage

Under the Swedish Electronic Communications Act, non-essential cookies and similar storage are used only after informed consent. Necessary storage supports consent choices, authentication, the cart, payment security and delivery requested by the visitor. Analytics storage is blocked until analytics consent. Until you choose, PMS Cookie Banner sends Google Consent Mode v2 signals set to denied; Google Analytics loads only after analytics consent and Meta advertising tags only after marketing consent. Rejecting optional technologies does not block access to the store.

Current inventory

Cookie or storage	Provider and purpose	Category	Typical duration
pmcb_consent_v1 (localStorage)	PMScripts — stores the visitor’s category choices and policy version.	Necessary	Choice valid for 180 days; stored record remains until replaced or browser storage is cleared
pmcb_privacy_v1 (localStorage)	PMScripts — remembers Global Privacy Control and separate privacy choices.	Necessary	No automatic expiry; until changed or browser storage is cleared
pmcb_state	PMScripts — passes the visitor’s consent categories and policy version to the server, so PixelYourSite server-side events follow the choice. Contains no identifier.	Necessary	Expires with the consent (up to 180 days)
pms_lang_hint (localStorage)	PMScripts — remembers that you closed or used the suggestion to view the site in Polish or Swedish, so it is not shown again.	Necessary	Until browser storage is cleared
pmcai_token (localStorage)	PMScripts — keeps your open conversation with the website chat assistant after you open the chat or send a message.	Necessary	Until you end the conversation or clear browser storage
pmcai_teased, pmcai_teaser_next, pmcai_hinted, pmcai_nudged, pmcai_nudges (sessionStorage)	PMScripts — limits how often the website chat assistant shows its greeting, hints and cart suggestions during your visit.	Necessary	Until you close the browser tab
storeApiNonce / storeApiCartData / storeApiCartHash (localStorage)	WooCommerce — keeps the shop cart and its security token in the browser for the cart and checkout blocks.	Necessary	Until replaced or browser storage is cleared
pms_display_currency	PMScripts — remembers the display currency explicitly selected by the visitor.	Necessary	1 year
woocommerce_cart_hash	WooCommerce — detects changes to the shopping cart.	Necessary	Browser session
woocommerce_items_in_cart	WooCommerce — indicates whether the cart contains a product.	Necessary	Browser session
wp_woocommerce_session_*	WooCommerce — links the browser to its requested cart session.	Necessary	By default, 2 days
wordpress_logged_in_* / wordpress_sec_*	WordPress — authenticates signed-in customers and administrators.	Necessary	Until the authentication session expires
wp-settings-* / wp-settings-time-*	WordPress — remembers administration interface settings for signed-in users.	Necessary	By default, 1 year
tk_ai	WooCommerce / Automattic — assigns an anonymous identifier for first-party administration usage analytics when that feature is active.	Analytics	Browser session
tk_qs	WooCommerce / Automattic — keeps short-lived first-party usage-analytics session state when that feature is active.	Analytics	Typically 30 minutes
__stripe_mid	Stripe — helps prevent payment fraud.	Necessary	By default, 1 year
__stripe_sid	Stripe — helps assess fraud risk during the payment session.	Necessary	By default, 30 minutes
m	Stripe — recognises a browser for payment-fraud prevention. Set only in Stripe context.	Necessary	About 13 months (set by Stripe)
hmt_id, __cf_bm, __cflb (hcaptcha.com)	hCaptcha (Intuition Machines), loaded by Stripe inside the payment form at checkout — checks that a person makes the payment, to prevent fraud. Set only in Stripe context.	Necessary	hmt_id about 30 days; __cf_bm about 30 minutes; __cflb short-lived
sbjs_*	WooCommerce order attribution — stores campaign and referral information. Blocked until analytics consent.	Analytics	According to the active attribution settings
_ga, _ga_ESP9SKE06D	Google Analytics 4 — distinguishes visitors and sessions to measure website use. Set only after analytics consent.	Analytics	Up to 2 years
pms_campaign_v1 (sessionStorage)	PMScripts — keeps the campaign parameters of the visit (such as utm_source or an ad identifier) so downloads and Pro plan clicks can be attributed. Set only after analytics or marketing consent.	Analytics / Marketing	Until you close the browser tab
pms_campaign	PMScripts — the same campaign parameters and the landing page, read once when you place an order so the order records which campaign brought you. Set only after analytics or marketing consent and removed when consent is withdrawn.	Analytics / Marketing	30 days
pms_ref	PMScripts partner programme — remembers which partner referred you (partner code and time of the visit) so the partner can be credited for a purchase. Set only after marketing consent.	Marketing	60 days
_fbp	Meta Pixel — identifies the browser to measure ads and conversions. Set only after marketing consent.	Marketing	90 days
_fbc	Meta Pixel — stores the click identifier when you arrive from a Meta ad. Set only after marketing consent.	Marketing	90 days
lastExternalReferrer, lastExternalReferrerTime (localStorage)	Meta Pixel — remembers the last external referring website for ad attribution. Set only after marketing consent.	Marketing	Until browser storage is cleared
pbid, pys_*, pysTrafficSource, pys_landing_page, last_pysTrafficSource, last_pys_landing_page	PixelYourSite — stores the traffic source, landing page, session and an external ID used to attribute ads and conversions. Set only after marketing consent.	Marketing	Up to 7 days; pbid according to the PixelYourSite settings

Providers and data involved

First-party PMS and WooCommerce storage handles consent state, account or cart identifiers and attribution data. Stripe can receive device, browser, IP and payment-session information for fraud prevention. Automattic usage analytics receives anonymous identifiers and administration usage events only when that optional feature is active and consented to. No optional category is activated merely because this policy is viewed.

Changing your choice

Use the privacy settings control below to reject optional categories, save a new choice or withdraw consent as easily as it was given. Accept and reject choices are presented at the same level. Removing browser storage can sign you out or empty the cart.

Technical limits

The inventory reflects the current PMS store configuration. A provider can change technical names or durations, so we review it after material site or provider changes. A detected service name does not by itself prove that every related script is blocked.