About this policy
Last updated: 28 October 2026.
This policy explains which personal data symelo.com processes, why, how long it is kept and who receives it, and the rights you have under the EU General Data Protection Regulation (GDPR). We collect only what the site needs: there are no advertising or tracking cookies, and we don't sell personal data or use it for advertising.
Who is responsible
Symelo LTD, a company registered in Bulgaria (VAT number BG207464756), ul. Makedonia 66, ap. 51, Plovdiv, Bulgaria, is the controller of the personal data described here: it decides why and how the data is processed. For any question about your data, or to use your rights, write to [email protected].
What it covers
The website symelo.com in English and Bulgarian, its free tools and APIs, the downloads of our WordPress plugins and themes, and the update check of the Symelo plugins downloaded from this site. Other websites we link to have their own rules.
Visiting the site
Every request your browser sends carries some technical data: your IP address, the address of the page or file, the time, your browser's user agent (its name, version and operating system), your language settings and, when you follow a link, the page you came from.
Cloudflare
All traffic to symelo.com passes through Cloudflare, Inc., which delivers and caches the pages, encrypts the connection and filters attacks and abusive bots. Cloudflare processes the request data above on our behalf and keeps it under its own terms. It also adjusts the pages it delivers: it hides email addresses from harvesters and decodes them in your browser, asks browsers to report failed connections to it, can add a script that measures page loading and counts visits without cookies (Cloudflare Web Analytics), and can set a short-lived security cookie (such as __cf_bm or cf_clearance) when it checks whether a visitor is a bot.
Our server
Behind Cloudflare, the site and its database run on a server we manage. All connections are encrypted (HTTPS). The site's code doesn't write visits or IP addresses to its logs or its database; the only records of visits it keeps are the statistics described below, which contain no IP addresses.
Purpose and legal basis
We need this data to deliver the site and keep it secure. The legal basis is our legitimate interest in running a reliable and secure website (Article 6(1)(f) GDPR).
Plugin and theme statistics
We count how our WordPress plugins and themes are viewed and downloaded, to see which ones people use and how they find them. These statistics set no cookies and store nothing in your browser.
What is recorded
Views of the Tools & Resources page, the plugin pages and their documentation, the themes index and the theme pages; downloads of plugin and theme zip files; and, on the themes index, the searches you type (up to 80 characters), the filters you choose and the previews you look at. Each record holds the page or file and its version, the language of the page, the time, your country (two letters, from Cloudflare), the device type (desktop, tablet or phone), whether the browser looks like a bot, and the website you came from (its domain only) or, for a download, the page on symelo.com where you started it.
No IP addresses
Your IP address and user agent are not stored. The server combines them with a secret key and the date and keeps only the resulting one-way code, so that one browser counts as one visitor on one day. The next day the same browser gets a different code, so visits on different days can't be linked. We don't use the code to identify anyone.
Legal basis and retention
Our legitimate interest in knowing which of our free plugins and themes are used, so we can improve them (Article 6(1)(f) GDPR). The records are kept to compare use over time and are not deleted automatically. As they contain no IP addresses, names or cookies, we usually can't tell which records, if any, relate to you (Article 11 GDPR).
Plugin updates
Copies of the Symelo WordPress plugins downloaded from symelo.com check this site for new versions.
The update check
About twice a day, a WordPress site with one of these plugins requests that plugin's update file (/wordpress-plugins/{plugin}/update.json on symelo.com). Its user agent names the WordPress version, the plugin and the plugin's version (WordPress/{version}; {plugin}/{version}); the site's address is not sent. Like any request, it reaches Cloudflare and our server with the IP address of the server the WordPress site runs on. The site's code doesn't record these checks.
Downloading an update
When the WordPress site installs an update, it downloads the new zip file from symelo.com, and WordPress sends the site's address in the user agent of that download. The download is counted in the statistics like any other: the IP address and user agent are used only for the daily code and are not stored.
Legal basis
Our legitimate interest in delivering updates, including security fixes, to the plugins you installed (Article 6(1)(f) GDPR). You can stop the checks by deactivating or deleting the plugin.
Contact form and email
When you send the contact form, we receive your name, your email address, the kind of inquiry, for a project the budget range and the needs you tick, the demo you mention, if any, and your message, together with the language of the form.
What we do with it
The message is saved in our database and emailed to us with your address as the reply address, so we can answer you, and you receive a confirmation email with a copy of what you sent. If you're signed in, the message is linked to your account and shown in your user panel. We may add a status and internal notes to it.
Email provider
Our mailbox [email protected] is hosted on Google Workspace, so the messages you send us directly and our replies are stored there.
Protection against abuse
To prevent floods and duplicates, we keep short-lived counters of submissions, identified by a one-way code of your email address (and of your account, if you're signed in). They expire within a day and are then removed automatically. Each saved message also keeps a one-way code of its content, so the same message isn't accepted twice in a day.
Legal basis
Answering your inquiry and, for a project, taking the steps you ask for before a contract (Article 6(1)(b) GDPR); for other messages, our legitimate interest in answering the people who write to us (Article 6(1)(f)). We need your name, email address and message to reply; without them we can't answer.
How long we keep it
Messages are not deleted automatically. We keep a message and our notes on it while they're relevant to the conversation or to work that follows from it, and delete them when you ask, unless the law requires us to keep them (for example, accounting records for paid work). Google keeps copies of the emails under its own retention rules.
Accounts and sign-in
The site has no public sign-up form. People who have an account sign in through Clerk, Inc., our authentication provider.
What Clerk processes
Your email address, your name and profile picture if you add them, the details you sign in with and, for each session, your IP address, browser and device, so that Clerk can keep you signed in and protect the account. Passwords are handled by Clerk; we never see them.
Cookies
Signing in sets Clerk's session cookies (such as __session and __client_uat). They are needed to keep you signed in and are cleared when you sign out or they expire. Clerk sets its cookies only when you sign in or open the user or admin panel, and its scripts run on our pages only for signed-in visitors.
Legal basis and retention
Providing the account you use (Article 6(1)(b) GDPR) and keeping it secure (Article 6(1)(f)). Account data is kept while the account exists; write to [email protected] to have it deleted.
Tools and APIs
The JSON Viewer, Text & Code Diff Checker, HTML Cleaner, QR Code Generator and Password & Random Generator run entirely in your browser: what you enter in them is not sent to us.
Kept in your browser
Some tools remember settings or work on your device only, in your browser's local storage: the JSON Viewer keeps up to eight recent documents when you save them, for up to seven days; the Diff Checker keeps its options; the SMTP Test Tool keeps the form, but never the password. If you rearrange the tiles on the Tools & Resources page, their order is kept in a first-party cookie (symelo-tools-order) for a year. This data stays on your device (the cookie holds only the order of the tiles), and you can clear it in your browser at any time.
Domain Registration Checker
The domain names you check are looked up by our server in the registries' public registration data services (RDAP), found through IANA's directory; the registries see our server, not you. Answers are cached by domain name for as long as the registry allows and are not linked to you. To share the service fairly, the browser version sets a cookie, __Host-symelo_domain_visitor, holding a random code, for a year. We store only a one-way code of it, with usage counters that are removed after a week without use; the record itself is deleted after a year.
Domain API keys
If you create API keys, we store each key's name, a one-way code of its secret (never the secret itself) and its creation, expiry, last-use and revocation dates, linked to your browser's code. A key stops working when it expires (after 1 to 365 days) or when you revoke it; the records are not deleted automatically.
SMTP Test Tool
The SMTP test connects from our server to the mail server you name, signs in with the login you enter and, if you ask, sends one test email with the sender, recipient, subject and text you choose. These details and the server's replies are used only for that test and returned to your browser; nothing is saved on our server or written to its logs. To prevent abuse, the server keeps in memory (never on disk) a one-way code of each recipient address, so that no address gets more than three test emails an hour.
Placeholder Image Generator
Image addresses are answered like any other request. The settings in the address, including any text you put on the image, are used to draw it, and the image may be kept in a size-limited cache on our server so that the same address loads faster. When another website shows one of our images, its visitors' browsers request it from symelo.com.
Legal basis
Running the tools you use (Article 6(1)(b) GDPR) and protecting them from abuse (Article 6(1)(f)).
Who receives personal data
We don't sell personal data or share it for advertising. It reaches only these service providers, each for its own part of the site:
- Cloudflare, Inc.: delivers and protects the whole site;
- Clerk, Inc.: sign-in, for people with an account;
- Google (Google Workspace): hosts our mailbox, [email protected].
The domain names you check go to the registries that hold them, and the details of an SMTP test go to the mail server you name, as described above. We also disclose data where the law requires it, for example to a court or a public authority.
Transfers outside the EU
Cloudflare, Clerk and Google are based in the United States and may process data there or in other countries. These transfers rely on the safeguards in their data processing terms, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- receive the data you gave us in a common machine-readable format and have it sent to another controller;
- object to processing based on our legitimate interests, such as the statistics.
Write to [email protected]. We answer within one month, and may ask you to confirm that the data is yours, for example by writing from the email address you used.
Complaints
If you think we handle your data unlawfully, you can complain to the Commission for Personal Data Protection (CPDP), the supervisory authority in Bulgaria, at https://www.cpdp.bg, or to the supervisory authority of the EU country where you live or work. We'd be glad to hear from you first.
No automated decisions
We don't make decisions about you by automated means, and we don't build profiles.
Children
The site is meant for adults and businesses. We don't knowingly collect personal data from children; if you think a child has sent us personal data, write to us and we'll delete it.
Changes to this policy
We update this policy when what the site does with personal data changes. The date at the top shows the latest version.