This page is for customers in the European Economic Area, the UK and other regions with data protection law. It supplements the privacy notice. A signed data processing agreement is available through [DPA_URL_OR_PROCESS].
The plugin runs on your server
Mass Custom Fields is software you install on your own WordPress site. Field values, definitions, data tables, generated pages, AI results and settings are stored in your database and processed by your server. WPMass does not receive them, so for that data you, the site owner, are the controller and WPMass is not your processor. The plugin supports your obligations: user account and comment data is covered by the WordPress export and erasure tools, and you control retention and deletion, including the setting that deletes all data on uninstall.
What WPMass itself processes
Only data connected to licensing, support and the website:
- Account and license data: name, email, plan, license status and the sites a license is used on.
- Optional usage data you opt in to share through the Freemius SDK.
- Support correspondence you send us.
For this data WPMass acts as a controller, using the sub-processors below. Website data is covered by the privacy policy.
Sub-processors for WPMass services
Sub-processor | Purpose | Data | Location |
|---|---|---|---|
Freemius, Inc. | Sales, payments, taxes, invoices, license delivery and checks, opt-in usage data | Customer and billing data, license keys, site URL, plugin, WordPress and PHP versions, admin name and email if opted in | [FREEMIUS_LOCATIONS] |
[WEBSITE_HOSTING_PROVIDER] | Hosting wpmass.com | Website logs, form submissions | [HOSTING_LOCATION] |
[EMAIL_PROVIDER] | Support and newsletter email | Support correspondence, newsletter addresses | [EMAIL_PROVIDER_LOCATION] |
[ANALYTICS_PROVIDER] | Website analytics, only after consent | [ANALYTICS_DATA] | [ANALYTICS_LOCATION] |
We will update this list when sub-processors change and announce changes [NOTICE_METHOD], giving [OBJECTION_PERIOD] to object.
Providers chosen by the customer
These are not WPMass sub-processors. The plugin contacts them only when you use the feature, with your own accounts and keys. You decide whether to use them and under which agreement.
Feature | Provider | Initiated by | Note |
|---|---|---|---|
AI content (Pro) | OpenAI, Anthropic, Google Gemini | Your server, with your API key | Sends the task brief, field notes, the data row of each page and the field definitions. Sign the provider's data processing agreement if personal data may be in your data. |
Maps | OpenStreetMap (default) or Google Maps (needs your key) | The visitor's browser | The browser's IP address and user agent reach the map provider. Consider this in your cookie and privacy notices. |
oEmbed fields | The provider of the embedded URL, for example YouTube or Vimeo | Your server | Only the URL is sent. |
Google Sheets feeds (Pro) | Your server | Downloads the sheet you linked as CSV. | |
Page caches and other plugins | Your choice | Your server | Outside the plugin's data flows. |
Security measures in the plugin
Capability and nonce checks on every action, escaped output, prepared SQL, API keys stored encrypted, password fields never printed or exported, and background work in batches. These describe the product's design. They do not replace the security of your own hosting and backups.
International transfers
Where Freemius or another sub-processor processes data outside the EEA or UK, the transfer relies on [TRANSFER_MECHANISM].
Requests and contact
Send data protection requests about WPMass's own services to [PRIVACY_EMAIL]. Requests about data stored in a particular WordPress site must go to that site's owner.