1. Who We Are
OptiUser is the company behind the Opti-Behavior WordPress analytics plugin. The data controller for the processing described in this policy is EI , Entrepreneur individuel (micro-entreprise), SIREN 907 746 382, 16 rue de Concarneau, 29200 Brest, France. Our website is https://optiuser.com/. For any privacy-related inquiries, contact us at contact@optiuser.com.
2. The Opti-Behavior Plugin — Your Data Stays on YOUR Server
The Opti-Behavior plugin is a self-hosted WordPress analytics solution. This means:
- All visitor analytics data (clicks, scrolls, heatmaps, session recordings, funnels, form interactions, errors) is stored locally on your WordPress server — in your own database or file system.
- No recordings, IP addresses, page content or form data are ever sent to OptiUser, our API, or any third party, except the visitor IP address used for country lookup (section 3.2). Only exception: Opti-Behavior Pro sends one random session ID per saved recording to count your quota (see 3.1).
- You are the sole data controller for all analytics data collected by the plugin.
- The plugin works without cookies by default (session-based tracking).
- IP anonymization is available and configurable in plugin settings.
3. External Services Used by the Plugin
The plugin connects to external services in limited, well-defined circumstances. No recordings, IP addresses, page content or form data are ever sent to OptiUser, our API, or any third party, except the visitor IP address used for country lookup (section 3.2). Only exception: Opti-Behavior Pro sends one random session ID per saved recording to count your quota (see 3.1).
3.1 OptiUser API (api.optiuser.com)
- Install tracker: After a site administrator clicks “Accept & Continue” on the plugin’s welcome screen, the plugin sends a status message to api.optiuser.com once every 24 hours. It contains: your site URL, plugin type (free/pro), the Free and Pro plugin version numbers, whether Pro is currently running, your WordPress and PHP versions, and one administrator email address of the site (none is sent if no valid address is found). No visitor data is included. We use it to count active installations, plan compatibility, manage Pro trials and licences, and send emails about your installation (welcome and getting-started tips, trial and licence reminders, and a reminder if the site stops sending data). Every email has a one-click unsubscribe link. Our emails currently use an open-tracking pixel and click tracking. You can object at any time by writing to contact@optiuser.com.
- Deactivation notification: When the plugin is deactivated, a notification is sent to update the installation record.
- Pro trial: If the “Activate my free 6-month Pro Trial” box is ticked on the welcome screen, the plugin sends your domain, site URL, site name, an administrator email address and a technical encryption key to create the trial licence.
- Pro download access: When a WordPress admin requests to download Opti-Behavior Pro from an upgrade page, the plugin sends the site URL, admin username, and admin email to generate a one-time access code.
- Pro license management: Opti-Behavior Pro contacts api.optiuser.com to activate and check your license or trial: site domain, license key, installation ID, plugin versions, and, after each saved recording, the recording’s internal session ID (a random identifier) so it counts towards your quota. Once a day, Pro also sends a signed licence check: installation ID, plugin type, Free and Pro versions, whether Pro is running, WordPress and PHP versions, and a first-week activity flag (yes / no: at least one page view recorded in the 7 days after installation). While Pro is active, the Free plugin does not send the install tracker message described above. No email address, recordings, IP addresses, page content or form data are sent. Legal basis: performance of our contract (GDPR Art. 6(1)(b)) for licence, update and compatibility checks; our legitimate interest (Art. 6(1)(f)) for the WordPress and PHP versions and the activity flag, used to plan compatibility and improve the product. You can turn off the activity flag in the Pro settings (License tab) or object at any time by writing to contact@optiuser.com.
- Customer account: When a Pro trial is started from the plugin, the administrator email address the plugin sends (see “Pro trial” above) is also used only to send you, when you request it on optiuser.com, a sign-in link to “My account”. This sign-in link is valid for 1 hour and is deleted within 7 days. When “My account” opens, we send once, to holders of an active trial started in the plugin, a service email with a link to create their account (legal basis: performance of the trial). The link works once, expires after 7 days and is deleted at the latest 14 days after it was sent. Your account is only created when you click the link; your trials and licences are then linked to it. Actions on your account are recorded in a security log (date, action, IP address). IP addresses are hashed after 30 days. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Released Pro licences: see section 6.
3.2 IP Geolocation (ip-api.com)
- Used only when a visitor location cannot be determined from CloudFlare headers.
- Only the visitor IP address is sent. Results are cached for 1 hour.
- Service: ip-api.com (fallback: ipwho.is) — Terms & Privacy
3.3 OpenStreetMap Tiles
- Used only in the WordPress admin when you view the visitor map. Not used on the frontend.
- Your browser makes standard HTTP requests to OpenStreetMap tile servers.
- Service: openstreetmap.org — Privacy Policy
4. Data We Collect on optiuser.com
When you visit optiuser.com or interact with our services, we may collect:
- Pro registration data: WordPress admin username, email address, and site URL — provided when you register for a Pro trial or download. Used solely for license management and support.
- Install tracking metadata: Site URL, plugin type, plugin versions, WordPress and PHP versions, and one administrator email address. Used for installation statistics, compatibility planning, licence management and the emails described in section 3.1.
- Standard web server logs: IP address, browser user-agent, and request timestamps when you visit optiuser.com. Retained for security and debugging purposes.
5. How We Use Your Data
- To generate and validate Pro trial licenses
- To provide Pro plugin updates and download access
- To understand plugin usage (e.g., WordPress/PHP version distribution)
- To send the emails about your installation described in section 3.1 (legal basis: our legitimate interest in supporting users of our plugin; you can unsubscribe or object at any time).
- To respond to support inquiries
- To improve the plugin and our services
We never sell, rent, or share your data with third parties for marketing or advertising purposes.
6. Data Retention
- Install tracking data: Kept after the plugin is deactivated (the record is marked as deactivated) until you ask us to delete it at contact@optiuser.com. We are working on an automatic deletion period and will update this policy when it is in place.
- Pro trial requested on optiuser.com (name, email address, site domain, licence key): kept while your trial is active, then for 12 months after it ends, then deleted or anonymised automatically. If you buy a licence, the paid licence rule below applies instead.
- Paid licence data (name, email address, site domain, licence key): kept while your licence is active, then only as long as needed to handle support and possible disputes (legal limitation periods). Invoices are kept for 10 years, as required by French accounting law.
- Trials started from the plugin, licence keys and activated domains: kept while your trial or licence is active, then only as long as needed for support, fraud prevention and our legal obligations.
- My account: Your account is kept while a trial or licence linked to it is active, then deleted automatically 12 months after the last one ends. An account with no linked trial or licence is deleted after 7 days. Security logs are kept for up to 12 months, with IP addresses hashed after 30 days. Invoices are kept separately for as long as accounting law requires. You can ask us to delete your account at any time.
- Released Pro licences: When a Pro licence is released from a domain, we keep only a keyed hash (HMAC-SHA256) of the e-mail address linked to that installation, never the address in clear. We use it solely to check that an address you enter matches, so we can send you an account-recovery link. It is deleted when the licence is registered again, when the installation record is deleted from our system, or 12 months after release at the latest. When you request a recovery link, the address is stored encrypted (AES-256-GCM) and deleted when the link is used, or by our routine maintenance once it has expired (the link is valid for 1 hour). Legal basis: our legitimate interest in letting you recover your account and preventing account takeover (Art. 6(1)(f) GDPR), and performance of our contract when we send the link you requested (Art. 6(1)(b) GDPR).
- Marketing consent: if you agree to hear from us, we keep a record of your consent (date and e-mail address) until you withdraw it, and as long as needed to prove it.
- Server logs: Retained for up to 90 days.
7. Your Rights
You have the right to:
- Access the data we hold about you
- Correct any inaccurate data
- Delete your data from our systems
- Export your data in a portable format
- Object to processing of your data
To exercise any of these rights, contact us at contact@optiuser.com. We will respond within 30 days.
8. Cookies
The optiuser.com website uses only essential cookies required for basic website functionality (e.g., WordPress session cookies). We do not use advertising cookies, tracking cookies, or third-party analytics on this website. The Opti-Behavior plugin itself does not use cookies by default.
9. Security
We implement appropriate technical and organizational measures to protect your data, including HTTPS encryption for all API communications, Ed25519 signed download tokens for secure file delivery, and HMAC-SHA256 access code verification.
10. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.
11. Contact
For any questions about this privacy policy or our data practices:
