Privacy Policy — Feinwerk Plugins

Last updated: 26 September 2026

Applies to the Feinwerk Plugins store (plugins.feinwerk.io), including the customer account, checkout and the connector interface. The website feinwerk.io has its own privacy policy.

1. Controller

Feinwerk, Peter Boehlke, Carl-von-Linde-Straße 32, 85716 Unterschleißheim, Germany, email: info@feinwerk.io (“Feinwerk”).

2. Principles

The Store does not use web analytics or tracking tools, does not embed services of advertising networks and does not create profiles. Analytics data (visitor data) from your Matomo instance is not automatically transmitted to Feinwerk by the Plugins; it stays in your instance. The exception is content you submit yourself, such as bug reports with screenshots (clause 7a).

3. Server logs

When you access the Store, the web server processes the following as technically necessary: IP address, time, requested URL, HTTP status, referrer and user agent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operation, error analysis and defence against attacks). The logs are deleted after 14 days at the latest unless a security incident requires longer retention.

4. Cookies and sessions

The Store only sets technically necessary cookies (session cookie, CSRF protection; in the logged-in area also the “remember me” cookie, if selected). Legal basis: Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR. The Store does not set analytics or marketing cookies. On the checkout page, Paddle may set its own cookies required for the payment process; Paddle is responsible for these (clause 6).

5. Customer account

When you register, or when an account is created automatically as part of a purchase, Feinwerk processes your name, email address and password (hashed) as well as the instances, licenses, purchases and settings assigned to the account. Legal basis: Art. 6(1)(b) GDPR. The data is deleted when the account is deleted, unless statutory retention obligations (e.g. Sections 147 AO, 257 HGB for business records) prevent this.

6. Payment processing via Paddle

Paid licenses are sold via Paddle as merchant of record: Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, or, for buyers based in the USA or Canada, the respective local Paddle company. Paddle is an independent controller for payment processing and processes, among other things, name, email address, billing and payment data and tax information. An adequacy decision of the European Commission exists for the United Kingdom (Art. 45 GDPR). Details: https://www.paddle.com/legal/privacy.

Feinwerk receives from Paddle the data needed to provide the license (email address, product, transaction and subscription status); legal basis: Art. 6(1)(b) GDPR. When you open the checkout page, the checkout script is loaded from Paddle’s servers; in the process, your IP address is transmitted to Paddle (Art. 6(1)(b) GDPR).

7. Connector interface (your Matomo instance)

The Connector in your Matomo instance communicates with the Store to deliver Plugins and keep them up to date. The following is processed: instance token, instance URL, Matomo and Plugin versions, time of the update check, download events, license status and, to check license limits, the number of Matomo users of your instance (only the number, no user data). Legal basis: Art. 6(1)(b) GDPR. This data is assigned to the instance, not to individual persons.

7a. Bug reports

Via the Connector, you can send bug reports about a Plugin to Feinwerk. This involves processing the title and description, the Plugin, Matomo and PHP versions, the assignment to your instance and up to three screenshots if you attach any. Screenshots may show content of your Matomo interface; please redact personal data before sending. The purpose is to analyse and fix the reported bug. Legal basis: Art. 6(1)(b) GDPR, for free Plugins Art. 6(1)(f) GDPR (legitimate interest in bug-free software). Bug reports are deleted as soon as they are no longer needed to fix the bug.

8. Emails

Feinwerk sends transactional emails (e.g. account creation, purchase confirmation, update notices for installed Plugins) to the account email address (Art. 6(1)(b) GDPR). Promotional emails are only sent with consent (Art. 6(1)(a) GDPR) or within the scope of Section 7(3) UWG and can be unsubscribed from at any time.

9. Web fonts (Bunny Fonts)

Fonts are loaded via Bunny Fonts (BunnyWay d.o.o., Slovenia/EU), an EU-based service that, according to its own information, does not store logs of personal data. Your IP address is transmitted when the fonts are loaded. Legal basis: Art. 6(1)(f) GDPR (consistent, fast presentation). Details: https://fonts.bunny.net

10. Plugin delivery

The Plugin packages are built and delivered on Feinwerk’s servers; no connection to third parties such as GitHub is made when your instance downloads them.

11. Recipients, hosting

The Store is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Germany. A data processing agreement (Art. 28 GDPR) is in place with Hetzner; legal basis for hosting: Art. 6(1)(b) and (f) GDPR. Data is only transferred to other third parties as described in this policy (Paddle, Bunny Fonts) or where required by law.

12. Retention

Unless stated otherwise above, Feinwerk stores personal data only for as long as necessary for the stated purposes and deletes it afterwards; statutory retention periods remain unaffected.

13. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent given at any time with effect for the future. To exercise your rights, simply contact info@feinwerk.io. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for Feinwerk is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Obligation to provide data; automated decisions

Providing the data is necessary to perform the contract; without it, the account, purchases and updates cannot be provided. No automated decision-making, including profiling, takes place.

15. Language versions

This privacy policy is available in German and English. The German version prevails.