Data Privacy
Last updated: 14 October 2026
This privacy notice explains how we process personal data when you visit usemediatoolkit.com, contact us, purchase a subscription, use your customer account or connect a WordPress installation to our licensing and update services.
Who is responsible
Marcus Pohorely, trading as Media Toolkit e.U., is responsible for the processing described in this notice.
Kratkystrasse 8a
8020 Graz
Austria
For privacy questions and requests, contact [email protected].
Visiting our website
Requests to our website involve technical information such as your IP address, request time, requested page or resource, browser and operating-system information, referrer where supplied, and response information. We use this information to deliver the website, diagnose problems and protect the service against misuse.
Our hosting provider is Hetzner Online GmbH, Germany. Probots GmbH provides hosting and server administration on our behalf. Cloudflare, Inc., United States, provides network delivery and security services for our public domain. As website traffic passes through Cloudflare, it processes connection and request information. Its network may process information outside the European Economic Area.
The legal basis for necessary website delivery and security processing is our legitimate interest in operating a reliable and secure service under Article 6(1)(f) GDPR. Processing necessary to provide a service you request may also be based on Article 6(1)(b) GDPR.
Customer accounts and communications
We process your name, email address, account identifier, password hash, profile details and information needed to manage account access. WordPress also maintains authentication sessions, including session identifiers, login times and technical session information such as IP address and browser information.
When you contact us, we process your contact details, message and any information or attachments you choose to provide. Please avoid including unnecessary personal data, passwords or license secrets in support messages.
The legal basis is Article 6(1)(b) GDPR for your requested account, purchase or support relating to your contract. For general enquiries and communications with representatives of business customers, we rely on Article 6(1)(f) GDPR: our interest in responding to requests and managing customer relationships.
Payments and subscriptions
We use Stripe for hosted checkout, subscription billing and the billing portal. We transmit your name, email address and customer or order references needed to arrange the transaction. You provide payment and billing information, such as billing address and any tax identification details, directly within Stripe’s services.
We receive information needed to reconcile your purchase and provide the service, including transaction and subscription references, selected plan, payment status, amounts, billing-period dates and cancellation status. Our checkout implementation does not store your full payment-card details on our website.
Stripe processes payment, device and transaction information for payment processing, security, fraud prevention and its legal obligations. Depending on the activity, Stripe acts as a processor or as a controller for its own purposes. Relevant European Stripe entities include Stripe Payments Europe, Limited and Stripe Technology Company, Limited, Ireland. See Stripe’s Privacy Policy for details.
Our legal bases are Article 6(1)(b) GDPR for processing your purchase and subscription, Article 6(1)(c) GDPR for accounting and statutory record-keeping, and Article 6(1)(f) GDPR for investigating payment problems and protecting against misuse.
License activation, checks and updates
Connecting a WordPress installation to our licensing service sends its website address, a generated installation identifier, request identifiers and the credentials required to activate or verify the license. Our server records the association with your customer and license, activation status and relevant timestamps. Update requests and downloads also involve authorization information and the requested plugin release.
These requests necessarily expose connection information, such as the requesting server’s IP address. We use license information to provide the purchased service, manage website limits, make authorized downloads and updates available, and prevent unauthorized use. These licensing and update requests do not upload your media files, image texts or image metadata to us.
The legal basis is Article 6(1)(b) GDPR where processing is needed for your contract, and Article 6(1)(f) GDPR for legitimate license administration, service security and communications involving business customer representatives. If an automated license or payment check produces an incorrect result, you can contact us to have the issue reviewed.
Local image tools and optional cloud providers
MediaToolkit’s local media operations run on the WordPress installation where the plugin is installed. Optional cloud optimization sends images directly from that installation to the provider selected by its operator, currently Imagify or ShortPixel, using the operator’s provider credentials. Images may contain identifiable people and embedded metadata, including location information. The cloud adapters retain existing EXIF information.
Those image transfers do not pass through our licensing server. The website operator is responsible for selecting a suitable provider, establishing an appropriate legal basis and informing affected people about processing on that website. The selected provider’s terms and privacy information apply to its processing. This notice does not replace a customer’s own website privacy notice.
Essential cookies and consent choices
WordPress uses cookies needed for authentication and secure account access. Authentication-cookie names include wordpress_logged_in_* and wordpress_sec_*; a wordpress_test_cookie may be used to check browser support. The customer login uses persistent authentication, normally valid for 14 days, subject to logout and other session controls.
We use Borlabs Cookie to manage your choices for optional services. Its first-party consent cookie records a generated identifier and the selected choices; the configured lifetime is 183 days. Consent records may also include the time, consent version and services selected. You can change or withdraw your choices at any time through the cookie settings available on our website. Rejecting optional analytics does not prevent you from buying or managing a subscription.
Strictly necessary storage is used for the service or settings you request. The GDPR bases for associated personal-data processing are Article 6(1)(b) or Article 6(1)(f), as applicable; processing needed to comply with consent documentation obligations is based on Article 6(1)(c). Optional analytics storage and processing require your consent, including Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
Optional website analytics
We use Google Analytics 4 and PostHog to understand how our website is used and to improve it. These optional services are loaded only after you consent to the respective service. We do not use these services to record your sessions.
Google Analytics 4
With your consent, this service helps us understand page visits, referrals, device/browser characteristics and interactions. Google Ireland Limited, Ireland, supplies the European service; processing can also involve Google entities and infrastructure outside the EEA. Google states that GA4 does not log or store individual IP addresses from EU, Swiss or UK users, but it processes an IP address to derive location information before discarding it. Cookie names include _ga and _ga_*, currently configured with lifetimes of up to two years. Our configuration disables Google Signals and advertising personalization and removes query strings and fragments from page and referrer URLs. See Google’s privacy information.
PostHog
With your consent, PostHog, Inc., United States, provides website usage analytics through its EU Cloud endpoint. Our setup records page views, uses a pseudonymous browser identifier and strips query strings and fragments from page and referrer URLs. Session recordings, automatic interaction capture and person profiles are disabled. Its ph_*_posthog cookie is configured for 365 days. EU project hosting does not by itself exclude every international processing or support access. See PostHog’s privacy information.
The legal basis for optional analytics is Article 6(1)(a) GDPR. You can withhold consent or withdraw it at any time through our cookie settings for future processing. Withdrawal does not affect processing that was lawful before withdrawal. Cookie expiration does not determine how long server-side analytics information is retained.
Recipients and international processing
Access is limited to people and service providers who need information for the purposes described above. Relevant recipients include our infrastructure administrator Probots GmbH, Hetzner, Cloudflare and Stripe; Google and PostHog receive analytics information only after you have consented to the respective service. Authorities or professional advisers may receive information where required by law or necessary to establish, exercise or defend legal claims.
Providers processing personal data on our behalf are subject to data-processing agreements and may use the information only within their authorized scope. For transfers outside the EEA, we rely on an applicable adequacy decision or appropriate safeguards, such as EU standard contractual clauses, together with supplementary measures where required. The applicable mechanism depends on the recipient and processing involved. You can contact us to request details about the safeguards relevant to your data. Hosting a server in Europe does not mean that all suppliers process information exclusively in Europe.
How long we retain information
We keep account and license information while it is needed to provide and administer your account, subscription and license rights. After those purposes end, information may remain only where needed to comply with legal obligations or establish, exercise or defend legal claims. Cancelling an automatic renewal does not by itself close your account or delete its records.
Accounting records and invoices subject to Austrian retention requirements are generally retained for seven years, calculated in accordance with the applicable accounting rules. Relevant proceedings or other statutory requirements may require longer retention. That obligation does not automatically justify keeping every support message, website log or analytics record for seven years.
Ordinary website server logs are retained for no longer than 30 days. Specific records may be kept longer if necessary to investigate a security incident or establish, exercise or defend a legal claim. Website backups are retained for up to 30 days before being replaced or removed. Information deleted from the live website may remain in those backups until that period ends; backups are used for recovery, not ordinary customer operations.
Ordinary support enquiries are retained for up to 12 months after the enquiry is resolved. Correspondence that is part of accounting records, contracts or a dispute is retained under the relevant statutory or legal-claim requirements instead.
For Google Analytics 4, identifiable user-level and event-level data subject to its retention setting is retained for two months. This setting does not govern standard aggregated reports. PostHog analytics events are retained for up to 12 months. Non-identifying aggregate statistics may be kept longer. The cookie lifetimes described above are separate from these server-side retention periods.
Consent choices in the browser expire after 183 days. Records needed to demonstrate valid consent are kept while the processing relies on that consent and afterwards for the applicable period needed to establish or defend related claims. They are restricted to that evidential purpose after the relevant processing ends.
Your rights
Under the applicable conditions, you can request access, correction, erasure, restriction of processing and portability of your personal data. You may object, on grounds relating to your situation, to processing based on legitimate interests. You may withdraw consent at any time for future processing.
To exercise these rights, contact [email protected]. Where necessary, we may ask for information proportionate to verifying your identity. Some records cannot be erased immediately when statutory retention requirements or other lawful exceptions apply.
You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria: dsb.gv.at. You may also contact a competent authority in the country of your habitual residence, place of work or the alleged infringement.
Required information and updates to this notice
Account, order and license information needed to provide the requested service is required for that service. If you do not provide it, we may be unable to create the account, complete the purchase or activate the license. Optional analytics consent is not required to purchase or use the service.
We update this notice when the services or relevant processing change. The date above identifies this version.