Privacy Policy
This Privacy Policy explains what personal data LetCode.run collects when you visit the website, buy a plugin, activate a license or contact us, why we use it and what rights you have under the EU General Data Protection Regulation (GDPR).
Who we are
The controller of your personal data is:
- DriveZone s.r.o.
- Registered office: Mírová 357, 517 50 Častolovice, Czech Republic
- Company ID (IČO): 21394164 (not registered for VAT)
- Registered in the Commercial Register kept by the Regional Court in Hradec Králové, file C 52676
- E-mail: [email protected] · Data box (datová schránka): 5vc3pt3
We sell WordPress plugins under the LetCode brand through the online store at letcode.run. We have not appointed a Data Protection Officer, as the law does not require one for our activities. For any privacy question, write to the e-mail above.
This policy covers the website letcode.run, our online store, customer accounts, license activation and plugin updates. It does not cover websites of our customers that use our plugins: each site owner is the controller for data of their own visitors.
What data we collect and why
We collect only the data we need to sell you a plugin, deliver it, keep it updated and answer your questions.
| Activity | Personal data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Purchase and checkout | Name, e-mail, billing address, company name, company ID and VAT ID (if given), order contents, price, payment status | Concluding and performing the purchase contract, issuing invoices | Contract, Art. 6(1)(b); legal obligation for invoices and accounting, Art. 6(1)(c) |
| Payment | Payment status and transaction ID; the last 4 card digits and card type as returned by Stripe | Processing and verifying the payment, refunds | Contract, Art. 6(1)(b) |
| Customer account | E-mail, name, password (stored only as a hash), orders, licenses, downloads | Access to your purchases, downloads and license keys | Contract, Art. 6(1)(b) |
| License activation and updates | License key, website address (URL) where the plugin is activated, plugin version, WordPress version, IP address of the server, activation dates | Validating the license, limiting activations, delivering automatic updates | Contract, Art. 6(1)(b) |
| Contact form and support e-mails | Name, e-mail, message and anything you choose to send us | Answering your question and providing support | Contract or pre-contract steps, Art. 6(1)(b); legitimate interest in replying, Art. 6(1)(f) |
| Blog comments | Name, e-mail, website (optional), comment text, IP address, browser user agent | Publishing comments and preventing spam | Legitimate interest, Art. 6(1)(f) |
| Website operation and security | IP address, browser and device data, pages visited, time of access (server and security logs) | Running the website, protecting it against attacks and abuse | Legitimate interest, Art. 6(1)(f) |
| Strictly necessary cookies | Session, cart and checkout cookies, login cookies, your cookie choice, security cookies of Cloudflare | Making the store and login work, keeping the site secure | Legitimate interest, Art. 6(1)(f); no consent needed for strictly necessary cookies |
What our plugins send. The plugins themselves do not send any data about visitors or members of your website to us. They contact letcode.run only to activate, check or deactivate your license and to look for updates, sending the data listed in the license row above.
Card details. Card payments are processed by Stripe. We never see or store your full card number or security code.
Cookies. We use only cookies that are strictly necessary for the website and the store to work, so we do not need your consent for them. The full list is in the Cookies section below.
Required data. Data marked as required at checkout is needed to conclude the contract and issue an invoice. Without it we cannot complete your order. Everything else is voluntary.
We do not use your data for automated decision-making or profiling, and we do not sell it.
Cookies and similar technologies
We use only strictly necessary cookies and no analytics, advertising or tracking cookies. This list reflects a check of the website on 1 November 2026.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| wordpress_logged_in_*, wordpress_sec_* | letcode.run (WordPress) | Keeps you signed in to your customer account | Until you close the browser, or 14 days with „Remember me“ |
| wordpress_test_cookie | letcode.run (WordPress) | Checks that your browser accepts cookies when you sign in | Until you close the browser |
| fct_cart_hash | letcode.run (store) | Remembers your cart during checkout | 12 hours |
| comment_author_*, comment_author_email_*, comment_author_url_* | letcode.run (WordPress) | Remembers your name and e-mail for your next comment – only if you tick that option | 1 year |
| __stripe_mid, __stripe_sid | Stripe, on the checkout page only | Prevents payment fraud | 1 year / 30 minutes |
| __cf_bm, cf_clearance | Cloudflare | Tells people from bots and protects the website against attacks; cf_clearance only after a security check | 30 minutes |
| lc_cookie_ok (browser local storage) | letcode.run | Remembers that you closed the cookie notice | Until you clear your browser data |
Fonts and emoji. Some fonts are loaded from Google Fonts and emoji images may be loaded from WordPress.org. These services set no cookies, but your browser sends them your IP address when downloading the files.
You can delete or block cookies in your browser settings. Without them, signing in, the cart and checkout will not work.
Who receives your data
Our store runs on our own WordPress website, so orders, accounts and licenses are stored on our hosting, not with a third-party store platform. We share data only with these recipients, and only to the extent they need it:
| Recipient | Role | Data | Location |
|---|---|---|---|
| Stripe | Payment processing (independent controller for payment data) | Name, e-mail, billing address, payment and card data you enter at checkout | EU (Stripe Payments Europe, Ireland); transfers to the USA possible |
| Webglobe | Web hosting and e-mail (processor) | All data stored on the website and in e-mails | [EU / Czech Republic – to be confirmed] |
| Cloudflare | Content delivery network and protection against attacks (processor) | IP address, browser data, requested pages | Global network, Cloudflare, Inc., USA |
| Google Fonts | Delivering web fonts | IP address, browser data | Google Ireland / Google LLC, USA |
| WordPress.org | Delivering emoji images | IP address, browser data | USA |
| Gravatar (Automattic) | Profile pictures next to blog comments | A hash of the commenter’s e-mail address | USA |
| Accountant / tax advisor | Bookkeeping and tax filings (processor or independent controller) | Invoice and payment data | Czech Republic |
| Public authorities | Tax office, courts, police – only when the law requires it | Data they are entitled to request | Czech Republic |
Transfers outside the EU. Stripe, Cloudflare, Google, WordPress.org and Automattic may process data in the USA. These transfers rely on the EU–US Data Privacy Framework where the company is certified, and on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR). You can ask us for more information about these safeguards.
How long we keep your data
| Data | Retention |
|---|---|
| Invoices and accounting records | 10 years from the end of the year of the sale, as required by Czech tax and accounting law |
| Orders, customer account, licenses | For as long as you have an account or an active license, then up to 3 years for possible claims |
| License activation data (site URL, versions, server IP) | While the license is active; removed or anonymised within 12 months after deactivation or expiry |
| Contact form and support e-mails | Up to 3 years after the last message |
| Blog comments | Until the comment is deleted; IP address and user agent of spam comments up to 30 days |
| Server and security logs | Up to 90 days, unless needed to investigate an incident |
| Cookies | Session cookies until you close the browser; others according to their set lifetime, at most 12 months |
After these periods we delete or anonymise the data.
How we protect your data
The website runs only over an encrypted connection (HTTPS). Access to the administration is limited to authorised persons and protected by strong authentication. We keep WordPress and all plugins up to date and back up the website regularly. Passwords are stored only as hashes, and we never see full card numbers.
Your rights
Under the GDPR you have the right to:
- Access – ask what data we hold about you and get a copy
- Rectification – have inaccurate or incomplete data corrected
- Erasure – have your data deleted where we no longer need it or have no legal reason to keep it (invoices must be kept for the period required by law)
- Restriction – ask us to limit the processing in the cases set by the GDPR
- Data portability – receive the data you gave us under a contract in a common machine-readable format
- Object – object to processing based on our legitimate interest; we stop unless we have compelling legitimate grounds
- Withdraw consent – where processing is based on consent, withdraw it at any time without affecting earlier processing
To exercise a right, write to [email protected] or send a message to our data box 5vc3pt3. We will reply within one month; for complex requests this may be extended by two more months, and we will tell you why. We may ask you to confirm your identity. Requests are free of charge unless they are clearly unfounded or excessive.
If you think we process your data unlawfully, you can lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic, or with the authority in your EU country.
Children
Our products are intended for website owners and developers. We do not knowingly collect data of persons under 16. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy when our services or the law change. The current version is always published on this page with its effective date. If a change significantly affects how we use your data, we will let customers know by e-mail.
Effective date: 1 November 2026