Kava: Free Multi-Purpose WordPress ThemeFree
WordPress · Theme
Squarespell policy
Privacy Policy
Last updated
What this covers, in short: we keep as little as the site can run on, we do not sell anything about you, and every outbound product link takes you to somebody else's site under their policy. The detail is below.
1 Who we are and how to reach us
Squarespell is an independent website-product catalogue. It lists plugins, templates and tools, tests some of them, and links out to the creators who sell them.
The operating legal entity is not yet stated on this page. It will be added before launch; until then the contact address below reaches the people who run the site.
For anything about this policy, or to make a request about your information, write to info@squarespell.com.
2 What we collect
The list below is exhaustive for the parts of the site we built. It is written from the code rather than from a template, so if something is not named here, the site does not record it.
Everyone who visits
- Ordinary web-server request logs: the IP address the request came from, the page asked for, the time, the browser's user-agent string, and the referring page where the browser sends one. These are the standard records a web server keeps in order to serve pages and investigate abuse.
- Anonymous aggregate homepage placement totals: the day, event type, public product or creator ID, homepage slot, and a count. These cover viewable Sponsored and Featured placements, their clicks, Squarespell Original and affiliate outbound actions, the seller call to action, and newsletter start/success. They do not contain an IP address, user-agent, referrer, cookie, account, email address or visitor ID, and cannot be reconstructed into a person's history.
- There is no third-party analytics product installed: no Google Analytics, no Matomo, no pixel and no session recorder, so no behavioural profile is built and no visit is attributed to an individual.
A Sponsored or Featured impression is counted only after at least half the placement has been visible for about one second. The page uses a short-lived signed placement token to prevent arbitrary catalogue IDs being submitted; the token contains public placement facts only and is not stored as visitor history.
Things your own browser stores, which never reach us
- Your light or dark theme choice, under the key squarespell-theme.
- The list of products you have saved, under the key squarespell-saved, held as product ID numbers.
Both are browser local storage on your own device. They are not cookies, they are not sent with any request, and we cannot read them. Clearing your browser storage deletes them and there is nothing on our side to delete.
If you subscribe to the newsletter
- Your email address, and the date the record was created. Nothing else: no name, no interests, no source page.
- Addresses are stored privately in this WordPress installation. No email marketing service is connected to this site at present, so your address has not been shared with one.
If you buy something we sell directly
- Order details handled by WooCommerce: what was bought, the price, the billing details you enter, the order status, and any file you were given access to download.
- Checkout is available without creating an account. If you do create one, the account record and its order history are kept until you ask us to remove them.
Card payments on this site are processed by Stripe, and PayPal, Amazon Pay, Klarna and Link are also available at checkout. Your card number is entered directly into the processor's own form and is never stored on this site; we keep the order, the billing details you enter, and the processor's reference for the payment. Each processor handles your payment data under its own privacy policy.
If you apply to list a product
- The fields on the seller application form: your name, work email, creator or business name, business website, product name and URL, platform, product type, pricing model, description, demo and documentation URLs, whether you run an affiliate program and its details, whether you are interested in Sponsored or Featured placement, an optional coupon and asset URL, and your answer on why the product fits.
- Your two confirmations, that you are authorised to represent the product, and that you accept the submission terms, together with the version of those terms you accepted.
- The date the application arrived.
- A one-way hash of your IP address. The address itself is never written down. The hash exists only so repeated submissions from one source can be rate-limited.
If we approve your application and invite you as a creator
Approval is a decision a person makes. There is no public sign-up: an account exists only because an administrator created or linked one after reviewing your application.
- A WordPress user account holding your username, the work email from your application, and a display name. We never generate, store or email a password, WordPress sends you a one-time link so you set your own, and we never see it.
- The link between that account and your original application, plus which administrator approved it and when. This is an audit trail: it is how we can say who granted access and on what date.
- The account can do two things: sign in, and submit product information. It cannot see orders, customers, other creators' submissions, or anything else in the site's administration.
If you submit product information as an approved creator
- Everything you enter on the product submission form: the product's name, URLs, description, classification, compatibility and delivery details, features, limitations, pricing, assets, and any accessibility or data-handling information you provide. Most of this is information about a product rather than about you.
- Your commercial answers, affiliate program details, a visitor coupon, and whether you are interested in Sponsored or Featured placement. These are kept apart from the catalogue's scoring and are not an input to how anything ranks.
- Which account submitted it, which application it came from, when it arrived and when it was last changed, the version of the submission terms you accepted, and its review status.
- A one-way hash of your IP address, on the same basis as the application form. The address itself is never written down.
- A private reviewer note may be attached by our team. It is internal, it is not shown to you, and it is not included in any email.
Submissions are stored privately. They are not published, not indexed, not included in the sitemap, not available through the site's public API, and not visible to any other creator. A submission marked accepted for listing still does not create a public product page by itself, writing a listing is a separate step we carry out.
Messages you send us
- Whatever you put in an email to us, kept for as long as we need it to deal with the matter and to keep a record of what was agreed.
3 Where it comes from
- Directly from you, when you fill in a form, subscribe, buy something or write to us.
- Automatically from your browser as it requests pages, which is what produces the server logs described above.
- Automatically as anonymous totals when you view or use an eligible commercial module on the homepage. The measurement request contains a signed placement token and event name, not an identity.
- From public sources, for the catalogue itself. Product listings are compiled from creators' own public pages and documentation. That is information about a product, not about you.
We do not buy contact lists, and we do not receive information about you from advertising networks or data brokers.
4 Why we use it, and on what basis
Each purpose stands on its own footing. We have not described anything as consent-based where the processing is actually needed to do the thing you asked for, to meet a contract, or to keep the site up.
| What for | Why we are allowed to |
|---|---|
| Serving pages, keeping the site available, and investigating abuse or attacks | Our legitimate interest in operating a working, secure website |
| Counting aggregate homepage commercial-placement activity so we can report what was shown and used | Our legitimate interest in operating and evaluating the marketplace without building visitor profiles |
| Reviewing a seller application and replying to it | Steps taken at your request before any agreement, and our legitimate interest in assessing what we list |
| Creating and running an approved creator account so you can submit product information | Steps taken at your request, and our legitimate interest in controlling who can submit to the catalogue |
| Reviewing product information you submit, and deciding whether to write a listing | Steps taken at your request before any agreement, and our legitimate interest in maintaining an accurate catalogue |
| Rate-limiting form submissions | Our legitimate interest in preventing automated abuse of a public form |
| Fulfilling an order and giving you access to what you bought | Performance of the contract you entered into |
| Keeping order and tax records | Compliance with a legal obligation |
| Sending the newsletter | Your consent, given by subscribing, and withdrawable at any time |
| Answering an email you sent us | Our legitimate interest in responding to correspondence |
Newsletter consent is separate and optional. Subscribing is not a condition of applying to list a product, buying anything, or using the site, and applying does not subscribe you.
5 Who else sees it
We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising technology on this site.
Who can see it
- The people who run Squarespell, in order to do the things described above.
- Our hosting provider, which necessarily processes requests and stores the database in order to run the site.
- Our email provider, which carries messages we send you, an application receipt, a submission receipt, the one-time link you use to set an account password, an order email, a reply.
- Professional advisers, or an authority, where we are legally required to disclose something.
Named providers are deliberately absent. The specific hosting and email arrangements for the production site have not been confirmed to us, and naming the wrong one would be worse than naming none. This section will name them before launch.
Following a link out
Most products in the catalogue are sold by other people. When you follow a link to a creator's site, including a link that earns us a commission, you leave Squarespell and that site's own privacy policy applies. Outbound product links now pass through a short redirect on our own server so that we can count the click. We record which product and which page the click came from, the time, and whether the request looked automated. We do not store your IP address, and we do not store any identifier that lets us recognise you again: repeat clicks are collapsed using a value that is re-salted every day and cannot be traced back to a person or linked across days.
6 Where it is stored
The hosting and service-provider arrangements for the production site have not yet been confirmed, so this policy does not describe where information is stored or which safeguards apply to any transfer. Stating a mechanism we have not verified would be a claim we could not stand behind. This section will be completed before launch.
7 How long we keep it
Two of these are enforced automatically by the code. The rest are the criteria we apply by hand, and they are described as criteria rather than as guarantees because nothing in the current setup deletes them on a timer.
| What | How long | Enforced how |
|---|---|---|
| Anonymous aggregate homepage placement totals | Up to 400 days | Automatically, by a daily cleanup job |
| Seller form state, held while you are correcting an error | About 15 minutes, then it expires | Automatically, by the code |
| Rate-limit counter, including the hashed IP | About 1 hour, then it expires | Automatically, by the code |
| Seller applications | Kept while under review, and afterwards as a record of what was submitted and on which terms | Reviewed by hand |
| Approved creator accounts | Until you ask us to close it, or until we withdraw access | Reviewed by hand |
| Product submissions and their reviewer notes | Kept while under review, and afterwards as a record of what was submitted, on which terms, and what we decided | Reviewed by hand |
| Newsletter subscriptions | Until you unsubscribe or ask us to remove the address | Reviewed by hand |
| Orders and their records | As long as tax and accounting rules require | Reviewed by hand |
| Accounts | Until you ask us to close it | Reviewed by hand |
| Email correspondence | As long as needed for the matter, and to keep a record of it | Reviewed by hand |
| Server logs | Retained by the host under its own schedule | Set by the hosting provider |
We are not promising automated deletion where none is implemented. If that changes, this table changes with it.
8 Your choices and your rights
Depending on where you live, you may have the right to ask for a copy of what we hold about you, to have it corrected, or to have it deleted. You can also object to some processing, or ask us to restrict it.
To make any of these requests, write to info@squarespell.com. We will ask you for enough information to be sure the request is really yours, and we will reply as quickly as we reasonably can.
Some things we cannot delete on request: an order record we are required to keep for tax purposes, for example, or a record of terms somebody accepted. Where that applies we will say so and explain why.
The newsletter
Every newsletter we send carries an unsubscribe link, and you can also ask us to remove your address by email. Withdrawing consent does not affect anything sent before you withdrew it.
A route of complaint to a supervisory authority is not stated here because the operating entity and its jurisdiction have not yet been confirmed. This will be added before launch. It does not affect your ability to ask us directly, at the address above.
9 Cookies and similar technologies
This site sets very little, and none of it is for advertising or behavioural analytics. The anonymous homepage aggregate counter sets no cookie and creates no browser identifier.
| What | When | What it does |
|---|---|---|
| wordpress_logged_in_… and wp-settings-… | Only if you sign in | Keeps you signed in and remembers admin screen preferences |
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_… | Only once you put something in a basket | Remembers the contents of your basket between pages |
| squarespell-theme and squarespell-saved | When you switch theme or save a product | Browser local storage on your device, not cookies, and never sent to us |
There is no cookie banner because every stored browser item above is needed for a function you asked for, and the aggregate counter uses no cookie or visitor identifier. If advertising technology or visitor-level analytics is ever added, a consent control will be added with it and this section will be updated before it is switched on.
We do not currently detect or act on a Global Privacy Control signal. We are not claiming to honour one, because that has not been implemented or tested.
10 Children, security and changes
Children
Squarespell is a business tool for people who run websites. It is not aimed at children and we do not knowingly collect information from them. If you believe a child has sent us something, write to us and we will remove it.
Security
Access to the administration area requires an account, seller applications and product submissions are stored where only signed-in staff can read them, an approved creator can reach nothing but their own submissions and is kept out of the administration area entirely, and the IP address used for rate limiting is hashed rather than stored. No system is completely secure and we are not claiming this one is; these are the measures actually in place.
Changes to this policy
The date at the top of this page is the date it last changed. If we change something that materially affects how we handle your information, we will update that date and, where it is appropriate and we have a way to reach you, tell you directly.
This page describes how the site actually behaves today. It is an operational document, not legal advice, and it should be reviewed by a qualified lawyer before launch.