Privacy Policy

WordPress Static Shield from Tulapp

Last updated: 20 August 2026

This Privacy Policy explains how ClickSmash B.V., trading as Tulapp, collects, uses, and protects information in connection with the Service.

1. Who We Are

Tulapp is a trade name of ClickSmash B.V., registered in the Netherlands under KVK number 93178085 (VAT NL866302566B01), registered address Grote Sparrenlaan 3, 2121 CZ Bennebroek, The Netherlands.

For any privacy-related request, contact us at support@clicksmash.com or via the Contact page.

2. What Information We Collect

Account information — email address, name, company name (if provided), and a securely hashed password (never stored in plain text).

Order and payment information — billing details you provide at checkout (name, company, country, VAT number, billing address, number of websites purchased) and the resulting subscription/licence records. Payments themselves are processed by Mollie, an independent payment service provider — we do not collect or store your card or bank account details; Mollie handles that directly. See section 5.

Website and domain information — the URL, WordPress version, PHP version, and compatibility tier of any WordPress site you link to your account, plus build/configuration data the plugin reports (e.g. static coverage, attack-surface scan results).

Technical and security telemetry — where applicable, data the plugin or our cloud services generate to verify protection is working as configured (for example, whether a route that should be blocked is actually blocked).

Server logs — standard web server logs (IP address, request path, timestamp, user agent) generated by normal operation of our servers, retained only as long as needed for security and troubleshooting.

Cookies — a single session cookie to keep you signed in to your Tulapp account. We do not use advertising or tracking cookies on this site.

Email — messages you send us (e.g. via the contact form) and transactional email we send you (account verification, password setup, payment confirmations).

3. Why We Process It (Legal Bases)

Performance of a contract (GDPR Art. 6(1)(b)) — account creation, checkout, and delivering the Service you purchased.
Legal obligation (Art. 6(1)(c)) — bookkeeping, tax, and consumer-protection records.
Legitimate interest (Art. 6(1)(f)) — server logs and security telemetry, to keep the Service secure and working.
Consent (Art. 6(1)(a)) — where we ask for it explicitly (e.g. the checkout consent checkboxes).

4. Payment Processing via Mollie

Checkout payments are handled by Mollie B.V., a licensed payment service provider. When you pay, your payment details are submitted directly to Mollie, not to Tulapp. Tulapp receives confirmation that a payment succeeded (or failed) and identifiers needed to activate your subscription — never your full card number, bank account details, or equivalent. Mollie's own privacy policy governs how it processes your payment details directly.

5. Cookies

We use one essential, first-party session cookie to keep you signed in. It is strictly necessary for the Service to function and is not used for advertising, analytics, or cross-site tracking. Because it is strictly necessary, no cookie-consent banner is shown for it.

6. Retention

We keep account, order, and subscription records for as long as your account is active and afterwards only as long as required for legal, tax, or accounting obligations. Server logs and technical telemetry are retained for a limited period sufficient for security and troubleshooting purposes, then deleted or anonymised.

7. Who We Share It With (Processors)

We share information with the following categories of processor, only as needed to provide the Service:

Mollie B.V. — payment processing.
Our email/SMTP provider — delivering transactional email (account verification, receipts, notifications).
Our hosting provider — running the servers the Service operates on.

We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

8. International Transfers

Where a processor is located outside the European Economic Area, we rely on an appropriate safeguard (such as the European Commission's Standard Contractual Clauses) before any such transfer takes place.

9. Your GDPR Rights

If you are in the EU/EEA, you have the right to:

access the personal data we hold about you;
rectify inaccurate data;
request erasure ("right to be forgotten"), subject to our legal retention obligations;
request a portable copy of your data;
object to processing based on legitimate interest;
lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

To exercise any of these rights, contact support@clicksmash.com.

10. Security Measures

Passwords are hashed (never stored in plain text), access-granting tokens are stored only as one-way hashes, and account sessions are protected with secure, HTTP-only cookies. No system is perfectly secure, and we cannot guarantee absolute security — see the Terms and Conditions, section 3.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

12. Contact

ClickSmash B.V. (trading as Tulapp) KVK 93178085 · VAT NL866302566B01 Grote Sparrenlaan 3, 2121 CZ Bennebroek, The Netherlands

Email: support@clicksmash.com — see also the Contact page.