OnePageCheckout
Get OnePageCheckout

Privacy Policy — OnePageCheckout Pro

Privacy Policy

This Privacy Policy explains how TrafficFlow GmbH (“TrafficFlow”, “we”, “us”, “our”), the company behind OnePageCheckout Pro (the “Plugin”), collects, uses, discloses, and protects personal data when you visit onepagecheckout.pro (the “Site”), purchase or subscribe to the Plugin, activate a license, turn on the free plan of our hosted address autocomplete, or contact us for support.

We are a Swiss company and act as the data controller for the processing described here. We comply with the Swiss Federal Act on Data Protection (revDSG) and, where it applies to visitors and customers in the European Economic Area and the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Last updated: October 2026. Please read this policy together with our Terms of Service and any product-specific notices.

1. Who we are (Data Controller)

The controller responsible for your personal data is:

  • TrafficFlow GmbH
  • Registered address: Staubstrasse 1, 8038 Zürich, Zurich, Switzerland
  • Commercial register / company number: CHE-364.165.705
  • VAT / UID: CHE-364.165.705
  • Privacy contact: support@onepagecheckout.pro

We have not appointed a statutory Data Protection Officer, but you can reach our privacy contact above for any question relating to this policy or your data.

2. Scope of this policy

This policy covers personal data we process as a controller: data collected through our website, our checkout, your customer account, our license and update servers, our support channels, and our website analytics.

It does not cover how you, as a WooCommerce store owner, process your own customers’ data when you install and run the Plugin on your own site. When the Plugin runs on your store, you are the controller of your shoppers’ data. The one case in which shopper data reaches us is our hosted address autocomplete, where we act as your processor. See “The Plugin on your own store” below.

3. What personal data we collect

3.1 Checkout and order data

Our own checkout at onepagecheckout.pro runs on WooCommerce. When you buy a subscription or a lifetime license, we collect the information needed to process your purchase, including:

  • Name and, where relevant, company name
  • Billing address and country
  • Email address and (optionally) phone number
  • VAT/tax identifier, where you provide one
  • Order details: products purchased, license tier, amounts, currency, taxes (including EU VAT/MOSS where applicable), invoices and order status
  • Payment confirmation data (see below) — we do not store full card numbers on our servers

3.2 Account data

If you create an account or customer portal login, we process your email address, hashed password, display name, and preferences, together with a history of your orders, subscriptions, invoices, and license keys.

3.3 License keys and activation domains

To operate per-site activation limits (Starter 1 site, Growth 5 sites, Agency unlimited sites) and to deliver updates and support, our license server records:

  • Your license key and the tier/plan it belongs to
  • The domain names (and, where technically necessary, IP address and WordPress/WooCommerce/PHP version) of the sites where you activate the Plugin
  • Activation, deactivation, update-check, and license-status timestamps

Domain names and site technical data are usually not personal data, but they can be linked to you through your license, so we treat them as covered by this policy.

3.4 Support correspondence

When you contact us for support, pre-sales questions, or refunds, we process the content of your messages and any attachments, your email address and name, and — where you share it to help us diagnose an issue — technical details about your site and configuration.

3.5 Website usage and basic analytics

When you browse the Site we collect limited technical and usage data, such as pages viewed, referring URLs, approximate location derived from IP address, device and browser type, and interaction events. We use this in aggregate to understand traffic and improve the Site. See “Cookies and similar technologies” below.

3.6 Communications and marketing

If you subscribe to our newsletter or product updates, we process your email address and subscription preferences, together with basic engagement data (for example whether an email was opened or a link clicked).

3.7 Hosted autocomplete usage

For each license we record how many address lookups its sites use per day and per month, together with the site keys issued to your activated sites. These are counts only — no typed text and no shopper IP addresses. We use them to apply the monthly quota of your plan, to send usage notices at 80% and 100%, and to show your usage in your account and in the Plugin.

3.8 Our live demo

If you try the address field in the live demo on the Site, what you type and your IP address are processed by our geo service exactly as described in section 7.1, with TrafficFlow as the controller.

3.9 Free plan of hosted address autocomplete

The free version of the Plugin can use our hosted address autocomplete without a license (500 lookups per site and month). Nothing is sent to us until the store owner clicks “Turn on” in the Plugin settings. That click registers the site with our license server at onepagecheckout.pro, which then records:

  • the site’s host name and site URL
  • the Plugin’s installation ID (a random identifier the Plugin creates) and the Plugin version
  • the administrator email address entered in the Plugin, used only for the usage notices described below
  • the time of the click and the version of the consent text shown with it
  • the status of the registration (on or off), the site’s monthly quota, when the registration was created and last changed, and, if the site later activates a Pro license, a reference to that license

No IP address is stored with the registration, and no shopper or order data is part of it. The IP address of the server that sends the registration and the email address are used only in pseudonymised (keyed-hash) form for rate limits against abuse; these entries expire within about a day.

Each free site receives a site key derived from its registration. Our geo service receives only that key, the site’s host name, its quota and its status — never the email address — and counts the site’s lookups as described in section 7.1.

We email the administrator address only when the site has used 80% and 100% of its monthly lookups. Every such email contains an unsubscribe link; unsubscribing deletes the email address and stops the emails, while address suggestions keep working.

4. How and why we use your data, and our legal bases

We only process personal data where we have a lawful basis under the GDPR and a justification under the revDSG. Depending on the situation, our bases are:

  • Performance of a contract (GDPR Art. 6(1)(b)): to process your order, deliver and license the Plugin, provide updates and support, manage subscriptions and renewals, and honour the 14-day money-back guarantee.
  • Legal obligation (GDPR Art. 6(1)(c)): to meet accounting, tax, invoicing, and VAT obligations, including retaining invoices for statutory periods.
  • Legitimate interests (GDPR Art. 6(1)(f)): to secure our systems, prevent fraud and license abuse, enforce activation limits, keep basic analytics, and improve our products and Site — balanced against your rights and freedoms.
  • Consent (GDPR Art. 6(1)(a)): for non-essential cookies/analytics where required, for marketing emails, and for registering a site for the free plan of hosted address autocomplete, which the store owner gives by clicking “Turn on” in the Plugin (see 3.9) and withdraws with “Turn off”. You may withdraw consent at any time without affecting prior processing.

Under the revDSG we process personal data in good faith and proportionately for the purposes stated at collection; the categories above describe those purposes for our Swiss-law compliance as well.

5. Payment processing

Payments are processed by Stripe; we do not store card details. Stripe collects and processes your card or payment-method details directly under its own privacy terms. We receive only the information needed to confirm and reconcile your order (for example, a transaction reference, payment status, the last four digits of a card, and billing country). We do not store full payment card numbers.

6. Service providers and processors

We share personal data with a limited number of vendors who process it on our behalf under data processing agreements and only on our instructions. Categories include:

  • Hosting and infrastructure — the providers who host onepagecheckout.pro, our database, and our license/update servers [Hosting provider].
  • Address autocomplete hosting — netcup GmbH, Karlsruhe, Germany, which operates the servers of our geo service (geo.onepagecheckout.pro) in data centres in Germany.
  • Payment processing — Stripe, our payment processor.
  • Email and support — the providers used to send transactional and marketing email and to run our support inbox/helpdesk [Email/support provider].
  • Analytics — the provider used for basic website analytics [Analytics provider].

We do not sell your personal data. We may disclose data where required by law, to establish or defend legal claims, or in connection with a merger, acquisition, or asset sale, in which case we will notify you as required.

7. The Plugin on your own store

OnePageCheckout Pro is software you install on your own WooCommerce store. When your shoppers check out, their personal data is processed on your site and infrastructure — you are the controller of that data and responsible for your own privacy notice. The Plugin does not transmit your shoppers’ checkout or order data (names, email addresses, orders, payment details) to TrafficFlow. Apart from license-related data (see “License keys and activation domains”), the only shopper data that reaches us is what our hosted address autocomplete needs, described in 7.1. Deactivating the Plugin instantly restores the stock WooCommerce checkout with no lock-in.

7.1 Hosted address autocomplete on your checkout

Pro licenses include hosted address autocomplete, and the free version of the Plugin can use it on the free plan once the store owner turns it on (see 3.9). When it is switched on, the shopper’s browser sends what they type into the address field directly to our geo service at geo.onepagecheckout.pro (free sites: wp.geo.onepagecheckout.pro, part of the same service), which returns address suggestions. For this service:

  • Roles: you, the store owner, are the controller. TrafficFlow GmbH processes the data on your behalf and on your instructions as your processor (Art. 28 GDPR, Art. 9 revDSG). A data processing agreement (DPA) is available on request at support@onepagecheckout.pro.
  • Data processed: the address fragments the shopper types and the suggestion they pick, the shopper’s IP address, your store’s domain (sent by the browser as the request origin), the country and language the checkout asks for, and the technical data every web request carries.
  • Purpose: only to return address suggestions, to count lookups against the monthly quota of your license or free site, and to protect the service against abuse (rate limits).
  • Storage: typed queries are processed in memory only to return suggestions and are not stored. For each license or free site, the service keeps its site keys with their host names and daily and monthly lookup counts. Rate-limit counters linked to IP addresses are held in memory for at most one hour. Our access logs contain no typed text and only shortened IP addresses (IPv4 /24, IPv6 /48), and are deleted after 7 days. The service sets no cookies and performs no tracking or profiling.
  • Location: the service runs on servers of netcup GmbH in Germany. Queries are answered from our own copy of the map data and are not passed on to Google, OpenStreetMap or any other third party. Only aggregate usage counts per license or free site (no typed text, no IP addresses) are sent to our license server.
  • Map data: suggestions are based on OpenStreetMap data, © OpenStreetMap contributors, available under the Open Database License (ODbL).

Please mention address autocomplete in your store’s own privacy notice. You can switch the hosted service off at any time in the Plugin settings. On the free plan, “Turn off” deletes the administrator email address and site URL from our license server at once and the rest of the registration 30 days later.

7.2 Your own Google key

If you enter your own Google Places API key in the Plugin (available in the Pro version), the shopper’s browser sends address input directly to Google under your own agreement with Google. TrafficFlow is not involved in that processing and receives none of that data.

7.3 Plugin versions before 3.0

Older versions of the Plugin route address suggestions through your store’s own server and our license server (hosted in Switzerland) before they reach the geo service; identical queries may be cached there for up to 60 seconds to speed up responses. The purposes above apply. Standard web-server logs on your server and on our license server may record these requests under their normal log rotation. Updating to the current version removes this route.

8. Cookies and similar technologies

We use cookies and similar technologies to make the Site and checkout work, remember your session and cart, keep you signed in, secure the Site, and — where you allow it — measure traffic. We distinguish:

  • Strictly necessary cookies (including WooCommerce cart/session and security cookies) that do not require consent.
  • Analytics and preference cookies that we set only with your consent where the law requires it.

You can manage non-essential cookies through our cookie banner (where shown) and through your browser settings. Blocking strictly necessary cookies may break checkout or login.

9. How long we keep your data

  • Order, invoice, and tax records: retained for the statutory retention period (in Switzerland generally 10 years).
  • Account and license data: retained while your account or license is active and for a reasonable period afterwards to handle renewals, updates, and disputes.
  • Support correspondence: retained for as long as needed to resolve your request and for a limited period thereafter for quality and reference.
  • Analytics data: retained in aggregated or limited form for a short period.
  • Hosted address autocomplete: typed queries are not stored; access logs (no query text, shortened IP addresses) are deleted after 7 days; per-license usage counts are kept while the license exists.
  • Free plan registrations: kept while the site uses the free plan. After “Turn off”, the administrator email address and site URL are deleted at once and the rest of the registration 30 days later; the geo service then deletes the site’s key and its per-site usage counts, keeping only totals without the host name. An email address removed through the unsubscribe link is deleted at once.
  • Marketing data: retained until you unsubscribe or withdraw consent.

When data is no longer needed for these purposes, we delete or anonymise it.

10. International data transfers

We are based in Switzerland. Our address-autocomplete service is hosted in Germany. Some of our providers may process data in the EEA, the United Kingdom, the United States, or other countries. Where we transfer personal data outside Switzerland or the EEA to a country without an adequacy decision, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses (with the Swiss addendum recognised by the Swiss Federal Data Protection and Information Commissioner) or equivalent safeguards — to protect your data. You may request a copy of the relevant safeguards using the contact details below.

11. Your rights

Subject to the GDPR and the revDSG, you have the right to:

  • Access — obtain confirmation of whether we process your data and a copy of it.
  • Rectification — have inaccurate or incomplete data corrected.
  • Erasure — have your data deleted where there is no overriding legal ground to keep it.
  • Portability — receive certain data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
  • Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
  • Restriction — ask us to restrict processing in certain circumstances.
  • Withdraw consent — where processing is based on consent, without affecting prior processing.

To exercise any right, contact us at support@onepagecheckout.pro. We will respond within the timeframes required by law and may need to verify your identity first.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC); in the EEA it is the authority in your country of residence, work, or the alleged infringement.

12. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and hashed passwords — to protect personal data against loss, misuse, and unauthorised access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children

The Site and the Plugin are intended for businesses and are not directed at children. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with a new “Last updated” date and, where changes are material, take reasonable steps to notify you.

15. Contact us

For any question about this policy or how we handle your personal data, contact:

  • TrafficFlow GmbH
  • Staubstrasse 1, 8038 Zürich, Zurich, Switzerland
  • support@onepagecheckout.pro