Notice updated 2026-10-01, revision 8 · Applies to RedirectNest’s website and service. The WordPress plugin’s local data is explained separately below.
Who is responsible?
The operator is A.M.E.X. Internet Marketing ltd, Makariou III, No.9, Larnaca, 7530, Cyprus. Company registration: HE 377934. VAT: 10377934Z. Company details. For privacy questions and requests, email Show email.
What we use and why
- Private support: your message, subject, required email address, optional name and private-link verifier let us handle your enquiry. We require an email address for new tickets so we can identify the contact for support and purchase enquiries. Providing it does not verify mailbox ownership or subscribe you to marketing. Older tickets may have no email address. Customer support uses the contract or steps you request before a contract; general enquiries and abuse prevention use our legitimate interests, subject to a documented balancing assessment.
- Orders and accounts: product, site allowance, price, currency, payment status and provider references are needed to fulfil purchases and administer subscriptions. Required accounting records are retained to meet Cyprus tax and accounting obligations under the financial-record schedule below. Card entry is hosted by Stripe.
- Security: essential session data, access checks, owner MFA, audit records and short-lived rate limits protect the service. Network-based rate limits use a keyed, daily rotating IP pseudonym, never a plain IP in the application’s limiter table. Other limits can use account references or hashes of the supplied email address. Hosting and provider logs are separate and require review.
- Optional analytics: only consent enables public-page and action counts, reading engagement, broad referral categories, approximate country totals and subsequent pricing-page counts. New purchases are not linked to this activity. No advertising, cross-site profiling or automated decisions with legal or similarly significant effects are implemented.
- Privacy requests: we use your request and the minimum verification information necessary to fulfil our data-protection obligations. Do not send identity documents, passwords, API keys, sensitive personal information or full card details through support.
No account is required for browsing or submitting a private support ticket. Customer accounts are available for purchases. Support does not subscribe you to marketing. Replies to website tickets are shown on the private ticket page; save your private link and check it for replies. Customer account setup and password recovery use transactional email, as described below. Owner support notifications use our mail server on the GoDaddy VPS and its outbound relay and contain ticket references and owner-login links, not customer message text. If you contact us directly by email, our mail server on the GoDaddy VPS and its outbound relay processes the email content and addressing information. Your name is optional. An email address is required for new support tickets; older tickets may have no email address. We cannot fulfil a purchase or answer a message without the information necessary for that request.
Cookies and browser storage
Optional analytics is available only after you accept it. We do not set advertising cookies. A choice applies to this browser, not automatically to your other devices. Rejecting is as easy as accepting. Manage or withdraw optional website analytics on our Cookie choices page, also linked from the public website footer. Do Not Track and Global Privacy Control disable our optional measurement. Withdrawal stops new events immediately; if offline, revocation is retried when you return.
On small screens, scroll the table to read every column.
| Storage | Purpose | Lifetime |
|---|---|---|
__Host-redirectnest_session | Essential public-website form protection. Secure, HttpOnly, SameSite=Lax; no cross-domain scope. | Browser session. Customer accounts and private support use the separate essential cookies described below. |
__Secure-redirectnest_customer and related form/action cookies | Essential customer sign-in, form protection and single-use account setup or recovery. | Session: 12 hours maximum and one-hour idle expiry. Form/action cookies: up to two hours. |
__Secure-redirectnest_checkout and __Secure-redirectnest_purchase | Essential checkout form protection and private purchase access. | 30 minutes and seven days respectively; recovery or revocation can end access earlier. |
of_csrf and of_ticket | Essential support form protection and access to an individual private conversation. Restricted to the relevant support paths. | One hour and 30 days respectively; renewed when used. Deletion or revocation ends ticket access. |
__Secure-redirectnest_withdraw and its receipt cookie | Essential withdrawal-form protection and access to the acknowledgment. | Up to 24 hours. |
__Secure-redirectnest_admin | Essential staff authentication, restricted to administration. | Eight hours by default, or up to 365 days when staff explicitly select Remember me. Sign-out or revocation ends access earlier. |
redirectnest_analytics_choice_v3 in local storage | Remembers a requested accept/reject choice and policy version. Acceptance includes a random receipt, stored as a hash on the server and never joined to aggregate page counts. The receipt also allows withdrawal of earlier optional article-to-purchase associations, where present. | 180 days; expiry is checked before every event. Browser storage can also be cleared in your browser settings. |
redirectnest_pending_withdrawal_v3 in local storage | Retries a withdrawal after a connection failure. | Until the server acknowledges it, or until the old receipt expires (maximum 180 days). |
__Host-redirectnest_article | With analytics consent, remembers the last published article, a broad source category, consent reference/version and expiry. Signed, Secure, HttpOnly, SameSite=Lax and limited to this domain; no advertising or cross-site identifier. | Up to 24 hours from the latest measured article view. Rejection and withdrawal remove it. |
| Cloudflare Turnstile, when requested | Spam protection loads only after “Load spam protection”. Default one-use verification tokens; pre-clearance cookies must remain disabled unless separately reviewed and disclosed. | Token/provider behaviour follows the reviewed Cloudflare configuration. |
Fonts and product assets are served locally.
How long information is kept
On small screens, scroll the table to read every column.
| Information | Application rule |
|---|---|
| Support messages and contact details | Deleted by the daily cleanup 365 days after the latest message, or earlier on an authorised deletion. An open privacy request or a documented, time-limited legal hold pauses automatic deletion. |
| Privacy-request cases | Closed cases: 365 days from the last update, unless their ticket is erased earlier. Open cases require owner review; they are not silently expired. |
| Private links and checkout links | Private support links remain valid until the ticket is deleted or access is revoked. Support browser access lasts up to 30 days and can be refreshed. Purchase-access cookies last up to seven days; checkout form cookies last 30 minutes. Account access is described below. |
| Consent evidence and aggregate analytics | Receipt: up to 180 days plus 30 days, or 30 days after withdrawal. Public-page totals and optional article/purchase associations: 90 days. Operational initial-payment reporting copies: 90 days, separate from required source payment records. Receipt records contain no IP address or user agent. Minimal withdrawal evidence is retained for restore safety while affected recovery copies can remain. |
| Security records | Rate-limit windows and stored-record retention are different. Public-website and support limiter records expire with their configured window and are removed on subsequent requests or scheduled cleanup. Customer-account limiter hashes are selected for cleanup after roughly two days during maintenance. Staff sign-in, checkout and withdrawal limit records are pruned during later relevant requests; inactive entries can therefore remain longer. These limiter tables contain pseudonyms, hashes or opaque references, not raw IP or email addresses. Account security events are kept for up to 180 days. Staff activity and security audit records are reviewed separately and may be retained longer where needed to investigate access, privacy requests or disputes. Deployment and provider logs follow separate retention reviews. |
| Orders and payment records | Invoices and necessary accounting/payment records are retained for six years from the relevant tax-return filing deadline or actual filing date, whichever is later, including applicable amended returns. Retention may be extended where legally required, including applicable tax-audit requirements or documented legal holds. This period does not apply to all customer data. Records required by law are not automatically deleted by a support-ticket request. Deletion or anonymisation requires review of the applicable filing dates and holds; no automatic six-year erasure is currently implemented. If Union OSS is used in future, records covered by that scheme will follow its ten-year requirement. |
| Backups and deletion journal | Encrypted backups are stored in a dedicated Cloudflare R2 EU-jurisdiction bucket. An hourly retention task selects snapshots older than 35 days for removal and prunes backup data no longer referenced by retained snapshots. Removal requires a recent verified recovery point and successful safety checks. Outages, repository locks and failed checks can delay expiry; 35 days is the normal retention target, not an unconditional deletion deadline. The 35-day automated policy applies to the public-website backup repository. Account, licence and support recovery copies use a separate encrypted repository and currently require manual retention review before deletion. Provider logs, email and other local copies have separate schedules. A minimal deletion journal records erased ticket references for replay during restoration; recovery must preserve the latest journal and replay it before returning to service. Owner-notification delivery metadata stores opaque ticket references and delivery identifiers for duplicate suppression. These records do not contain ticket text or contact details and are reviewed when handling erasure requests and restoring service. |
Optional article-to-purchase measurement
If you accept the current analytics notice, we count public-page visits and selected actions, article views, engaged reads (at least 30 seconds with the page visible and halfway through it), and subsequent pricing views. The last measured article is remembered for up to 24 hours for these pricing-page counts. New purchases are not currently associated with public article activity. Earlier optional associations, where present, remain subject to withdrawal and the retention period below. The private report counts only verified initial Stripe payments, shows each currency separately and adjusts for refunds and disputed balances. It excludes subscription renewals. The optional association contains an article, purchase reference, consent reference/version and timestamps; it can be personal data because a purchase may identify a customer. It is retained for up to 90 days, based on consent, separately from payment records needed for fulfilment or legal obligations.
We do not collect search queries, complete referrer URLs, AI conversations, fingerprints or a page-by-page browsing history. AI and search categories depend on recognizable referrers and can be incomplete. Counts are events, not unique visitors; a recorded connection does not establish that an article caused a sale. Payment totals without an article source are operational financial counts, not tracking of visitors who declined consent.
Use the Cookie choices page to withdraw as easily as accepting. Withdrawal stops new optional events immediately and removes article associations linked to the available consent reference when the request reaches the server. If you are offline, revocation is retried when you return. After clearing all site storage or changing browsers, contact us with a purchase reference for removal of older associations. Aggregate activity totals cannot be linked back to remove one person's contribution. Required payment records are handled separately. A minimal withdrawal journal supports reapplying deletion after backup restoration; recovery must preserve this journal. The previous aggregate-only analytics consent does not enable article attribution: a new choice is required.
Article drafts are generated at an owner's request using OpenAI and the public product documentation and article library. Customer records, support messages and payment details are not included in those generation requests. Drafts remain private until publication.
Recipients and international transfers
Only authorised owners administer private records. The current deployment uses a GoDaddy VPS located in the United States for hosting, Cloudflare for proxy/DNS and Turnstile, Cloudflare R2 in its EU jurisdiction for encrypted backups, and our mail server on the GoDaddy VPS and its outbound relay for support email and owner notifications. Stripe processes hosted payment, billing and subscription information. Depending on the service, Stripe acts as our processor or as an independent controller for its own fraud-prevention, regulatory and other purposes. See Stripe’s processing agreement. Cloudflare receives the IP address and browser signals needed for Turnstile. It acts as a processor when protecting this website and as a controller for its separate purpose of improving Turnstile’s bot detection, as explained in its linked privacy notice. Loading spam protection is a deliberate request for that feature, not consent to analytics or marketing. Use our privacy contact if the challenge is inaccessible. See Stripe’s privacy information and Cloudflare’s Turnstile privacy information.
Support is operated from Cyprus using the providers listed above, including US hosting. The R2 EU setting applies to that bucket; it does not establish EU-only hosting, email or all provider processing. Provider processing terms include GoDaddy’s DPA, Cloudflare’s DPA and Google’s CDPA. These documents describe applicable transfer arrangements, including standard contractual clauses and, where applicable, adequacy arrangements. You may contact us for information about the safeguards relevant to your data. Hosting, email and network services can involve processing outside the EEA; EU backup storage does not make the complete service EU-only. WordPress.org statistics and Search Console jobs fetch plugin/search observations; support content is not sent to these jobs. Our mail server on the GoDaddy VPS and its outbound relay is configured for support email and operational notifications. When customer accounts are enabled, our mail server on the GoDaddy VPS and its outbound relay also delivers transactional account and purchase-notification emails, as described below.
Optional newsletter
Newsletter signup is separate from support, purchases and website analytics. A subscription starts only after an email confirmation. Read the newsletter privacy notice and retention details.
Email correspondence and manual review
Direct email correspondence is separate from website support tickets. Company-wide automatic mailbox deletion is not enabled. Historical correspondence in earlier mail-provider accounts may remain until separately reviewed; changing the current mail provider does not erase those copies. We review correspondence monthly and retain it while needed to resolve enquiries, provide ongoing service, handle disputes or meet documented legal obligations. We identify information no longer needed for deletion through that review. Account and licence records are reviewed separately from required financial records. Privacy requests are handled when received; they do not wait for the monthly review.
Your rights and how to use them
You can request access, correction, erasure, restriction, objection to processing based on legitimate interests, and portability where its legal conditions apply. You can withdraw optional analytics consent without affecting the lawfulness of earlier processing. A private ticket includes a JSON export and a privacy-request form. Signed-in accounts and their site pages also provide JSON exports. Each export covers its stated scope; contact us for a complete access request, including other records and provider-held data. A ticket can be deleted directly unless a pending review or documented hold applies.
We normally respond within one calendar month. Complex or numerous requests may require up to two additional months; we must explain and notify you within the original month. Verification must be proportionate: possession of a private link proves access to that resource, not every record associated with an email address. Rights can have lawful limits, such as retaining accounting records or protecting another person’s rights. We explain any refusal and your complaint rights.
You may complain to the Cyprus Commissioner for Personal Data Protection or the competent supervisory authority in the EU country where you live, work or where the alleged infringement occurred. You do not have to contact us first.
WordPress plugin data
A site owner using RedirectNest is responsible for their site’s own privacy notice and lawful operation. The plugins do not set visitor cookies. Free makes no product-service requests. Pro licensing and optional fleet sharing are described below. Redirect rules, migration drafts and reports are stored in that WordPress database. URLs and paths can contain personal data even without IP addresses; avoid placing secrets or personal details in them.
Optional 404 collection is off by default. It stores limited local path counts for 7 days by default (configurable to 30 or 90), skips common private/token paths, and does not collect query strings, IPs, referrers or user agents. Pro makes destination requests only when an administrator starts a check or explicitly enables scheduled monitoring; the destination receives the server IP and requested URL. Common secret query parameters are redacted in stored check results. Plugin privacy tools can remove logs, drafts, archived reports and history; they preserve active redirects. Site backups are controlled by the site owner and require their own retention and restoration procedures.
Pro connections and optional fleet sharing
When a site administrator connects a site-specific install key, the service receives its WordPress site address, environment, entitlement reference and connection timestamps to activate that site and deliver updates. Keys are encrypted locally using WordPress salts and stored as one-way hashes on the service. Each production entitlement can include one associated staging site. This service processing supports the requested purchase; it is separate from optional analytics.
Fleet sharing is off by default and separately enabled by the site administrator. It sends Free, Pro and WordPress versions, rule count, latest failed-check count and check/worker timestamps to the private purchase dashboard. It sends no visitor identifiers or rule URLs. Remote summaries expire after 30 days. Disabling sharing stops further local sharing immediately and attempts to erase the saved summary; if the service is unreachable, retry or erase it through the purchase page. Revoked site addresses are cleared after 30 days. Minimal key-revocation records survive restore operations to prevent old credentials returning.
Detailed diagnostic sharing is a separate, optional choice in Pro. When enabled, it sends a bounded report of redacted problem paths, check states and up to seven days of aggregate redirect/404 trends to the private purchase account. It does not send full destinations, query strings, visitor IPs, cookies or user agents. Reports expire after seven days. Consent changes use a version counter so an older queued upload cannot restore information after you turn sharing off. Disable sharing in WordPress or erase the remote report from the account site page; release or revoke the site to remove its active sharing.
Optional monitoring emails use the WordPress site's configured mail transport and chosen recipient. They contain aggregate results and an administration link. The site operator is responsible for recipient authorisation and the mail provider's arrangements. Mail acceptance is not proof of delivery. Licensing and account records support ongoing service. On closure or an erasure request, we review them separately from required financial records and remove or anonymise information no longer needed, subject to documented obligations and holds. This is a manually reviewed process; the financial retention period does not automatically apply to every account field.
Changes
We update this notice when the service or processing changes. A materially changed optional-analytics purpose or policy requires a new choice. The processing described here applies when you use the corresponding support, account, purchase or plugin feature.
Customer accounts and account emails
When customer accounts are enabled, we associate verified paid purchases with the billing email returned by Stripe. That address does not prove mailbox ownership: you must use a single-use setup email to choose a password before signing in. Sandbox and live accounts are separate. We store your account email, password hash, verification time, purchase associations, hashed sessions and recovery tokens, and security activity. We never store readable passwords.
Essential customer cookies use the __Secure-redirectnest_customer prefix. The Secure, HttpOnly, SameSite=Lax customer session cookie lasts up to 12 hours and expires after one hour of inactivity. Form and setup cookies last up to two hours. Signing out, changing the password or revoking account access ends the applicable sessions earlier. Setup links last two hours, reset links 30 minutes. Password changes revoke previous account sessions, recovery links and linked private purchase links. Existing purchases and site licences remain.
Our mail server on the GoDaddy VPS and its outbound relay delivers account setup, purchase, recovery and password-change emails. This is not marketing. Queued messages may be retried; sent or cancelled mail records are removed after 30 days, expired tokens after seven days and security activity after 180 days. Failed mail remains for operator review. Account and purchase records are retained for ongoing service and applicable recordkeeping, subject to review. Use Account & security to export account records or contact support for a complete privacy request.