Privacy

Mutagen privacy policy

Short version: we collect very little, we don't track you around the web and we don't sell your data. Here's the full story, in plain English.

The short version

Privacy policies tend to run long, so here are the highlights:

  • We collect only what we need to run this site, your account, your license and support.
  • No advertising or tracking cookies, and no third-party analytics.
  • We never sell your personal information or use it for ads.
  • What your WordPress site collects with Mutagen, like form entries and SMTP settings, stays on your site. We can't see it.
  • License and update checks send your license key, site URL and version numbers. That's it.
  • You can ask to see, export, correct or delete your data at any time.

Who we are

Mutagen is run by [Legal company name], [Mailing address] ("Mutagen", "we" or "us"). We're responsible for the personal information described here: what you share on this website, in your Mutagen account and when you buy a plan.

This policy covers this website, your account, billing, support and the license and update checks the plugin makes. It doesn't cover the websites you build with Mutagen. Those are yours, and so is their data (more on that below).

What we collect

We only ask for what we need. Here's the full list, grouped by how you use Mutagen.

When you visit the website

Like almost every website, our server records basic request details: IP address, browser type, the page requested and the time. These logs help us keep the site secure and working. To block form spam, we also keep a scrambled (salted hash) version of your IP address for about 10 minutes. We don't use analytics tools or tracking pixels.

When you join the newsletter

Your email address, plus a record of when you signed up and confirmed. We use double opt-in, so nothing arrives until you click the confirmation link.

When you contact us or ask for support

Your name, email address, subject and message, plus anything else you choose to send, like screenshots or site details that help us solve a problem.

When you create an account or start a free trial

Your name, email address and password (stored only as a secure hash, never in plain text), your company name if you add one, your license keys and the sites you activate Mutagen on.

When you buy a plan

Your billing name, address and country (needed for tax), the plan you chose and your invoice history. Card payments are handled by our payment processor. We never see or store your full card number.

When the plugin checks for updates

To validate your license and deliver updates, the Mutagen plugin contacts our servers from time to time. Each check sends your license key, your site's URL, the Mutagen, WordPress and PHP versions it runs and the time of the check, along with your web server's IP address. It never sends your posts, pages, form entries, visitor data, users or passwords.

Data on your WordPress site

Mutagen runs inside your own WordPress install, and the data it handles stays there. Form entries, SMTP credentials, redirects, roles, SEO settings and everything else live in your site's own database. Mutagen doesn't send any of it to us, so we can't see it. Emails from your site go through the SMTP provider you choose.

That puts you in charge of your visitors' data. If you collect personal information with Mutagen Forms, mention it in your own site's privacy policy, and use the CSV export and delete options when someone asks for their data.

How we use your information

We use it to:

  • Create and run your account, trial and licenses.
  • Deliver plugin updates and confirm your license is valid.
  • Answer your questions and provide support.
  • Send the newsletter you signed up for.
  • Send service emails, like receipts, trial reminders and renewal notices.
  • Keep our services secure and stop spam and abuse.
  • Meet legal, tax and accounting obligations.
  • Improve Mutagen using combined numbers, such as how many sites run each WordPress version.

And here's what we never do:

  • Sell or rent your personal information.
  • Share it for targeted advertising or show you ads.
  • Use your personal information to train AI models.

If you're in the European Economic Area or the United Kingdom, the GDPR asks us to name a legal basis for each use. Ours are:

  • Contract: to provide your account, license, updates, billing and support.
  • Consent: for the newsletter. You can withdraw it at any time with one click.
  • Legitimate interests: to keep our services secure, prevent abuse, answer messages and improve Mutagen, in ways you would reasonably expect.
  • Legal obligation: to keep tax and accounting records and respond to lawful requests.

Cookies

We keep cookies to a bare minimum. There are no advertising, tracking or analytics cookies, which is why you won't see a cookie banner here. The site uses only these strictly necessary cookies:

  • mutagen_csrf: a random value that stops other websites from submitting our forms on your behalf. It's deleted when you close your browser.
  • mutagen_preview: lets our team view unreleased pages. It lasts 30 days, and regular visitors never receive it.

If we add cookies later, for example to keep you signed in to your account, we'll list them here.

Who we share it with

We share personal information only with service providers that help us run Mutagen, and only what each one needs for its job. They're bound by contract to protect it and can't use it for their own purposes.

  • Web hosting: runs this website and our license and update servers.
  • EmailOctopus: stores the newsletter list and sends the newsletter.
  • Email delivery: sends our replies, receipts and account emails.
  • Payment processor: handles card payments and billing.

We may also share information when the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger or sale of the business. If that ever happens, we'll let you know, and your information stays protected by this policy. Ask us any time for a current list of our providers.

International transfers

Our providers may store or process information in countries other than yours, such as the United States or the United Kingdom. When personal information leaves the EEA or UK, we rely on safeguards the law recognizes, like adequacy decisions or the European Commission's Standard Contractual Clauses.

How long we keep it

We keep information only as long as it's useful to you or the law requires:

  • Newsletter: until you unsubscribe.
  • Messages and support requests: up to 2 years after our last reply, so we have context if you write again.
  • Account data: while your account is open, then deleted or anonymized within 90 days of closing it. Unused trial accounts are removed after 12 months.
  • Billing records: as long as tax and accounting laws require, often up to 7 years.
  • Server logs: a short time, usually 30 days.
  • Spam protection data: about 10 minutes.

Keeping it safe

We use HTTPS across the site, store passwords only as secure hashes, limit access to the people who need it and work with established providers. No system is perfectly secure, but if a breach ever affects your personal information, we'll tell you and the authorities as the law requires.

Your rights and choices

Your data is yours. Depending on where you live, you can ask us to:

  • Show you the personal information we hold about you.
  • Correct anything that is wrong.
  • Delete your information.
  • Give you a copy in a portable format.
  • Stop or limit certain uses, or object to them.
  • Withdraw consent you have given, such as for the newsletter.

You can unsubscribe from the newsletter using the link in any email. For everything else, email support@mutagen.com. We'll confirm the request really comes from you and reply within 30 days. It's free, and using your rights will never change the service or price you get.

US residents: California and a growing number of other states give you the right to know, correct and delete your information, and to opt out of its sale, its use for targeted ads and profiling. We don't do any of those things, so there's nothing to opt out of. If we turn down a request, you can appeal by replying to our answer.

EEA and UK residents: you can also complain to your local data protection authority. We'd love the chance to fix things first, though.

Changes to this policy

When we update this policy, we change the date at the top. If a change is significant, we'll email account holders before it takes effect.

Contact us

Questions, requests or just curious? Email support@mutagen.com, use the contact page or write to [Legal company name], [Mailing address]. A real person will reply.