PRIVACY
Understand your backup data.
What WPBackups processes, why it is used, and how to contact the operator.
This notice describes the current technical data flows. It does not promise a particular processing region, universal deletion deadline or certification.
Data used by the service
Site identity and authentication
Registration processes the site URL and optional site name, WordPress, PHP and plugin versions. The service stores site registration, status and last-seen information. API requests use a site ID and site secret over HTTPS; the service stores a digest of the secret. A site secret is separate from the recovery key.
Backup objects and metadata
Encrypted file and database objects may contain personal information from your WordPress site. Backup IDs, status, timestamps, object sizes, identifiers and references support storage, restore-point listing, retrieval and quota enforcement.
Backup payload encryption does not encrypt the manifest. Metadata can include the site URL, software versions, installation fingerprint, database prefix, file paths and names, sizes, timestamps, hashes and object references. This metadata is readable by the service and may contain personal information.
Operations and support
Connections expose IP addresses and request timing. Site and IP rate-limit state, last-seen records and diagnostics support service operation, abuse controls and troubleshooting. If you contact us, your message contains the contact information and diagnostic details you choose to send. Share only the minimum information needed.
When Cloud communication occurs
Cloud use is optional. Activation alone does not register a site. After configuration, opening the plugin administration page retrieves Cloud listings; manual or separately enabled scheduled backups send data. Explicit recovery preparation retrieves selected objects before offline recovery. Cloud service details describe the API and storage destinations.
What encryption protects
File and database payloads are encrypted on the WordPress host before upload using AES-256-GCM. Backup payload encryption does not hide service metadata. HTTPS protects transport. The documented protocol does not transmit plaintext backup encryption keys. A compromised host or recovery key can compromise backup confidentiality.
Retention and deletion
Completed Cloud restore points remain until explicitly deleted through the authenticated service API. The plugin has no Cloud-delete button. Removing references can reduce quota usage before physical cleanup; objects still used by another backup remain. Incomplete work becomes eligible for expiry after 24 hours of inactivity, with hourly scheduled cleanup subject to age and reference checks. This is not a promise that every copy is erased within 24 hours. Deactivating or uninstalling the plugin does not delete Cloud backups or site registration.
Site registration, operational records, support correspondence and infrastructure copies have separate retention considerations. The application cleanup thresholds above are not a complete retention schedule or a guarantee of erasure from every storage layer. Contact us about your particular data or site-closure request; do not send secrets.
Service infrastructure and locations
Cloud operation involves API hosting, an object-storage gateway and an underlying distributed storage network. This notice does not assert that processing stays in one country or that gateway deletion proves erasure of every distributed copy. Contact our privacy address for questions about recipients, locations and transfers before sending data with specific residency requirements.
This website
These presentation pages use locally served styling, with no analytics, advertising scripts, embedded third-party media, contact forms or external fonts added to the site. The web server records access and error logs. WordPress administration uses its own authentication cookies. Email links open your chosen mail application.
Privacy questions and requests
Contact privacy@wpbackups.com for questions about access, correction or deletion. Rights and handling depend on applicable law and the data involved. If your information is contained in another operator’s WordPress backup, contact that site operator as well. Do not include recovery keys, site secrets or backup contents.
The operator of each backed-up site chooses its content and is responsible for its own notices and authority to process it. No universal controller or processor role is assumed by this technical notice.