Pirkoo

Privacy Policy

Pirkoo

What personal data Pirkoo handles (the WooCommerce plugin, the service it connects to and the website pirkoo.com), why, who processes it for us and how long we keep it. Pirkoo is made by tvarkom.

Last updated: 10 November 2026

Who we are

The data controller is MB TVARKOM SOFTWARE ("tvarkom", "we", "us"), a small partnership (mažoji bendrija) registered in Lithuania under company code 308171668, registered office Gedimino g. 22A-14, 44319 Kaunas, Lithuania. For privacy questions and data requests, email [email protected].

The Pirkoo plugin

Pirkoo shows your store's health on its own page in your store's admin. It contacts Pirkoo's service for the first time when an administrator clicks "Connect and scan"; before that, it sends nothing. From then on it sends:

• Connecting (and again if the store's key stops working): your store's address, your site's admin email (WordPress Settings → General) as the contact address of your store's registration, and the address of the plugin's verification endpoint. We fetch a one-time token from that endpoint to confirm the request comes from your store, then issue a key for your domain. Unfinished registrations are deleted after 7 days. We send no marketing to that email.
• Each scan, when an administrator clicks "Connect and scan" and later "Scan now" (at most once a week; the plugin never scans on its own): your store's address, its cart and checkout page addresses and the admin email. The request also reaches us from your store's server IP address, which we use for our limits.
• Store data: PHP, WordPress and WooCommerce versions; database, options table and autoloaded options sizes; the number of active plugins and the object cache type; background task (Action Scheduler) counts and how late WP-Cron runs; the number of orders in the last 30 days as a range (for example 50–200); the names and sizes of the largest autoloaded options and of database tables left by removed plugins; PHP settings such as the memory limit; failed and late background task names, with error messages stripped of email addresses, links, IP addresses and long numbers; and a profile of one checkout page load on your store's server, with a temporary cart: plugin, theme and hook names with their timings, database query shapes with every value replaced by "?", the host names of outside services called, and object cache hit and miss counts. Option, table, task, hook and host names are chosen by plugins; before they're sent, the plugin replaces any email address, run of six or more digits, or long hexadecimal or UUID identifier in them with a placeholder.
• Business context, so the analysis can explain its findings in business terms: your store's country and currency; the number of paid and on-hold orders in the last 30 days, and of failed, pending and cancelled orders; gross sales in the last 30 days and the average order value, as exact amounts in your store's currency, which we keep with the scan's analysis (below); how many customers in the last 30 days were new and how many returning, as two counts; the number of published products and variations and whether stock management is on; the IDs of the enabled payment gateways and shipping methods (never their settings or keys); whether checkout uses the Checkout block or the classic shortcode and whether High-Performance Order Storage is on; the database and web server product; how many of your theme's WooCommerce template overrides are outdated; how many plugins have an update waiting; and the name of an active backup plugin, if any; the domain your store's emails come from (never the address); how many products were added to the cart, checkout pages opened and orders placed over the last 30 days, which the plugin counts on your store's server as daily totals, without cookies, browser scripts or anything about the shopper, keeping 35 days and deleting them when you uninstall it; and how many orders in the last 30 days came from each source type and from the 10 most common campaign sources, from WooCommerce Order Attribution (a campaign name that looks like an email address, a long number or an identifier is counted as "other", never sent).
• Site checks, with each scan: whether a WordPress or theme update is waiting, whether debug output is shown, whether search engines are asked not to index the store, the site's WordPress environment type (production, staging, development or local, so a staging copy isn't marked down for blocking search engines or showing debug output), how many database tables use the MyISAM engine or a character set other than utf8mb4, how many expired transients are stored, how many administrator accounts exist (a count, no user details) and whether the dashboard file editor is on; the upload limit, missing PHP extensions, free and total disk space, the server's load, CPU core count and memory; how many plugins and themes WordPress paused, how many fatal errors the store's PHP error log shows for the last 7 days (the plugin reads the log on the store's server and sends only the count, never log lines), the automatic update settings and whether permalinks are plain; the database's response time and how many spam comments, auto-drafts and old revisions it holds; how many core files differ from WordPress.org's official checksums, which the plugin fetches from api.wordpress.org sending only the WordPress version and language; wp-config.php's file permissions, whether a user named "admin" exists (yes or no, no other user details), and whether registration is open and the role new accounts get, and counts the same daily shop totals on your store (without cookies or anything about the shopper, kept 35 days, deleted when you uninstall it).

The plugin lists what it sends above the "Connect and scan" button. It doesn't read customers' names, email addresses or postal addresses, order contents, option contents or task arguments, and sends sales only as the two 30-day totals above.

• The dashboard: each time an administrator opens the plugin's page, it asks us for your store's results and when it may scan again, sending only the store's key. We answer with your store's audit history (below), the date of the next scan and the latest scan's analysis: your store's profile and business context, and every check with what was measured and its reference.

What the scan reads. Our scanner loads your store's public homepage, cart and checkout pages the way a visitor would, without running their JavaScript: it measures response times, page size and caching, and reads response headers and public platform markers. It also checks your HTTPS certificate and your domain's public SPF and DMARC records, and requests 18 well-known addresses on your store (such as configuration backups, .env files, the debug log, a .git folder, database dumps, site archives and phpinfo pages) to see whether anyone could download them; it reads at most 4 KB of each answer, follows no redirect and keeps only how many were found, never their contents. It doesn't log in, submit forms, place orders or read anything that isn't public. Each store can scan once a week. We email nothing for these scans.

Your scan's analysis. We keep each scan's full analysis, including your store's business context and its sales amounts, linked to your store for 12 months after the scan, deleted sooner with its audit request or on request. We use it to show it to you on the plugin's page and to answer you when you contact us. For a sole trader, sales can relate to a person: we keep them only for this, and they're not part of our statistics across stores.

Your audit history. We retain audit results linked to your store for support and comparison over time. For each completed scan we keep: the health score and risk level; which checks found a problem, as short identifiers, and how many points each cost; the server, cart and checkout response times; page weight and number of files; the autoloaded options size; the PHP version and object cache type; the days left on your HTTPS certificate; and whether SPF and DMARC records were found. These results are not anonymous: they are linked to your store through its audit request, which holds the admin email and IP address until those are erased after 90 days. We use them to show your store's results over time, to answer you, and, across stores, to improve our scanner. We keep them for 12 months after each scan, and delete them sooner on request.

Your store's profile. We keep the latest business context of each store (not the analysis, the store data, the checkout profile or any sales amount), replaced by each new scan. We use it as totals across stores, for example how many stores per country, size or checkout type, to understand which stores use the plugin, and to support your store when you contact us.

Legal basis (Art. 6 GDPR), by purpose:

• Registering your store, scanning it when you ask and keeping its analysis to show it to you: providing the service you request (Art. 6(1)(b)).
• The audit history: our legitimate interests in supporting your store, showing its results over time, and improving our scanner (Art. 6(1)(f)).
• The store profile and its statistics; the IP address, audit requests and limits: our legitimate interests in understanding who uses the plugin, supporting stores that contact us and preventing abuse (Art. 6(1)(f)).

You can object at any time: email [email protected] and we'll delete your store's audit history and profile, or stop scanning or uninstall the plugin, and nothing more is sent.

Uninstalling the plugin deletes everything it keeps on your store: its settings, its key and the table of daily totals. Records already on our side follow the periods in "How long we keep it" below, or are deleted sooner on request.

Pirkoo's website

pirkoo.com has no forms, analytics or cookies of its own. When you visit it, our hosting provider and Cloudflare process your IP address and the pages you request to deliver the site and protect it from abuse; if Cloudflare's bot protection checks your browser, it sets one security cookie, cf_clearance (HttpOnly, up to one year), which isn't used for tracking or advertising. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)); the cookie is strictly necessary for that security. tvarkom's company website, tvarkom.com, has its own privacy notice there.

When you email us

We keep your messages and contact details to answer you and, if you become a client, to do the work. Legal basis: taking steps at your request or performing a contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)).

Who processes data for us

• Fly.io: hosts pirkoo.com, Pirkoo's API and our scanner, with their databases and logs, on servers in Amsterdam, Netherlands.
• Cloudflare: DNS for pirkoo.com and network protection for the website.
• Google: Google Workspace hosts our mailboxes.

Some of these providers are based in the United States. Where data leaves the EU, they process it under an EU adequacy decision, such as the EU-US Data Privacy Framework, or Standard Contractual Clauses. We don't sell your data or use it for advertising. We don't take payments.

How long we keep it

These periods are applied automatically by our software:

• Failed scans (the request and any store data sent with it): 15 days after they failed.
• Audit requests (store, page addresses and time): 24 months, for our limits and records. The email address and IP address in them are erased after 90 days.
• Plugin registrations (store and admin email): the email is deleted after 12 months without activity, and the registration 24 months after the store's last scan. Activity means a successful scan, a registration or a reconnection.
• Audit results (the audit history) and each scan's full analysis (with its business context and sales amounts): 12 months after each scan, or sooner on request. They're also deleted with their audit request.
• Store profiles: replaced by each scan, and deleted with the store's registration (at the latest 24 months after its last scan), or sooner on request.

Other copies:

• Our mailboxes hold the emails you send us. They have no automatic deletion: we keep these messages for as long as we need them to deal with your request and any follow-up, and longer only where the law requires it.
• Database snapshots: our hosting provider takes daily snapshots of our databases, plus one before some updates, and deletes each after 5 days. We don't keep any other backups of the database. Data we've deleted can remain in a snapshot until it expires. We use snapshots only to restore our service, and if we restore one, we delete again anything that had already been deleted.
• Logs: our service logs record store addresses and technical identifiers, not scan contents or email addresses. Our hosting provider keeps them for about 7 days.

Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Email [email protected] and we'll reply within one month. For help with Pirkoo, email [email protected].

You can also complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (vdai.lrv.lt (https://vdai.lrv.lt/en/)), or to the authority where you live.

Changes

This policy is published at https://pirkoo.com/privacy/ and shipped with Pirkoo. If we change how we handle your data, we'll update it and the date at the top.