Introduction
Cirvgreen ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our website and services.
Cirvgreen is operated under the licensed trade name CirvGreen Education & Training Computer Software in Dubai, United Arab Emirates.
Information We Collect
Information You Provide
- Contact and pilot applications: Name, email address, selected subject, message text, and any information you choose to submit about your team and pilot fit
- Newsletter Subscriptions: Email address when you subscribe to our newsletter
- Account Information: Email and payment details when you purchase our products
Information Collected Automatically
- Usage Data: Pages visited, time spent, and interactions with our website
- Device Information: Browser type, operating system, and device identifiers
- Analytics: Plausible and Microsoft Clarity are disabled by default. Either provider is loaded only when the deployment owner explicitly configures its environment-specific identifier.
- Cookies and similar storage: Essential storage and any storage used by configured analytics providers, subject to their settings and policies
Cirv Sight
Cirv Sight is an administrator-initiated hosted evidence service. The Cirv Sight WordPress plugin sends data to the service only after a WordPress administrator takes an explicit action.
WordPress Connector Data
- Pairing: A short-lived, one-time pairing code, a random pairing-request identifier, the site's root HTTPS origin, connector type and version, and an Ed25519 public key
- Manifest Send: WordPress and connector versions, supported active Cirvgreen plugin slugs, a content-free manifest hash, timestamps, and signed authentication and replay-protection fields
- Disconnect and Rotate: A signed revocation message containing connector, key, and message identifiers, a nonce, an allowlisted reason, timestamps, a payload hash, and an Ed25519 signature
The connector does not send page content, page paths, visitor records, email addresses, cookies, consent records, prompts, citations, analytics, payment data, API keys, share-of-voice values, or the local private signing key.
Network and Infrastructure Data
Cirv Sight uses Cloudflare to deliver and host the service. Cirv Sight and Cloudflare may process the connecting WordPress server's IP address, timestamps, and standard HTTP request metadata for request delivery, rate limiting, abuse prevention, security, and logging. Cirv Sight's application rate-limit record uses an HMAC-pseudonymous identifier instead of storing the raw connecting IP address. Cloudflare's handling of transport and infrastructure data is also governed by Cloudflare's applicable terms and privacy documentation.
Connector Retention and Deletion
The intended Cirv Sight application retention schedule is:
- Connector-event and pseudonymous rate-limit records are scheduled for deletion on the first retention purge after 30 days
- Connector-security records are scheduled for deletion on the first retention purge after 90 days
- Expired pairing-grant records are scheduled for deletion on the first retention purge after 30 days from expiry
- Connector-binding records are scheduled for deletion on the first retention purge after 30 days from revocation or expiry
A connector binding is active for up to 90 days as a security-credential lifetime, not as a trial or paid limit. These periods apply to Cirv Sight application records. Production infrastructure-log retention, backup deletion, processing regions, and the complete production service-provider list must be verified before Cirv Sight WordPress reviewer or customer access is enabled. This policy will be updated with those verified details before that access is offered.
Data Stored in WordPress
The plugin stores its encrypted private signing key, connector binding, and bounded retry records in the site's WordPress database. Deactivation retains this local data. Disconnect asks Cirv Sight to revoke the remote binding and removes local credentials only after an exact acknowledgement. Uninstall removes local plugin data but does not contact Cirv Sight or independently revoke the remote binding, so administrators should disconnect before uninstalling when immediate remote revocation is required.
A pending pairing identity may remain locally for up to 91 days without storing the raw pairing code. A pending manifest retry is valid for four minutes. A signed pending revocation remains until it is acknowledged or the plugin is uninstalled. Data held only in WordPress is controlled by the WordPress site operator.
How We Use Your Information
We use your information to:
- Respond to your inquiries, assess pilot fit, and provide customer support
- Send newsletters and product updates (with your consent)
- Process purchases and deliver products
- Improve our website and services
- Comply with legal obligations
Third-Party Services
Our website and services use the following providers where the stated feature is enabled:
- Cloudflare: Hosts and delivers the website and Cirv Sight service, and provides application storage, request security, logging, and observability
- Google Workspace: Receives messages sent to our role-based privacy contact
- FormSubmit: Processes website contact and pilot-application submissions
- Buttondown: Manages newsletter subscriptions
- Plausible: Provides optional website analytics only when configured
- Microsoft Clarity: Provides optional heatmaps and session-replay analytics only when configured
- Render: Hosts the endpoint used by the shared footer newsletter form
- Stripe: Processes payments securely
- Freemius: Manages licensing for relevant Cirvgreen WordPress products; the Cirv Sight WordPress plugin does not contain a plugin-side licence check or paid feature gate
Each service has its own privacy terms governing its processing. Cirv Sight's complete production provider and processing-location list remains a pre-access requirement and will be published before WordPress reviewer or customer access is enabled.
Data Retention
We retain your personal data only as long as necessary for the purposes outlined in this policy, or as required by law. You may submit a deletion request at any time.
Your Rights
Depending on applicable law, you may have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Opt out of marketing communications
- Data portability
To submit a data-rights request concerning Cirv Sight, contact [email protected]. We may request information sufficient to verify the request and locate the relevant account or connector record. For data stored only in WordPress, contact the WordPress site operator.
Data Security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.
International Transfers
Our providers may process data outside the United Arab Emirates. Processing locations depend on the service and provider used. Before enabling Cirv Sight WordPress reviewer or customer access, we will verify and disclose its production processing regions and, where required by applicable law, the safeguards applicable to that processing.
Children's Privacy
Our services are not intended for children under 16. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with an updated revision date.
Contact Us
For questions about this privacy policy or our data practices, contact us at:
- Email: [email protected]
- Location: Dubai, United Arab Emirates