Privacy Policy

Last updated: 24 October 2026

This Privacy Policy explains what personal data NinjaHackz collects when you use ninjahackz.com, docs.ninjahackz.com, the NinjaHackz app and our support services, why we use it, who we share it with, how long we keep it, and your rights.

1. Who is responsible for your data

The data controller is EGM SOFTWARE LTD, trading as NinjaHackz, a company registered in England and Wales under company number 10846809, registered office 71-75 Shelton Street, London, England, WC2H 9JQ.

For privacy questions or requests, email [email protected] (please put “Privacy request” in the subject) or open a ticket in our support portal.

2. The data we collect

Account and order data. Your email address, name (if you provide it), billing details shown at checkout (such as country and billing address), order history, plan, subscription status, renewal dates, invoices, licence keys and licence status.

Payment data. Your payment is handled by Stripe or PayPal. We receive limited details, such as payment method type, the last four digits of a card, payment status and dispute information. We never see or store your full card number.

Licence and device data (from the app). To validate your licence, the app sends your licence key, a device identifier derived from your hardware, and your computer name (used to name the activation) to our licensing provider, SureCart. SureCart also receives the IP address of these requests and records the date and time of activations and licence checks. The app checks your licence from time to time while you use it, and keeps your licence details on your device so you do not have to enter them again.

Crash data. Crash logs stay on your device and are not uploaded to us. If you choose to send us crash files or the app’s “Copy info” text (app status, error message, build date and time), we use them only to help you. The app does not contain analytics or telemetry code.

Support data. When you contact support, we store your name, email address, ticket subject, messages, any attachments you upload (up to 5 files, 5 MB each), tags, internal notes and a history of the ticket. To help you, support may look up your orders, subscriptions, licences and device activations.

Marketing data. If you are on our mailing list, we store your email address, name, subscription status, lists and tags, purchase records synced from our store, your website user ID and sign-up source, and email activity (deliveries, opens, clicks and confirmations).

Website and analytics data. With your consent where required, we use cookies and similar technologies to understand how our websites are used, including pages viewed, referrers, device and browser type, approximate location (country) and first-party identifiers. See our Cookie Policy.

Forms. If you fill in a form on our site (for example the newsletter sign-up or the checkout feedback survey), we store the answers you give.

3. How and why we use your data

AI-assisted support. We use Grok, provided by SpaceXAI, to help with support. Some replies may be drafted or sent by AI under the “NH Support Team” name. To do this, the AI processes the content of your ticket and the order and licence information needed to answer it. You can always ask for a human to handle your request by saying so in your ticket.

Automated actions. Some account actions happen automatically, for example licence deactivation when a renewal payment fails or when a payment is disputed. If you think an automatic action was wrong, contact support and a person will review it.

4. Who we share data with

We do not sell your personal data. We share it only with service providers who process it for us, and with others where the law requires:

• SureCart (store, checkout, licences, customer dashboard, receipts)
• Stripe (card, Link and wallet payments, tax calculation, fraud checks)
• PayPal (PayPal payments)
• SureContact by Brainstorm Force (email marketing and CRM)
• SureMail with Amazon Web Services (Amazon SES) (sending website and notification emails)
• SureForms (website forms)
• OttoKit (automations, for example applying CRM tags, revoking licences after a dispute and sending purchase events to analytics)
• Fluent Support (support ticket system, hosted on our website)
• SpaceXAI (Grok) (AI assistance with support replies)
• Google (Google Analytics 4 and Google Tag Manager, through our own first-party tagging server; Google reCAPTCHA for spam protection; Google advertising cookies only with your consent)
• Cloudflare (network, CDN, security, bot protection and Cloudflare Zaraz)
• ShortPixel (image optimisation and image CDN)
• Mintlify (hosting of docs.ninjahackz.com)
• Hetzner Online (hosting of our website and tagging server in Germany)
• Payment processors, banks and card networks: when you dispute a payment, we share order, delivery, account and licence activation records (including device identifiers, IP addresses and time stamps) so they can investigate the dispute and prevent fraud.
• Authorities, where we are legally required to share data.

5. Where your data is processed

Our website is hosted on servers in Germany. Some of our providers are based in, or process data in, countries outside the UK and EEA, including the United States. Where this happens, we rely on the safeguards those providers offer under UK and EU law, such as adequacy regulations, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

6. How long we keep data

We keep personal data only as long as we need it for the purposes above:

• Account, order, payment and licence records: while your account is active, and afterwards for as long as we need them for tax, accounting, fraud prevention and payment disputes (UK law generally requires accounting records to be kept for 6 years).
• Support tickets: while your account is active or until you ask us to delete them, unless we need a ticket for an open dispute or legal claim.
• Email marketing: until you unsubscribe. After you unsubscribe or your email bounces, we keep a minimal suppression record so we do not email you again.
• Logs of emails sent by our website: 90 days.
• Cookie consent records: 12 months.
• Analytics data: according to the retention settings of Google Analytics.

7. Your rights

Under UK GDPR and EU GDPR, you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• ask us to delete your data;
• restrict or object to our use of your data, including at any time for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To use these rights, email [email protected] or open a ticket in our support portal. We will reply within one month.

How deletion works.

1. Send your request from the email address on your account to [email protected].
2. We send you a confirmation email with a link. Click it to confirm the request is yours.
3. Once confirmed, we use WordPress’s personal data erasure tool to remove your data from our website, including your support tickets. We also delete or anonymise your customer, marketing and form records in our other systems.
4. We tell you by email when this is done.

We do not delete records that we must keep for tax and accounting, fraud prevention, or an open payment dispute or legal claim. We keep those only for the period the law requires, and then delete them. Payment providers such as Stripe and PayPal keep their own records under their own legal obligations.

Exporting your data. Ask the same way. After you confirm by email, we send you a copy of your data.

Marketing choices. Every marketing email has a link to manage your preferences or unsubscribe. You can opt out of categories (Announcements, Newsletter, Promotional) or all marketing. Transactional emails about your orders, licence and account are always sent.

Cookies. Change your choices at any time with the Cookie Preferences button on our site.

Complaints. You can complain to the UK Information Commissioner’s Office through the ICO website or to the data protection authority in your country. We would appreciate the chance to resolve your concern first.

8. Security

We use HTTPS, Cloudflare security and bot protection, and access controls to protect your data. No method of transmission or storage is completely secure.

9. Children

You must be 18 or older to buy a plan. Users aged 16 or 17 may use NinjaHackz only with the permission of a parent or guardian, who must make the purchase. NinjaHackz is not for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child under 16 has given us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy. We will post the new version here with a new “Last updated” date and, for significant changes, tell customers by email.

11. Contact

EGM SOFTWARE LTD, trading as NinjaHackz
Company number 10846809 (England and Wales)
Registered office: 71-75 Shelton Street, London, England, WC2H 9JQ
Email: [email protected]
Support: open a ticket in our support portal