Lapaas Cortex ("Cortex", "we") is the licensing, account and AI service platform for the Lapaas
WordPress plugin suite, operated by Lapaas (lapaas.com). This policy explains what we collect,
why, and the choices you have.
What we collect
- Account information. When you sign in with Google we receive your name, email
address and profile picture. We use this only to identify your customer account, your licenses
and your purchases.
- License & site data. When a Lapaas plugin is activated with a license key we
record the site's domain, WordPress/PHP versions and plugin version, so you can see and manage
your connected sites and so we can enforce plan limits.
- Anonymous usage telemetry (opt-in). If you grant consent inside the plugin, we
receive anonymous, aggregated counters (for example "threats blocked" or "images optimized")
identified only by a random ID — never page content, visitor data, or personal information.
You can withdraw consent at any time in the plugin.
- Payment records. Payments are processed by our payment providers (for example
Razorpay). We store the order reference, plan and amount — never your card details.
Google user data (Search Console & Analytics)
If you choose to connect Google Search Console and Google Analytics, Cortex requests
read-only access (webmasters.readonly, analytics.readonly) so your own
search and traffic statistics can be shown inside your WordPress dashboard and used by the
Lapaas SEO tools on your site.
- Your Google refresh token is stored encrypted (AES-256-GCM) on our servers and is
never shared with your WordPress site, other users, or any third party.
- We fetch data from Google only when your site requests it, and only for the site the
connection belongs to.
- We do not sell, share or transfer Google user data to anyone. We do not use it for
advertising. We do not allow humans to read it except with your explicit permission for
support, or where required for security or by law.
- Disconnecting (one click in the plugin) immediately deletes the stored token and revokes
our access with Google. You can also revoke access at
myaccount.google.com/permissions.
- Lapaas Cortex's use and transfer of information received from Google APIs adheres to the
Google API Services User Data Policy,
including the Limited Use requirements.
What we never collect
- Your site's visitor data or personal data of your users.
- Page content, posts, or media from your site.
- Card numbers or banking credentials.
Retention & deletion
Account and license records are kept while your account is active. Google connections are
deleted immediately on disconnect. To delete your account and associated data, email
[email protected] — we complete deletion requests within 30 days.
Security
All traffic is encrypted in transit (TLS). Secrets and Google tokens are encrypted at rest.
Access to production systems is limited to authorized Lapaas operators.
Contact
Lapaas · lapaas.com ·
[email protected]