Who we are
SiftWP ("SiftWP," "we," "us") is a WordPress security scanning and auto-fix service operated by Logic Nexa Solutions. This policy applies to siftwp.com and app.siftwp.com. If you have questions about this policy, the fastest way to reach us is the WhatsApp chat link on any page of the site, or through your dashboard once you've signed up.
What we collect
Account information
When you sign up, we collect your email address and a password (stored hashed, never in plain text). If you connect a site, we also collect the site's URL and the cPanel/hosting username you provide.
SSH key material
To connect to your site, SiftWP generates a dedicated SSH key pair specific to that connection. The public key is what you import into your hosting account. The private key is stored encrypted on our systems and used only to authenticate SiftWP's own scans and fixes against your site — it is never used for any other purpose, and it never includes or touches your WordPress admin password or your hosting account's master password.
Scan and site data
Running a scan reads file metadata, file contents where necessary to check for tampering or malware, and limited database contents from your connected site, strictly to identify and report security findings. We don't read or store your site's content beyond what's needed to complete a scan and show you the results.
Payment information
Payments are processed by Stripe. SiftWP does not collect or store your full card number — Stripe handles that directly, and we receive only what's needed to manage your subscription (plan, billing status, and transaction history).
Usage and analytics data
We use Google Analytics to understand aggregate traffic to siftwp.com — pages visited, general location, device type. This is standard web analytics and is not linked to your account data.
How we use your data
- To provide the service — running scans, applying fixes, and showing you results in your dashboard.
- To process payments — via Stripe, for paid plans and credit purchases.
- To communicate with you — scan results, security alerts, and account-related messages. We don't send marketing email without your consent.
- To improve the service — aggregate, anonymized analytics on how the site and product are used.
Who we share it with
We don't sell your data. We share the minimum necessary with a small number of service providers who help us operate: Stripe (payments), our hosting and database infrastructure providers, and Google Analytics (aggregate site analytics). Each is bound by its own privacy and data-protection terms.
Data retention
We retain account and scan data for as long as your account is active. If you delete your account, we delete your SSH key material and site connection details within 30 days. Some records (like billing history) may be retained longer where required by law.
Your rights
You can access, correct, or delete your account data at any time from your dashboard, or by reaching out to us directly. If you'd like your SSH key revoked immediately rather than waiting for account deletion, you can also remove it directly from your hosting account's SSH key manager — see the installation guide for where that's found.
Cookies
siftwp.com uses essential cookies to keep you logged in across the marketing site and the dashboard, and analytics cookies (Google Analytics) to measure traffic. You can control cookies through your browser settings.
Children's privacy
SiftWP is not directed at children under 16, and we don't knowingly collect data from them.
Changes to this policy
If we make material changes to this policy, we'll update the "Last updated" date above and, for significant changes, notify active account holders by email.