Privacy Policy

Effective date: November 1, 2026

This Privacy Policy explains what personal information Ostara Ventures LLC ("Ostara", "we", "us") collects through the Permitly pages of our website (ostaraventures.co/permitly), the Permitly plugin and its online services (the "Services"), how we use it, and the choices you have. It works together with the Permitly Terms of Service and License.

The short version

This summary helps you read the policy. It is not part of it; the full policy controls.

• Consent records never come to us. Children's names, parents' details, signatures and consent records stay in your own WordPress database. We cannot see or reach them.
• We receive only what we need to sell, license and support Permitly: your name, email and billing details at checkout (handled by Freemius), license and site details, and anything you send us.
• If you use automatic translation or the people check, we receive form wording or downsized images only to do that job, and we keep no images.
• We do not sell or share personal information, and we do not use advertising or tracking cookies on these pages.
• You can ask us to see, correct or delete your information by emailing [email protected].

1. Who this policy covers

1.1 Our customers and visitors. This policy covers people who visit the Permitly pages of our website, download or buy Permitly, use the Services, or contact us.

1.2 Not your organization's website. Permitly runs on websites operated by our customers. Each customer decides what it collects from families and staff, and is responsible for its own privacy notice. The information Permitly stores on a customer's website, including the consent registry, belongs to that customer and is not collected by us. If you are a parent or guardian with a question about your child's photos or consent, please contact the organization that runs the program. If you contact us instead, we will point you to them.

2. What we collect

2.1 When you visit our website. These pages do not use analytics, advertising or tracking cookies. Like any website, our hosting provider (Cloudflare) processes standard technical information such as your IP address, browser type and the pages requested, to deliver the site and protect it from abuse. The pages load fonts from Google Fonts, which receives your IP address and browser details when the fonts load.

2.2 When you buy. Purchases are processed by our checkout provider, Freemius, which may act as the seller of record. Freemius collects your name, email address, billing address and payment details under its own privacy policy. We receive your name, email, organization, the plan you bought, your license and your payment history. We never receive or store your full card number.

2.3 When you install and activate the plugin. To activate and check your license, deliver updates and prevent abuse, the plugin shares with Freemius, and through it with us, your website address, the WordPress, PHP and plugin versions, the site's language, the activating administrator's name and email address, and a license or installation ID. During setup the plugin may also ask whether to share basic, non-sensitive usage data. That is optional, and consent records are never included.

2.4 When you use automatic translation. We receive the English lines of your consent form that changed, the language code and your installation ID. We keep a copy of each translated line, and a monthly usage count per site, so the same text is never paid for twice. Permitly is designed so that no child, parent or consent information is sent. Please do not put personal information into your form wording.

2.5 When you use the people check. Only if an administrator turns it on, we receive downsized copies (no larger than 768 pixels) of images that are live on your website and still need an answer, with your installation ID. We use them only to answer whether each image shows any person. We do not identify anyone, estimate anyone's age or other traits, or create face templates or other biometric identifiers. We do not keep the images: we keep only a one-way fingerprint of each file with its answer, and a monthly usage count per site.

2.6 When you contact us. If you email us, we receive your email address, your message and anything you attach. Please do not send us consent records or other information about children or parents.

3. How we use information

We use the information above to:

• provide, license, update and support Permitly and the Services;
• process purchases, renewals and cancellations, and send receipts and notices about your account, the Terms or renewals;
• keep the Services secure, enforce plan limits and prevent fraud and abuse;
• understand, in aggregate, how Permitly is used so we can improve it, if you opted in to usage data; and
• comply with the law and protect our rights.

We do not use your information for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share it with

4.1 No selling or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4.2 Our service providers. We share information only with companies that help us run Permitly, bound by written terms that limit their use of it. This table is our public list of subprocessors, and we will update it if we add one that materially changes how images are processed:

Anthropic's commercial terms do not allow it to train its models on what we send, and it may keep that content for a limited time for safety and legal reasons.

4.3 When the law requires it. We may disclose information if required by law, legal process or a government request, or to protect the rights, property or safety of Ostara, our customers or others.

4.4 If our business changes. If Ostara is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, subject to this policy.

5. How long we keep it

• Purchase, license and payment records: for as long as you are a customer and as long as tax and accounting laws require after that, generally up to 7 years.
• Activation and site details: while the installation is active, and for a reasonable period after.
• Translated lines and people check fingerprints with their answers: kept to avoid repeat charges, and deleted when no longer needed. They contain no images and no consent records.
• Support emails: for as long as needed to help you and keep a record of what we agreed.

When a customer's Pro License ends, we delete or de-identify any personal data we still hold on their behalf through the Services within 30 days, and a customer can ask us to do so at any time. Records we must keep, such as license and billing records, are kept as described above. Section 17 of the Terms has the details.

6. Security

We use reasonable technical and organizational measures to protect information, including encrypted connections, signed requests between the plugin and our Services, and keys that are never stored in the plugin. No system is perfectly secure, and we cannot guarantee absolute security. If we confirm a security incident affecting personal data we process for a customer, we will notify that customer without undue delay and, where feasible, within 72 hours, as described in Section 13 of the Terms.

7. Children

Permitly is a business tool for organizations. Our website and Services are not directed to children, and we do not knowingly collect personal information from anyone under 18. Information about children in our customers' programs stays on our customers' own websites, as described in section 1.2.

8. Your choices and rights

8.1 Your requests. You can ask us to tell you what personal information we hold about you, to correct it, or to delete it, by emailing [email protected]. We will verify your request and respond within 45 days. Some information, such as payment records, we may need to keep to meet legal obligations.

8.2 California residents. Depending on our size, the California Consumer Privacy Act may not apply to us. Either way, we honor the rights it describes: to know, correct and delete your personal information, and not to be treated differently for making a request. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would require offering a right to limit its use. You may use an authorized agent to make a request.

8.3 Do Not Track and Global Privacy Control. Because these pages use no tracking or advertising cookies, there is nothing for a Do Not Track or Global Privacy Control signal to turn off. We treat a Global Privacy Control signal as a request not to sell or share, which we already do not do.

8.4 Emails. We send only emails about your purchases, license, renewals, these terms and support. You can stop optional emails at any time.

8.5 Usage data. You can turn off optional usage data sharing in the plugin's account settings at any time.

9. People outside the United States

Ostara is based in California, and our providers may process information in the United States and other countries. By using Permitly you understand that your information may be processed in the United States.

10. Changes to this policy

We may update this policy. We will post the new version here with a new effective date, and for material changes we will give customers notice by email or in the plugin at least 30 days before the change takes effect.

11. Contact

Ostara Ventures LLC San Diego County, California [email protected]