Privacy policy

Effective 16 October 2026

Who we are

MazeGuard Security and MazeGuard Cloud are built and operated by Design Maze ("we", "us"). Questions about this policy, or requests about your data, go to contact@getmazeguard.com.

This website

getmazeguard.com is a set of static pages. It sets no cookies, runs no analytics and loads no fonts, scripts or images from any third party. It is hosted on Cloudflare, which processes the technical details of each request — such as your IP address and browser user agent — to deliver the page and protect it from abuse, as described in Cloudflare's privacy policy. We do not use that data to identify or track you.

The plugin, without a licence

Everything the free plugin does — two-factor authentication, account security, malware and database scanning, file integrity, quarantine, the activity log — runs on your WordPress server and stores its results in your own database. None of it is sent to us.

The plugin does contact other services directly from your server. None of this data reaches us:

• WordPress.org, to check WordPress core files against official checksums (sending your WordPress version and locale, with a user agent naming the plugin and your site address), and to compare your plugins and themes with their releases (sending each one's slug and version — the same information WordPress sends when it checks for updates). The second can be turned off under MazeGuard > Settings. See the WordPress.org privacy policy.
• Cloudflare, only if you add your own Cloudflare API token, to manage blocks and settings in your own Cloudflare zone. See Cloudflare's privacy policy.

MazeGuard Cloud

MazeGuard Cloud is optional. Your site sends nothing to it until an administrator enters a licence key under MazeGuard > Cloud & License and ticks the consent box. From then on, we receive the following, and only the following.

When you connect a site

• The licence key, your site's address and your site's name.
• To confirm you control the site, our server makes one request back to it (/wp-json/mazeguard/v1/verify) and checks a token your plugin generated.
• We then issue the site a connection secret used to sign its later requests.

Periodic site summary

• Your site's address and name; the plugin, WordPress and PHP versions.
• The MazeGuard security score.
• The number of active plugins, installed plugins and installed themes — not their names.
• Counts of findings from each scan type, and counts of accounts in each security state (for example, how many administrators lack two-factor). No usernames, email addresses or IP addresses.
• When the summary was sent. The time of each contact is what lets us notice when a site goes silent.

Alerts relayed for delivery

• Each alert's type, severity, counts and time.
• The alert's wording only if an administrator has turned on the setting that includes it. That setting is off by default. When on, the wording can name an account or an IP address — for example, the account that was locked after failed sign-ins.
• We keep the most recent 20 alerts for each site. Alerts are delivered by email or webhook to the MazeGuard team, who follow up with you as agreed for your licence.

External scans

If you request an external vulnerability scan, our servers make ordinary web requests to your site's public address, as any visitor would, and keep the results to show you.

What MazeGuard Cloud never receives

File contents, database values, passwords, two-factor secrets, customer or order records, quarantined files, and the names or contact details of your site's users. The plugin builds the summary from a fixed list, and our server discards any field not on its own matching list.

Buying a licence

Payments are handled by Stripe. We never see or store card details. From Stripe we receive the name or email address given at checkout, the identifiers of your Stripe customer record and subscription, and the subscription's status, so we can issue, renew, suspend or cancel your licence. Your licence key is sent to you once and stored by us only as a one-way hash, which is why we cannot show it again. See Stripe's privacy policy.

Why we use this data

Only to provide MazeGuard Cloud: to check your licence, show your sites' status, deliver alerts, detect sites that stop checking in, run scans you request, and handle billing. We do not sell it, use it for advertising, or combine it with data from elsewhere. Where a legal basis is required, it is the performance of our contract with you, and our legitimate interest in keeping the service secure.

Who else handles it

We share it only with the providers that run the service for us — our server hosting provider, Stripe for payments, and our email delivery provider for alerts and licence keys — and with authorities where the law requires it.

How it is protected

Data is stored encrypted on servers we operate and travels only over HTTPS. Each connected site signs its requests with its own secret, and licence keys are stored only as hashes.

How long we keep it

We keep a site's data while its licence is active. Disconnecting a site in the plugin stops all further data from it and revokes its connection secret; the site's existing record is kept so your licence history stays intact, until you ask us to delete it. Email contact@getmazeguard.com and we will delete your sites' records, and your licence record once any billing obligations are settled.

Your choices and rights

You can disconnect a site, turn off alert wording, or turn off the WordPress.org comparison at any time from the plugin. You can ask us what we hold about you, ask us to correct or delete it, or object to how we use it, by emailing contact@getmazeguard.com. You may also complain to your local data-protection authority.

Changes

If we change what we collect, we will update this page and its effective date before the change takes effect, and say so in the plugin's changelog.