HKC PluginsPrivacy policy
Last updated: [date]
HKC Plugins publishes WordPress extensions, including HKC Performance, and operates a sign-in service at auth.hervekabla.com that lets those extensions connect to a Google account. This policy explains what data is processed, by whom, and why.
1. Who is responsible
Hervé Kabla, [postal address]. Contact: [contact email].
2. The WordPress extensions
The extensions run on your own WordPress site. The data they handle — performance measurements, Search Console figures, Google connection tokens — is stored in your site's database, under your control. We do not receive it. Uninstalling an extension deletes its data and revokes its Google access.
When checking for updates, your site downloads a small file from this website (plugins.hervekabla.com). Like any web request, it reaches our host's server logs (IP address, date, requested file); we do not use these logs for any other purpose.
3. The sign-in service (auth.hervekabla.com)
When you click “Sign in with Google” in an extension, the sign-in goes through our service, which holds the Google application credentials. The service processes:
| Data | Purpose | Retention |
|---|---|---|
| Address and name of your site | Shown on the confirmation page; used to send you back to your site | Up to 15 minutes, then deleted |
| Google OAuth tokens (access and refresh tokens) | Handed over to your site right after sign-in; used to renew your site's access token; checked to allow Chrome UX Report requests | Not stored: in transit only. The one-time handoff expires after 5 minutes; a token validity check is cached for at most one hour |
| Cryptographic fingerprints of IP addresses and tokens | Abuse prevention (rate limiting) | Up to 24 hours |
The service does not receive, store or analyse your PageSpeed Insights or Search Console data: your site calls Google directly. Temporary data is encrypted at rest. The only cookie is a short-lived security cookie on the confirmation page.
4. Google user data
The extensions request read-only access to Google Search Console (https://www.googleapis.com/auth/webmasters.readonly), and your basic account identity (openid, email) to show which account is connected. This data is used only to display performance and search reports to you, inside your own WordPress admin.
HKC Plugins' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data, do not use it for advertising, do not transfer it to third parties, and do not allow humans to read it, except with your explicit consent for support, for security purposes, or to comply with the law.
You can revoke access at any time from the extension (“Disconnect”) or from your Google account permissions.
5. Hosting and security
This website and the sign-in service are hosted by OVHcloud, in France. All communications are encrypted (HTTPS).
6. Your rights
Under the GDPR you have the right to access, rectify and erase your data, and to lodge a complaint with your supervisory authority (in France, the CNIL). Given the minimal and short-lived data processed by the service, most requests concern data stored on your own site, which you control directly. Contact: [contact email].