LEGAL & PRIVACY

How DiviHarbor collects, uses and protects personal information.

Effective date: 28 October 2026

Version: 1.0

DiviHarbor is a digital membership platform offering access to a library of third-party WordPress and Divi plugins and related digital resources. DiviHarbor is operated by Mioo Design (trade name of Andi Fosselle), a business registered in Belgium under enterprise number 0700.444.126 (VAT BE 0700.444.126), at Stegelstraat 18, 8810 Lichtervelde, Belgium. In this Policy, “DiviHarbor”, “we”, “our” and “us” refer to Mioo Design as the controller of the personal data described below.

This Policy explains how we collect, use, disclose, safeguard and retain personal data when you visit our website, create an account, purchase or manage a membership, download resources, contact support or interact with our marketing. It applies to business customers and individual consumers worldwide, subject to applicable local law. This Policy should be read alongside our Terms and Conditions. Information about cookies and tracking technologies is included in this Policy.

Depending on how you use our services, we may process: (a) identity and account information such as first and last name, email address, username or internal account identifier, password hash, account status, account creation and authentication events; (b) billing and transaction information such as country, billing address, company name and VAT number where provided, purchase and renewal history, amounts, currencies, invoices, refunds, payment status, payment-provider reference and, if returned by the payment provider, limited card details such as the last four digits; (c) membership and download records identifying the account, plugin, release or version downloaded, download date and time and download status; (d) communications including contact details, enquiry subject, messages, support-ticket history, and any order or account details needed to resolve a request; (e) technical and security information such as IP address, browser/device information, authentication and security logs, error events, suspicious activity indicators and fraud-prevention signals where collected; and (f) marketing, cookie and analytics data, including newsletter preferences, consent histories, cookie identifiers, website interaction and advertising conversion data, to the extent permitted and enabled.

We do not request sensitive personal data as part of the normal membership service. Please avoid including confidential, sensitive or unnecessary personal information in support messages. We do not publish customer reviews, ratings or public customer profiles.

We receive data directly from you when you register, buy, manage settings or contact us; automatically from your use of our website and downloads; and from service partners such as payment providers and authentication providers. If you choose Google or Apple sign-in where available, we may receive the information you authorize those providers to share, generally an authentication identifier, name and/or email address. Their own privacy terms also apply to their services.

We process personal data only where a legal basis applies:

• Contract (Article 6(1)(b) GDPR): registration, authentication, providing and managing membership access, processing orders, making downloads available, handling renewals and delivering requested support.
• Legal obligation (Article 6(1)(c)): tax, accounting and invoicing requirements; lawful requests and other mandatory compliance obligations.
• Legitimate interests (Article 6(1)(f)): securing the website and accounts, preventing fraud or abuse, troubleshooting, maintaining service continuity, defending legal claims and improving support, after weighing these interests against your rights. You may object where the law allows.
• Consent (Article 6(1)(a)): non-essential cookies and tracking where consent is required, and promotional communications requiring an opt-in. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

We do not treat consent to the Privacy Policy or acceptance of our Terms as consent to advertising or tracking.

An account is required to use a membership; guest checkout is not offered. Registration is intended for adults aged 18 or over. You may sign in with an email address and password, or through an enabled Google or Apple sign-in option. Passwords must be stored using appropriate one-way hashing, not in readable form. Login and recovery events may be logged to protect accounts. Where third-party sign-in is used, the provider may process data according to its own policy.

We use WooCommerce to manage orders, membership transactions and billing information and may transmit necessary invoicing details to an external accounting or invoicing provider operating under an appropriate legal arrangement. Online payments are handled by the payment provider displayed during checkout, currently planned to be Stripe. Payment providers process payment credentials and may perform their own fraud checks. We do not intentionally store full payment-card numbers or security codes on our website. We may retain payment references, transaction status, invoices, renewals, cancellation records and evidence relating to disputes where necessary.

Annual memberships renew automatically where described during purchase and under the applicable Terms. Founders Lifetime and other Lifetime products are one-time purchases where offered. The exact prices and available membership plans appear at checkout; this Policy is not a pricing agreement.

For each download, we record the relevant account, the resource and release/version, the date and time and the result of the download. We use these records to provide access, troubleshoot failures, administer memberships and identify suspicious activity, excessive automated downloading or potential account sharing. Technical security signals may also be used where appropriate. Suspected misuse can be reviewed and may lead to proportionate account-protection measures under our Terms, subject to applicable law.

DiviHarbor does not itself operate a vendor licensing-activation system or routinely transmit a member's website/domain to an original plugin developer. A separately installed third-party plugin may independently communicate with its developer or other services; its functionality and privacy practices are governed by the developer's own documentation and terms.

We use information submitted through our contact forms and ticketing system to answer pre-sales enquiries, investigate problems, provide account assistance, prevent spam and maintain a record of interactions. The ordinary form requests a name, email address, subject and message. Support staff may associate messages with an existing account or order where needed. File attachments are not currently part of the standard form; if enabled in the future, uploaded materials will be subject to appropriate security controls and data minimization.

Where you subscribe or another legal permission applies, we may send product announcements, new-plugin notices, news, offers and related marketing. We maintain a history of marketing choices, including when consent is given, withdrawn or renewed. You can unsubscribe using the link in the message or your account preferences when available. Unsubscribing from marketing does not stop essential account, billing, security or support communications. We may retain limited suppression records to respect opt-outs.

We use strictly necessary technologies for login, account security, membership sessions, language preferences, cart/checkout functions and remembering privacy choices. Subject to the appropriate choices and legal requirements, we may also use Google Analytics 4, Microsoft Clarity, Google Ads tags, Meta Pixel, LinkedIn Insight Tag and remarketing technologies for analytics, product improvement, conversion measurement and advertising. Google Search Console and Bing Webmaster Tools may be used for search performance; their use does not by itself mean that a tracking cookie is installed on your device.

For visitors subject to EU/EEA cookie rules, non-essential cookies and comparable tracking are not activated before valid consent, except where an applicable legal exception exists. The cookie interface offers Accept all, Reject non-essential and Customize, with category-level choices and a way to change or withdraw consent later. A pseudonymous consent record may document the choice, time, policy/banner version and changes. Further details about the cookies actually used, their providers, purposes and lifetimes will be included in this Policy as the production configuration is verified.

Pages may feature embedded YouTube or Vimeo videos, live demonstrations, externally hosted fonts, Gravatar elements, anti-spam tools, or other third-party components. Loading an embedded service can transmit your IP address, device information or other technical data to its provider. We aim to block non-essential embeds until the necessary consent is obtained, and to offer an alternative or explanation where appropriate. When you follow a link away from DiviHarbor, the destination operates under its own privacy terms. We are responsible for the collection and disclosure that we determine or participate in on our site; we cannot exclude that responsibility merely because a third party subsequently processes the data.

We may use AI-assisted tools to draft general website content and, where deployed, to categorize or summarize support requests, identify service patterns or help detect potentially fraudulent use. Such processing may involve account, support, download or technical data strictly to the extent needed for the particular purpose. We seek to limit access, restrict onward disclosure and apply appropriate safeguards. We may analyse user behaviour for service quality, security and lawful marketing purposes. Where personal-data profiling is used, applicable transparency, objection and other rights continue to apply. We do not intend to make decisions that produce legal or similarly significant effects solely by automated means without a lawful basis and the safeguards required by applicable law, including meaningful human review where required.

We disclose personal data only where reasonably necessary to provide the services or comply with law. Relevant categories and services may include OVHcloud (hosting and backup storage in France), Cloudflare (content delivery, traffic and website protection), Stripe (if used at checkout), payment and banking partners, external accounting/invoicing providers, identity providers (Google or Apple if enabled), support and email infrastructure, and authorised staff or professional advisers. Depending on consent and feature activation, analytics, advertising and content recipients may include Google, Microsoft, Meta, LinkedIn, YouTube/Vimeo and other providers described in the cookie and tracking information within this Policy.

Some providers act as processors on our instructions; others act as independent controllers for specific activities. We assess applicable contractual and privacy responsibilities. We do not provide our member database to original plugin developers merely because their plugins appear in our library. We do not directly sell customer lists.

Our main hosting and backups are intended to be located in France. However, some suppliers, authentication systems, analytics, advertising services or support technologies may process or access personal data outside the European Economic Area, including in the United States. Where required, we rely on a valid adequacy decision (including applicable EU-US Data Privacy Framework certification), standard contractual clauses or other permitted safeguards, together with supplementary measures where appropriate. You may contact us for information about relevant transfer safeguards.

We apply the principle that personal data should not be retained longer than necessary. Our operational retention schedule is based on the following criteria and must be reflected in the deployed systems:

• Active account and membership data: for as long as the account or membership is required; after closure or an inactive expired membership, unnecessary data should be erased or anonymised, normally within 24 months, except where another basis requires retention.
• Accounting documents, invoices and credit notes: for the applicable Belgian statutory retention period (generally seven years for ordinary VAT invoices, calculated from 1 January following issue), or longer where a specific law or properly evidenced dispute requires it.
• Support and pre-sales tickets: normally 24 months after the last relevant interaction or ticket closure, unless needed for an ongoing claim or mandatory obligation.
• Download history: while relevant to account access and security, followed by deletion or anonymisation after account closure or expiration, normally no later than 24 months unless a concrete incident or claim requires longer retention.
• Security and server logs: for a limited period proportionate to security and troubleshooting needs; the exact category-specific periods are specified in our internal retention schedule. Logs relevant to an incident may be retained longer where justified.
• Marketing preferences and consent records: for as long as marketing is active and subsequently as necessary to document consent or honour an opt-out; cookie-consent choices are retained for proportionate periods and refreshed when appropriate.
• Backup copies: normally rotated and deleted within 30 days; information lawfully removed from the live platform may remain in restricted backups until the relevant backup expires.

If a legal hold, chargeback, complaint or ongoing dispute applies, relevant records may be retained for the time reasonably needed to establish, exercise or defend claims. We do not automatically keep all personal data for twenty years.

We use proportionate organisational and technical safeguards, including HTTPS, restricted role-based access, multi-factor authentication for authorised personnel, encryption of suitable backup data, updates, access reviews and security monitoring where configured. Access is limited to people or suppliers with a legitimate need. No online service can guarantee absolute security, but we take appropriate action to prevent and respond to incidents in line with applicable law.

Subject to legal conditions and exceptions, you may request access, rectification, erasure, restriction, portability and may object to processing based on legitimate interests or to direct marketing. You may withdraw consent at any time and, where applicable, seek safeguards against qualifying solely automated decisions. We may need to verify identity before providing or deleting account information. Requests are normally handled within one month; lawful extensions may apply. Erasure does not override mandatory invoice retention or properly justified claim-related preservation.

Use the privacy request option in My Account (when available) or the contact/support form on DiviHarbor, selecting a privacy-related subject. A usable form is available to visitors who are not logged in, so an account is not a condition for exercising privacy rights. We may contact you privately to verify your request. Our controller's registered details are provided in Section 1. You also have the right to complain to the Belgian Data Protection Authority (GBA/APD) at https://www.dataprotectionauthority.be or to another competent supervisory authority where the law permits.

Membership purchases and registrations are intended only for people aged 18 years or older. We do not knowingly market memberships to, or intentionally collect registration details from, children. Please contact us if you believe a child has submitted account information.

The details marked mandatory during registration and checkout are necessary to create an account, supply a paid service, comply with invoicing law or protect payments. If you do not provide them, we may be unable to provide the requested membership or purchase. Marketing consent and non-essential cookies are optional; refusal does not prevent core membership access.

We may update this Privacy Policy if our services, providers or legal obligations change. We publish the current version and effective date on this page. Where an update materially changes processing or the law requires notice or renewed consent, we will provide an appropriate notice or obtain consent. Earlier versions may be retained for accountability.

DiviHarbor — operated by Mioo Design

Registered Belgian business number: 0700.444.126

VAT: BE 0700.444.126

Business address: Stegelstraat 18, 8810 Lichtervelde, Belgium

Website: https://www.diviharbor.com

Privacy requests: the privacy request facility in My Account or the contact/support form on our website.