Who we are
CognitoLab is operated by Ivan Omelianenko, a private individual based in Ukraine ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at [email protected].
What this policy covers
This policy covers cognitolab.net, founder.cognitolab.net, the live plugin demos linked from them, and the WordPress plugins we publish (IntelliDesc, Heralda, ProofBlocks, Fettle and their Pro add-ons).
It does not cover third-party sites we link to, which have their own policies — including WordPress.org, GitHub, the Freemius checkout, OpenCart marketplaces such as opencartcode.com, and TavernMind (tavern-mind.com), which has its own terms and privacy policy.
When you visit our websites
Usage statistics
We run our own simple, first-party statistics — no Google Analytics, advertising networks, or third-party trackers. For each page view or tracked click we record:
- the page path and which of our sites it was on;
- for clicks, the button label and the link it points to (for example, a download or demo link);
- the referring page, if your browser sends one;
- a visitor identifier: a one-way SHA-256 hash of your IP address, browser user agent, and the current date. It changes every day, cannot be reversed to your IP address, and your IP address itself is not stored with these statistics.
We use this only to understand, in aggregate, which pages and products people are interested in.
Cookies
cognitolab.net sets two strictly necessary cookies — a session cookie and an XSRF-TOKEN cookie — which protect forms against cross-site request forgery and keep the site's admin area working. They are not used for tracking or advertising. founder.cognitolab.net sets no cookies.
Hosting and network
Our sites are served through Cloudflare, which processes your IP address and request data to deliver pages and protect them from abuse. Our web server may also keep standard technical logs (such as IP address, time, and requested URL) for security and troubleshooting; these are kept only briefly.
When you contact us
If you use the contact form on founder.cognitolab.net, we receive your name, email address, and message. The form is protected by Cloudflare Turnstile (a bot check) and delivers your message to us by email (via Cloudflare Email Routing) and as a Telegram notification. To prevent spam, your IP address is kept in a daily rate-limit counter that expires automatically after about 25 hours. If you email us directly, we receive whatever you include in the email.
We use this information only to reply to you, and keep the conversation for as long as it is useful for that purpose.
Live demos
The live demos run WordPress Playground entirely in your browser; nothing you do inside a demo site is sent to us, apart from the fact that a demo was launched (recorded in our usage statistics above).
In the IntelliDesc demo, when you click to generate content, the product details entered in the demo are sent through our Cloudflare Worker to Google Gemini to produce the result. Results are cached for up to 24 hours so identical requests aren't regenerated, and your IP address is kept in a daily rate-limit counter that expires automatically. Please don't enter personal data into the demo.
Purchases and licenses
Pro versions of our WordPress plugins are sold through Freemius, Inc., which acts as the reseller and processes payments, taxes, and invoices. Your payment details go directly to Freemius and its payment processors; we never see your full card details. Freemius shares with us the information needed to provide your license — such as your name, email address, license and subscription details, and the sites where the license is activated — which we use to provide licensing, updates, and support. See the Freemius Privacy Policy.
Pro plugins contact Freemius's servers to activate your license and check for updates. OpenCart extensions bought on a third-party marketplace are governed by that marketplace's own privacy policy.
Our WordPress plugins
None of our plugins send your site's content or your visitors' data to us.
- Heralda and ProofBlocks make no external connections. Heralda stores a visitor's "dismissed" state in that visitor's own browser.
- Fettle and IntelliDesc can use an AI provider (such as Google Gemini, Anthropic Claude, OpenAI, xAI Grok, or OpenRouter) with an API key you supply. Data is sent only to the provider you configure, only when you click the relevant button, and only as described in each plugin's readme on WordPress.org. That provider's own terms and privacy policy apply.
- Pro add-ons additionally contact Freemius for licensing and updates, as described above.
Legal bases
Where the EU/UK GDPR or similar laws apply, we process personal data on these bases: our legitimate interests in running, securing, and improving our sites (statistics, security logs, spam protection); taking steps at your request or performing a contract (replying to you, providing licenses, updates, and support); and compliance with legal obligations.
Who we share data with
We don't sell or rent personal data. We share it only with service providers that help us run our sites and products — Cloudflare (hosting network, bot protection, email routing), Telegram (contact-form notifications), Google (the IntelliDesc demo), and Freemius (sales and licensing) — or when required by law. Some of these providers are located outside Ukraine and the EU, including in the United States; they apply their own safeguards to international transfers.
How long we keep data
- Usage statistics: kept in pseudonymous form for as long as they are useful for aggregate statistics, and deleted periodically.
- Rate-limit counters: expire automatically within about 25 hours.
- Contact messages: as long as needed to handle your request.
- License and customer records: for as long as your license is active, and afterwards as long as required for accounting, tax, or legal purposes.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or restrict the use of your personal data, to object to processing based on legitimate interests, and to receive a copy of your data. To exercise any of these rights, email [email protected]. You also have the right to complain to your local data protection authority.
Note that our usage statistics are designed so that we cannot link them back to a specific person, so we generally cannot find or delete them for an individual.
Children
Our sites and products are intended for businesses and adults. We don't knowingly collect personal data from children.
Changes to this policy
We may update this policy when our sites or products change. The "Last updated" date at the top shows when it was last revised.