PressFlow runs on your WordPress/WooCommerce installation. You choose your hosting and manage your customer relationships. This guide helps you understand the plugin's data flows; it is not a replacement for a privacy notice specific to your shop.
What remains on your installation
Print specifications, calculated job snapshots, WooCommerce orders, quotes, customer messages, saved jobs, production records, uploaded artwork and proofs are stored or processed by your installation. Different records serve different purposes and have separate retention needs.
Uploaded artwork is held in private database records rather than ordinary public Media Library attachments. Permission checks control plugin download routes. This does not encrypt every database or backup, make all staff access appropriate or secure unrelated plugins automatically. Limit admin access, use HTTPS, maintain the site and protect backups.
Customer-supplied transfer links are stored with the job. The destination service can process the file independently; consider that service when describing recipients and international transfers. Do not put private transfer URLs in publicly accessible pages.
The licence service
Entering your key sends the key, site address, installation ID and plugin version to PressFlow over HTTPS. Later scheduled checks use the activation token and licence ID instead of resending the full key. The licence client does not send your customer list, print orders, artwork or specifications to PressFlow.
The vendor processes purchaser/activation records as described in its privacy policy. Other WordPress, WooCommerce, hosting and extension communications must be assessed separately.
Retention: what the settings mean
WooCommerce → Print settings has an Artwork retention (days) setting. The default is 90 days from upload, including artwork from abandoned baskets. Daily WordPress cron cleanup removes expired file bytes. Run and monitor cron; the setting alone cannot execute a scheduled deletion on a server where cron is broken.
This artwork period does not mean all order specifications, quotes, account details, production history or financial records are deleted at the same time. Set WooCommerce's account/order retention to match your lawful business requirements and arrange a separate procedure for PressFlow records that those settings do not cover. Do not promise automatic deletion or export of every plugin record without checking its coverage.
Incomplete resumable-upload sessions expire after 24 hours and have their own cleanup. Saved-library artwork and proofs can also be affected by the artwork-retention policy. Inform customers how long files will remain available; a reorder may need new artwork after expiry.
Deleting live data does not erase copies already held by backups, exported job tickets, staff email, local downloads or transfer providers. Account for those copies in your retention and access process.
Browser storage and private links
The configurator can save unfinished choices in localStorage for seven days. Entries can include typed print-option values, so do not describe every entry as anonymous. They do not save uploaded artwork or account contact fields. Expired entries are removed when read again; a browser that is never revisited can retain the stored bytes until its data is cleared.
A theme's VAT preference can be stored as pressflow-vat. Guest order-job access can use a private cookie with a grant normally valid for up to 30 days. Private quote and job links are credentials, not public tracking pages. Rotate or revoke access when necessary and avoid including credentials in public screenshots or analytics.
Identify these technologies in your shop's cookie notice and assess the applicable consent or exception requirements. Automatic saved-choice code is not a complete consent-management solution. A clear button alone does not necessarily provide a lasting opt-out from future writes.
Requests from customers
Establish a way to locate a customer's WooCommerce orders and accounts together with associated PressFlow quotes, saved jobs, artwork, proofs and job records. Verify their identity proportionately, protect other people's data and assess legal retention duties before deletion. A closed customer account does not necessarily remove all plugin data.
Do not assume WordPress's standard Export/Erase Personal Data tools cover every PressFlow field. Check the implementation and use a documented manual process for anything outside that coverage. Redact or remove unnecessary copies in support messages and job exports as well.
If you ask PressFlow or a developer to access real customer data for support, agree access and processor terms before sharing it. Use temporary accounts, least necessary access and a redacted staging copy where practical. Revoke access after the task.
A practical shop-owner checklist
- Identify the legal operator of your shop and publish the correct contact details.
- Explain the data collected for quotes, orders, artwork, proofs and production, with purposes and lawful bases.
- Identify hosting, email, payment, backup and transfer providers and assess international processing.
- Set realistic artwork and order retention, test cron and include exported/email/backup copies.
- Limit staff access and keep private links and artwork out of public demonstrations.
- Audit cookies/localStorage, configure consent or valid exceptions and provide the required choices.
- Maintain a data-rights and complaints process that covers plugin records, not just account deletion.
- Have appropriate processor agreements for hosted/build/support services involving customer data.
Operating PressFlow does not itself certify a shop as GDPR-compliant. The privacy and legal requirements depend on your business, its customers and the services you connect.