Privacy Policy

Last updated: 26 October 2026

1. Who we are

This site (donkeycms.com) is operated by DonkeyByte SRL, Str. Ciresului, Nr. 33 Dobroesti, Ilfov, Romania (VAT RO49649125). This policy explains what personal data we collect, why, and who we share it with. Contact: hello@donkeycms.com.

2. What we collect

• Your account: your email address, and whether you agreed to receive our newsletter. If you sign in with Google, we also receive from Google your name, your profile photo and Google’s identifier for your account, and keep the identifier so the same Google account always opens the same DonkeyCMS account. We use this to sign you in (by emailed link or with Google), to send your license keys, and to send release and security notices for the DonkeyCMS license you hold.
• Your profile: the full name, display name, short bio and photo you add on your account page. If you sign in with Google and have not added a full name or photo yourself, we fill in the name Google sends and keep a copy of your Google profile photo. You can change or remove any of them at any time. Your full name is private. If we open an ideas board for license holders, other members will see your photo, display name and bio, never your email address or full name.
• Your purchases: which plan you bought, your license key and its dates. Payment and billing details (card, billing address, VAT number) are collected by Creem at checkout; we receive only what we need to issue and manage your license.
• Your license activity: installations of DonkeyCMS that use a license key contact our license server about once a day, sending the key and the site's domain. We use this to check the license and its site limit, to offer updates, and to detect misuse of license keys.
• Your purchases and downloads: when you buy a plan, confirm a Free sign-up, download DonkeyCMS or your site installs an update, we record the date, your name and email address (as given at checkout), the license, the version and the IP address used. We keep this with your license records to detect and investigate misuse of license keys, and erase the IP addresses after 24 months.
• Messages you send us: your name, company (if you give it), email address and message, when you use the contact form or email us. We use them only to reply. The contact form stores nothing on our site: your message arrives as an email in our inbox.
• Technical data: IP address and browser type, used to protect our forms against abuse and kept in our server logs.
• Visits to this site: we count the visits to our public pages ourselves, without cookies and without any outside analytics service. For each page view we keep the page, the name of the website you came from (for example "google.com", never the full address), the time, your country, the kind of device and browser you use (two words such as "phone" and "Safari", not the full details your browser sends), and a visitor code. Your IP address is used for a moment to work out the country and the visitor code and is not stored with them. To tell people from automated programs, a page also sends us one short signal after it has loaded, which says only that this page view was opened in a real browser. The country is looked up on our own server, in a list from IP Geolocation by DB-IP, so your address is not sent to anyone for this. The visitor code is a scrambled value made from your IP address, your browser type and a secret that we replace every day: it lets us count one person reading three pages as one visitor, it cannot be turned back into your IP address, and it is different every day, so we cannot follow you from one day to the next or tell who you are. These counts are not linked to your account, your purchases or your email address.

3. What we don't do

We don't track you across other websites, we don't show ads, and we don't sell your data.

4. Why we process this data

To deliver what you bought and provide support (performance of our contract with you), to meet tax and accounting duties (legal obligation), to protect the site against abuse and to understand, in numbers only, how many people visit the site and where they come from (legitimate interest), and to send our newsletter (tips, offers and general news) only if you agreed to it (consent, which you can withdraw at any time from your account page or from the link in any such email).

Release and security notices are different: they tell everyone who holds a DonkeyCMS license, including the Free plan, that a new version is available and how to update. They are part of the service you receive with your license (performance of our contract), so they are sent whatever your newsletter setting, and only about versions of the software you use.

5. Who we share it with

• Creem (Armitage Labs OÜ, Estonia) — our reseller and merchant of record. Creem handles payment, VAT and invoicing, under its own privacy policy.
• NewsMAN (Romania) — sends our emails (sign-in links, license keys, purchase, refund and cancellation notices, release and security notices, and the newsletter if you opted in).
• Cloudflare — Turnstile, the bot check on our sign-in and contact forms.
• Google (Ireland / USA) — only if you choose “Continue with Google”. You sign in on Google’s own page; Google tells us your email address, your name, your profile photo and its identifier for your account. We do not receive your Google password or anything else from your Google account.
• Hostico (Romania) — hosts this site and our license server.

6. Cookies

We use one cookie: a session cookie that keeps you signed in to your account. It is strictly necessary, is set only on the sign-in and account pages, and is deleted when you close your browser. We use no analytics or advertising cookies. Our own visit counting (section 2) uses no cookie and stores nothing in your browser. The site's fonts are served from our own server, so loading a page does not contact Google or any other third party.

If you close an announcement bar at the top of a page, your browser remembers that for 24 hours so the bar stays closed. That note says only which bar was closed and when. It stays in your browser, is never sent to us and is not used to recognize you. The same goes for the plan you pick in the filter above the docs menu: your browser remembers that one word so the menu stays filtered.

The sign-in page remembers in your browser which sign-in option you used last (Google or email), only to show a “Last used” label. It is not a cookie, it is never sent to us, and you can clear it with your browser’s site data.

7. How long we keep it

Account and license records, including your profile and the Google identifier if you use Google sign-in, are kept while your account exists, and billing records as long as Romanian tax law requires. Support emails are kept only as long as needed to resolve your request. Visit counts (section 2) are deleted after 13 months.

8. Your rights

Under the GDPR you can ask to access, correct or delete your personal data, object to its use, or receive a copy of it, subject to records we must keep by law. Write to hello@donkeycms.com. You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro).

9. Google sign-in and Google Drive backups

If you choose “Continue with Google”, we receive only your email address, your name, your profile photo and Google’s identifier for your account (the openid, email and profile permissions), to sign you in and to start your profile with your name and photo.

You can stop using Google sign-in at any time: remove “DonkeyCMS” at myaccount.google.com/permissions, then sign in with an email link instead. Your DonkeyCMS account and licenses stay as they are. To have the stored Google identifier deleted, write to hello@donkeycms.com.

DonkeyCMS can save a site's backups to the site owner's own Google Drive. This is optional and available on the Business plan.

• What it can access: only the files DonkeyCMS itself creates in your Drive (Google's drive.file permission). It cannot see anything else in your Drive or your Google account, apart from your email address, which is shown so you know which account is connected.
• Where the access is kept: in your own DonkeyCMS installation, on your own hosting. donkeycms.com does not store it. When your site renews its access to Google, donkeycms.com passes the request through with our app's credentials and keeps no copy.
• What it is used for: uploading, listing, downloading and deleting your backups. Nothing else. It is never used for advertising, never sold, and never read by a person.
• Stopping it: click Disconnect in DonkeyCMS, or remove "DonkeyCMS" at myaccount.google.com/permissions. Backups already in your Drive stay there until you delete them.

DonkeyCMS's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated date.