Skip to content
WP Bulk Replace

Privacy

This page explains what WP Bulk Replace collects, why, and what we do with it. It covers this website (wpbulkreplace.com), your customer account (account.wpbulkreplace.com) and the Help Center (help.wpbulkreplace.com). It is written to be read rather than to be survived.

Last updated: 18 October 2026.

The plugin itself

The free plugin does its work entirely on your own WordPress site. It does not send your files, your filenames, your content or your site’s data anywhere.

The free plugin does contact wpbulkreplace.com for one thing: to check whether a newer version is available. That request names the plugin and its version. It does not include your site’s address or any of its content, although, like any request on the internet, it reaches us from your server’s IP address. You can turn the check off by adding define( 'WPBR_DISABLE_UPDATE_CHECKS', true ); to your site’s wp-config.php.

WP Bulk Replace Pro contacts our servers for two things only: to check that your license is valid, and to look for plugin updates. Those requests carry your license key and the address of the site making them, so that we can count how many sites a license is being used on. They do not carry your content.

Analytics on our websites

We use Google Analytics 4, loaded through Google Tag Manager, to understand how people find and use our three websites: which pages are useful, where people get stuck, and whether changes we make help. Google provides these services. Google receives the information described below and handles it under Google’s Privacy Policy; Google explains how it uses information from websites like ours at How Google uses information from sites or apps that use our services.

What we measure. When analytics is on, we measure:

  • which pages you view, and the site you came from;
  • clicks on the Free download links, the Get Pro and pricing-plan buttons, and links to support and the Help Center;
  • when you start the product video;
  • when you sign in to your account, or sign in for the first time after buying.

Google Analytics also records the kind of information any website visit involves, such as your browser and device type, screen size, language, and an approximate location that Google works out from your IP address.

What we keep out of analytics. We do not send your name, email address, license key, site address, payment details or anything you type into a form. Before a page address is sent, we remove sign-in links and other one-time codes from it, and we drop everything after the ? except standard campaign tags such as utm_source. Visits from Stripe’s and Freemius’s checkout pages are not recorded as coming from them.

Checkout, purchase and license analytics. If analytics was on when you started a checkout, our servers may also send Google Analytics a small number of events that follow from it:

  • that a checkout started, with the plan and its price;
  • that a purchase was completed, with the plan, a transaction reference and, for purchases made through Stripe, the amount paid and the currency;
  • a refund against that purchase;
  • that a site was activated on or released from the license, with the plan and the kind of site it is (for example, production or staging).

These events are sent only within 24 hours of the checkout starting, and only if you have not turned analytics off in the meantime. We do not report renewals, or anything that happens later. They carry the same pseudonymous Google Analytics identifier as the visit: a random ID that tells one browser’s visits apart without naming you, but that can still relate those visits to each other. They never carry your email address, license key or site address. Our record of your purchase and license does not depend on any of this: buying, downloading, activating and signing in work the same whether analytics is on or off.

Cookies

We use these cookies:

  • Your analytics choice (wpbr_analytics_consent). This remembers whether you accepted or rejected analytics, across all three of our sites, for 12 months. We set it only when you make a choice.
  • Google Analytics (_ga and _ga_ followed by an identifier). These hold a pseudonymous ID that tells visits from the same browser apart. They are set only while analytics is on, and Google sets them to last up to two years unless you clear them. When you reject analytics, we delete them.
  • Keeping you signed in, on account.wpbulkreplace.com only. These are a session cookie, a security cookie that protects forms against forgery, and a short-lived cookie, lasting up to 24 hours, that remembers the browser you asked for a sign-in link from. They are needed for the account to work, and are not used for analytics.

If you pay through Stripe or Freemius, their checkout pages may set their own cookies under their own policies.

Your analytics choices

The first time you visit, we ask whether you accept analytics cookies. Accepting and rejecting are equally easy, and you can change your mind at any time from Cookie settings at the bottom of every page on all three sites.

  • Analytics is off until you choose Accept, wherever you are. If you ignore the question, it stays off.
  • Your choice applies to all three sites, so you are asked once, not once per site.
  • If your browser sends a Global Privacy Control signal, we treat it as a rejection on all three sites, and it takes precedence over an earlier Accept.

When you reject analytics, or turn it off later, no analytics cookies are set and the ones already there are deleted. Our servers also stop sending checkout and license events for that browser, including any not yet sent. Your browser must allow cookies for your choice itself to be remembered.

Even with analytics off, our pages still load Google Tag Manager from Google’s servers. Google therefore receives the technical information that any request to its servers carries, such as your IP address and browser details. Google Analytics may also receive a limited signal that a page was viewed, without cookies, so that Google can estimate overall visit numbers.

You can also clear cookies in your browser at any time, or use Google’s Google Analytics opt-out browser add-on.

Buying Pro

When you buy a license we store the email address you give us and a record of what you bought. US purchases are processed by Stripe. Purchases outside the US are processed by Freemius as our merchant of record. Your card details go to the payment provider and do not reach WP Bulk Replace. We keep the customer email address, the plan, the license and subscription records, and the dates the subscription runs between.

Stripe and Freemius handle your payment information under their own privacy policies: Stripe’s Privacy Policy and Freemius’s Privacy Policy. They tell us about payments and subscription changes, and what was bought. That is how your license is created and renewed.

We send you email about your license: the key itself, a link to sign in, and reminders before a renewal. These go through an email delivery provider, which handles the message on our behalf.

Signing in

There are no passwords. Signing in means clicking a short-lived link we email you. We store a one-way hash of each link rather than the link itself, so a copy of our database does not contain anything that opens an account. Sign-in links are removed from page addresses before anything is sent to Google Analytics.

Getting in touch

If you email us or open a support request, we keep what you sent so that we can answer it.

How long things are kept

  • Your analytics choice is kept in your browser for 12 months, and Google Analytics cookies for up to two years, unless you clear them or reject analytics.
  • Google keeps analytics data according to the data-retention settings in our Google Analytics account.
  • Our own servers keep a copy of each checkout, purchase and license event they send to Google Analytics, without your email address, license key or site address, for 30 days after it is sent. An event that could not be sent is kept for 90 days so that we can find out why. Both are then deleted.
  • Sign-in links stop working after a short time, and a link that has been used cannot be used again.
  • Account, purchase and license records are kept so that your license keeps working and your purchases can be accounted for.

What we do not do

We do not sell your information, and we do not share it for advertising. We do not use advertising cookies. Our pages tell Google’s tags that advertising storage, advertising use of data and ad personalisation are not allowed, and the events our servers send are marked as not for personalised ads.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. For anything about privacy, including these choices and anything on this page, write to [email protected] and a person will answer.

If we change how we handle information, we will update this page and the date at the top.