Here, we provide clear and complete information about your personal data that Toolset plugins and site gather. You can also view and control its handling.

There is a new regulation coming into in the European Union on the 25th May 2018, called General Data Protection Regulation. It provides strict guidelines on how ones personal data is gathered and handled. This also affects companies and individuals that reside outside of the EU but collect data from EU citizens.

We completely agree that you should be able to see which information is gathered, why it is gathered and how you can view it or opt-out altogether. This is why we took this opportunity to provide you with a comprehensive privacy policy and additional documentation pages for all related topics.

Privacy Policy

Table of contents

Who we are

We are the OnTheGoSystems Ltd. company, makers of the Toolset plugins and owners of the website.

You can find more information about us, including our full address, on our company website.

What personal data we collect and why we collect it


When you leave comments on the site we collect the data shown in the comments form, and also your IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here. After approval of your comment, your profile picture is visible to the public in the context of your comment.


If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Contact forms

Information submitted through the contact forms on our site are sent to our company email, hosted by Gmail. Google adheres to the EU “Privacy Shield” policy and you can find more information about this here.

While we keep these submissions for customer service purposes they are never used for marketing purposes or shared with third parties.


Our site uses the following cookies:

  • Google Analytics cookies – these are set for monitoring and tracking visitors behavior on the site.
  • WordPress logged-in cookies – these are used by WordPress to authenticate logged-in visitors, password authentication, and user verification.
  • WPML cookies – these are used by our WPML plugin to identify the preferred user’s language as our site is multilingual. You can find detailed information about this on WPML documentation page about browser cookies stored by WPML.
  • WooCommerce cookies – these are used by the WooCommerce plugin to track visitors and their purchased items in the cart.
  • W3 Total Cache cookies – these are used by W3 Total Cache plugin to monitor referrer and user identification for caching purposes.
  • WP Polls cookies – these are used by WP Polls plugin to provide proper polls functionality based on user identification.
  • ICL-MPP Affiliate cookies – this is used by our system to monitor and identify affiliates for the purpose of performance monitoring and payments.
  • bbPress cookies – this used by the bbPress plugin to provide proper forum functionality based on user status and profile.
  • Toolset plugin cookies – this is used by our Toolset plugin (Toolset Types, Module Manager, and Toolset Forms) to properly provide functionality based on user status.
  • WP Postratings cookies – this is used by the WP Post rating plugin to provide proper rating functionality based on user status.
  • Limit Login Attempts cookies – this is used by the Limit login attempts plugin to provide brute force security in logins by monitoring user cookies.
  • CMS Tree Page View cookies – this is used by the CMS Tree Page View to provide correct functionality based on user behavior.

Embedded content from other websites

Articles on this site may include embedded content, like YouTube videos, for example. Embedded content from other websites behaves in the exact same way as if you visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged-in to that website.


In addition to Google Analytics, we are using the following statistics on our site for performance and monitoring:

  • Affiliate performance statistics – statistics regarding our affiliates
  • Installer statistics – statistics regarding the number of plugin installations of our products in clients, also includes the site info like PHP version, WordPress version used, etc.
  • Support statistics – statistics regarding our supporters and clients about how many tickets created, resolved, pending, etc.
  • WooCommerce statistics – statistics regarding our sales, conversion rates, refunds, etc.
  • Reference sites statistics – statistics regarding our clients reference sites installation.
  • Compatibility plugin statistics – statistics regarding our clients compatible/incompatible themes/plugins with our products.

Data shared with our support

Sometimes, to help our support debug a Toolset-related issue on your site, we might ask you to share a copy of your site with us. Since this is your site, you are the one responsible for its data and we strongly encourage you to remove any personal information from the database before sharing it with us.

That being said, here are some important points about what happens with the site duplicates and data that is shared with our support:

  • When a debug or setting check is needed, we ask for access to the site or even a full copy of the site.
  • We use that access/duplicates strictly for debugging.
  • We do not share that data with anyone outside of the company.
  • We might need to share the duplicates with OnTheGoSystems supporters and developers when the case requires it.
  • We destroy this information after we finish debugging and resolve your issue.
  • Our forum is public but any outside URL is automatically masked and any private information is shared only in private comment seen only by the supporters and the client that reported the issue.
  • Again, we strongly encourage you to remove any personal/sensitive information that the site might hold before sharing access/duplication if you are concerned about it.
  • We cannot be held responsible for any loss of private information from databases if that should occur. In other words, you should have a fully working backup of whatever site you share with us.

Data collected by the Toolset plugins you use

The Toolset plugins are fully compliant with GDPR.

If you give them explicit consent, the only data they can collect is which theme and plugins your site is using. This information is used only for providing you with faster and better support. Toolset plugins will prompt you and require explicit action, asking you if you want to share with us this information. If you decline, it will not collect any data whatsoever.

These cookies only communicate with your site and never with The only communication mechanisms from your site to our are:

1. When you register the plugins on for automatic renewals.
2. If you choose to send us details about the theme and plugins that you use (we use this information to send you alerts about compatibility issues, and you choose if you want to send it or not)

Other than this, any cookies are only intended to keep the “state” of pages between the browser and your server. Whenever possible, we keep information in the DOM and not in cookies, but that’s not always possible.

Data collected through the Toolset Maps plugin

The Toolset Maps plugin allows you to use Google Maps or Azure Maps services on your website. Due to the nature of these services, you should be aware of the following:

  • Google and Microsoft collect information from your site’s users through any Google or Azure map you use.
  • The Toolset Maps plugin does not control the nature of this information, its storage location, usage, eventual sharing with third parties and so on. All of that depends on the map service you use, i.e. Google or Azure.
  • Because of this, Toolset Maps does natively not offer such consent method. We concluded that this falls under the responsibility of a site’s webmaster.
  • As a site owner, you can add custom consent controls and block Toolset Maps from loading the map until allowed by the user. There are multiple ways for you to achieve this. For example, you could use the premium version of the GDPR Cookie Consent Plugin and a small custom filter. Alternatively, you could use a custom JavaScript code and Toolset only. You can see both examples here.

Who we share your data with

We don’t share your data with third-parties in a way as to reveal any of your personal information like email, name, etc. However, some data is transferred and/or stored with third-party services we use, like cloud-based services and payment processors. This is done as a way to provide you with a better overall service and user experience.

Here are the services we use to make our own service better for you:

  • Active Trail – we store our client contact details for newsletters, announcements, and usability testing invite purposes. They can opt-out of these at any time.
  • PayPal – we use Paypal as one of our payment processor. During checkout, a client will provide login information and credit card info. This information is processed directly within this gateway payment and we do not save it on our sites.
  • Stripe – we use Stripe as one of our payment processor. During checkout, a client will provide credit card info. These are all stored in the Stripe site.
  • Amazon SES – we use this services to manage mailing campaigns to our clients. What is shared are client contact details (name and client email).

Who can see my personal information

If you are not a registered client in our site, there is no personal information we have or can see about you.

If you are a client with a Toolset account, your personal information can be accessed by:

  • Our System administrators.
  • Our supporters when they need to (in order to provide support) get the information about the client accounts and access.

How long we retain your data

When you submit a support ticket or a comment, its metadata is retained until (if) you tell us to remove it. We use this data so that we can recognize you and approve your comments automatically instead of holding them for moderation.

If you register on our website, we also store the personal information you provide in your user profile. You can see, edit, or delete your personal information at any time (except changing your username). Website administrators can also see and edit that information.

How we protect your data and what data breach procedures we have in place

We protect customer data with the following site features:

  • We are entirely using SSL/HTTPS throughout all our sites. This encrypts our user communications with the servers so personal identifiable information is never captured by third parties without authorization.
  • Databases are sanitized (actual user personal details are removed) before deploying to development or testing environment.

In case of a data breach, System administrators will immediately go through affected users and will attempt to reset passwords if needed after informing the user.

What rights you have over your data

If you have an account on this site or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us.

You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes. In short, we cannot erase data that is vital to you being currently our customer (i.e. basic account information like an email address).

For these requests, please use this form.

Additional information

You can find additional information about related topics on the following page: