Privacy Policy
Last updated: 2026-10-11
This Privacy Policy explains how Cmsmart (“Cmsmart”, “we”, “us”), a division of Netbase JSC, collects, uses, shares and protects your personal data when you use cmsmart.net, our dashboard, plugins and related services (the “Services”). By using the Services you agree to this policy.
1. Who we are
Netbase JSC — 91 Nguyen Chi Thanh Street, Dong Da District, Hanoi, Vietnam. Contact: project@cmsmart.net.
2. Data we collect
- Account data — name, username, email address and password (stored hashed) when you register or place an order.
- Social sign-in data — if you sign in with Facebook or Google, we receive your name, email address and public profile (per the
public_profileandemailpermissions you approve). We do not receive your social password and we do not post to your social accounts. - Order & license data — products purchased, license keys, activated domains, invoices and support tickets.
- Usage & device data — IP address, browser, pages viewed and cookies, used to run and secure the site and to measure traffic.
3. How we use your data
- To create and manage your account and authenticate sign-in (including social login).
- To deliver products, license keys, downloads and customer support.
- To send transactional email (order confirmations, password resets, license notices) and, where you opt in, product news.
- To secure the Services, prevent fraud and abuse, and comply with legal obligations.
Licence and update checks
When the Cmsmart Product Designer plugin or a Cmsmart Store is activated with a licence key, the plugin contacts the Cmsmart licence server to confirm that the key is valid, to deliver updates and to enable licensed services. Each check sends: (1) your licence key; (2) your site's domain name (and, for subdirectory multisite, its path); (3) the names of the active theme and child theme (stylesheet and template names); (4) the plugin version and, if a Cmsmart Store is installed, the store identifier and store version; (5) whether a Cmsmart demo-content import marker is present; and (6) the plugin and WordPress/WooCommerce versions needed for compatibility. We do not receive your customers' personal data, orders, product content or admin credentials through these checks.
We use this data to provide the updates, support and cloud services you are entitled to; to apply the right plan to your licence; to prevent one key from being used on more domains than the plan allows; and to detect abuse or errors (legitimate interest and performance of the contract). Licence-check records and key/domain bindings are kept while the licence is active and for a limited period afterwards, for billing, support and dispute evidence, and are then deleted or aggregated. This data is processed by Cmsmart (Netbase JSC) on its own servers and is not sold or shared for advertising.
Backend demo access
When you request a 24-hour view-only backend demo of a Cmsmart demo store, we record: your account ID and verified email address, the demo store, the time of the request and the expiry time of the link, a one-way hashed form of your IP address, and when the link was first used and how many times. The access link itself is stored only in hashed form.
On the demo store, an audit log records the time, the link reference and the admin screens opened. This audit log is kept for 30 days and then deleted.
Each request also creates a ticket for your account in WorkSuite, our project and ticket system, with the store, your email address, the request time and the expiry time (never the access link), so that our team can follow up on your request. That ticket is kept with your other tickets.
We use this data to give you the access you asked for, to keep it view-only and time-limited, to prevent abuse of the demo stores, and to follow up on your interest in our products (performance of your request and legitimate interest).
AI token wallet
Your Cmsmart AI wallet keeps a ledger of every token transaction: the date, the type (for example plan allowance granted, renewed, expired, upgraded or removed after a refund, gift, top-up, or tokens used), the number of tokens, the balance after the transaction, the related order or licence reference, and the AI feature used. We use the ledger to show your balance, to apply plan allowances, to bill token use, and to handle disputes and prevent abuse (performance of the contract and legitimate interest). The ledger is kept with your account and order records (section 6).
4. Sharing & processors
We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract, including: Amazon Web Services (hosting, email delivery), Cloudflare (security/CDN), our payment provider (PayPal) for purchases, and Google reCAPTCHA for spam protection. Facebook and Google act as independent controllers of the data you provide to them during social sign-in.
5. Cookies
We use cookies and similar technologies for authentication, preferences, security and analytics. You can control cookies in your browser; disabling essential cookies may break sign-in and checkout.
6. Data retention
We keep account, order and license data for as long as your account is active and as required for legal, tax and accounting purposes. You may request deletion at any time (see next section).
7. Your rights & data deletion
Subject to applicable law (including the GDPR), you may request access to, correction of, a copy of, or deletion of your personal data, and you may object to or restrict certain processing. To delete your data — including data obtained through Facebook Login — follow our User Data Deletion instructions or email project@cmsmart.net. We respond within 30 days.
8. Security
We use TLS in transit, hashed passwords, access controls and reputable infrastructure providers to protect your data. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you of material breaches where required.
9. International transfers
Our providers may process data outside your country (e.g. in the United States). Where required, we rely on appropriate safeguards for such transfers.
10. Children
The Services are intended for businesses and adults. We do not knowingly collect data from children under 16.
11. Changes
We may update this policy; we will post the new version here and update the date above.
12. Contact
Questions about this policy or your data: project@cmsmart.net.
