Privacy Policy

Last updated: October 3, 2026

1.Who this policy applies to

• Customers: people and businesses who create a Push Agent account to send notifications from their websites. For customer information, Push Agent decides how it is used (we are the “controller”).
• Subscribers: visitors who click “Allow” to receive notifications from a website that uses Push Agent. Here the website owner decides what is sent and to whom, and we process subscriber information on their behalf (we are a “processor” or “service provider”). Website owners must explain their use of Push Agent in their own privacy policy. If you are a subscriber with a question about a particular website, please contact that website first; we will help them respond.
• Visitors to our own website, pushagent.net.

2.Information about our customers

• Account details: your name, email address and password (stored only as a secure hash). You may also add your city and country to your profile.
• Google sign-in: if you choose “Sign in with Google”, Google shares your name, email address, Google account ID and profile picture with us. We do not receive your Google password.
• Websites and content: the websites you add (name, address, logo), your opt-in prompt text, the notifications you write (titles, messages, links, images), schedules, targeting choices and campaign results.
• API keys: the name you give each key and when it was last used. We store only a fingerprint of the key itself, never the full key.
• Billing: when you buy a plan, 2Checkout (Verifone) sends us your name, email address, country, order and subscription references, the plan, amounts and payment status. 2Checkout processes your card or other payment details; we never receive them.
• Communications: messages you send us and our replies.
• Security and technical data: your IP address and browser information when you use the dashboard, used to keep you signed in, to prevent abuse (for example limiting repeated login attempts) and, on some forms, for Cloudflare Turnstile bot checks.

3.Information about notification subscribers

When a visitor allows notifications on a website that uses Push Agent, we collect:

• Push subscription: a unique address (endpoint) and encryption keys created by the visitor’s browser and its push service. These are needed to deliver notifications to that browser and do not by themselves tell us who the person is.
• IP address and browser information: the IP address, browser user agent and browser language at the time of subscribing. We use them to record the browser, operating system or device type, and an approximate city and country, which the website owner can use for statistics and targeting. To estimate the location we send the IP address to an IP-location service (ip-api.com).
• Activity: when the subscription was created, which notifications were sent to it, whether delivery succeeded, and which notifications were clicked.
• Customer code (optional): on shops that use WooCommerce order updates, a one-way code made from the customer’s email address and the shop’s private key, so order updates reach the right person. The email address itself is not sent to us and cannot be worked out from the code.

We do not collect subscribers’ names, email addresses or browsing history. A subscriber can unsubscribe at any time by blocking notifications for the website in their browser settings; we then stop sending to that browser and mark the subscription inactive when the browser reports it has ended.

4.WooCommerce order updates

If a shop uses our WordPress plugin to send order updates, the shop sends us, for each update: the notification title and message written by the shop (which can include the customer’s first name, last name, order number, order status and total, if the shop uses those placeholders), a link to the order, and the customer codes described above. We keep a log of these updates (message, order reference, number of devices and result) so the shop can see what was sent. We use this information only to deliver the update for the shop.

5.Visitors to pushagent.net

Our website is served through Cloudflare and our hosting provider, which process your IP address and browser information to deliver pages and protect the site from attacks. We do not use analytics, advertising or social-media tracking tools on pushagent.net or app.pushagent.net. If you contact us through the website, we use the details you give us to reply.

6.How we use information

We do not use personal information for advertising, we do not sell or “share” it for cross-context behavioural advertising, and we do not make decisions about people based solely on automated processing that have legal or similarly significant effects.

7.Service providers we use

We share information only with providers that help us run Push Agent, only as much as they need, and under agreements that require them to protect it:

We may also disclose information if the law requires it, to protect the rights, safety or property of our users, the public or Push Agent, or as part of a merger, acquisition or sale of our business, in which case this policy will continue to apply.

8.Cookies and browser storage

• Dashboard (app.pushagent.net): one essential session cookie that keeps you signed in. It is deleted when you close your browser or sign out. Cloudflare may set security cookies to detect bots, and Google sets its own cookies if you use “Sign in with Google”.
• pushagent.net: WordPress cookies are only set if you sign in or leave a comment. Cloudflare may set security cookies.
• Websites that use Push Agent: our script stores a few small values in the visitor’s browser storage (for example whether the browser is subscribed and when “Not now” was clicked, so we don’t ask again too soon). These are not used to track people across websites.

We do not use advertising or analytics cookies. You can delete cookies and site data in your browser settings at any time.

9.How long we keep information

• Accounts that are never activated are deleted automatically after 24 hours.
• Customer accounts: we keep account and website information for as long as the account exists. When you ask us to delete your account, we delete it, its websites, subscribers, notifications and statistics within 30 days. Copies in our backups are overwritten within a further 30 days.
• Subscriptions: kept while they are active. Subscriptions that a browser reports as ended are marked inactive and are deleted when the website or account is deleted.
• Order-update logs and campaign statistics: kept while the website remains in the customer’s account.
• Billing records: kept for as long as tax and accounting laws require, normally up to 7 years.
• Security records (such as rate-limit entries by IP address) are short-lived and deleted automatically.

10.How we protect information

All connections to Push Agent use HTTPS. Passwords are stored as secure hashes, API keys only as fingerprints, and notification content is encrypted end to end with the Web Push standard before it is handed to browser push services. Access to our systems is limited to people who need it to run the service. No system is perfectly secure, but we work to protect your information and will notify affected customers and authorities of a personal data breach where the law requires it.

11.International transfers

Push Agent is run from the United States and our servers are hosted there. Our providers may process information in other countries. If you are in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States; where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Customers who need a data processing agreement for their subscribers’ data can request one from us.

12.Your rights and choices

Everyone

• You can see and update most of your account information in the dashboard, and ask us to delete your account by emailing us from your account’s email address.
• Subscribers can unsubscribe at any time by blocking notifications for the website in their browser.

EU, UK and Swiss residents

You have the right to access, correct or delete your personal information, to restrict or object to its processing, to data portability, and to withdraw consent at any time where we rely on consent. You also have the right to complain to your local data protection authority.

California and other US state residents

Depending on where you live, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to not be discriminated against for using these rights. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. You may use an authorised agent to make a request on your behalf.

How to make a request

Email [email protected]. We may need to confirm your identity, for example by asking you to write from your account’s email address. We reply within one month (45 days for US state law requests) and will tell you if we need more time. If you are a subscriber of a website that uses Push Agent, we may pass your request to that website’s owner, who decides how it is handled.

13.Children

Push Agent is a business service for adults and is not directed at children. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

14.Changes to this policy

We may update this policy as Push Agent changes. The “Last updated” date at the top shows the latest version. If we make significant changes, we will tell customers by email or in the dashboard before they take effect.

15.Contact us