Privacy Policy
Last updated: October 2026
1. Who We Are
OJStack (ojstack.dev) is operated by a sole proprietorship registered in Poland. We sell premium plugins for Open Journal Systems (OJS).
For any privacy-related questions, contact us at ojstack.dev/contact/.
2. What Data We Collect
2.1 Contact and Purchase Forms
When you submit a form on our website (purchase inquiry or custom development request), we collect:
- Name
- Email address
- Institution / journal name (if provided)
- Message content
- Plugin name (for purchase inquiries)
Form submissions are processed by Formspree and forwarded to our email. We use this data solely to respond to your inquiry and process your order. To block automated spam, every form is protected by Cloudflare Turnstile, which checks that the submission comes from a real browser. Turnstile is a technical necessity for sending the form and is not used for analytics or advertising.
2.2 Website Analytics
We use Google Analytics to understand how visitors use our website. Google Analytics collects:
- Pages visited and time spent
- Referral source (how you found us)
- Approximate geographic location (country/city level)
- Device type, browser, and operating system
This data is aggregated and does not personally identify you. Google Analytics uses cookies — see Section 4 below. For details on how Google processes this data, see Google's Privacy Policy.
Separately, we count visits with Cloudflare Web Analytics, which uses no cookies or other browser storage and does not recognize returning visitors. It records the page you open, the page you came from, your country, device and browser type, and page load time. Cloudflare does not store your IP address, and we see only aggregate counts, with nothing that identifies an individual. The legal basis is our legitimate interest in understanding traffic to the site (Art. 6(1)(f) GDPR). You can object at any time (see Section 7) or block the script in your browser; the website works the same either way.
2.3 Plugin Telemetry
Our plugins may send a one-time, non-blocking request to our server upon activation. This request contains only:
- The URL of the journal where the plugin is installed
- Plugin name and version
- OJS version number
No personal data, user credentials, submission content, or reviewer information is collected. If the request fails (e.g., due to firewall restrictions), the plugin continues to function normally.
2.4 Invoicing
When processing a purchase, we may collect billing details (name, institution, address, tax ID) for invoicing purposes. This data is stored only as long as required by Polish tax law.
3. How We Use Your Data
- To respond to your inquiries and process orders
- To issue invoices and provide purchase receipts
- To provide plugin support during the support period
- To improve our website and products (analytics)
- To verify authorized plugin installations (telemetry)
We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Cookies
Our website uses cookies for:
- Google Analytics — performance and usage tracking (
_ga,_ga_*cookies)
You can change or withdraw your consent at any time with the Cookie settings link at the bottom of every page; choosing "Reject" deletes the Google Analytics cookies. You can also disable cookies in your browser settings. The website will continue to function without cookies.
5. Third-Party Services
We use the following third-party services that may process your data:
- Formspree — form submission processing (Privacy Policy)
- Cloudflare Turnstile — bot protection on forms (Privacy Policy)
- Google Analytics — website analytics (Privacy Policy)
- Cloudflare Web Analytics: cookie-free visit statistics (About, Privacy Policy)
- Google Fonts — font delivery (Privacy FAQ)
- Cloudflare — website hosting and CDN (Privacy Policy)
6. Data Retention
- Form submissions: retained as long as needed to fulfill your request, then deleted
- Invoicing data: retained as required by Polish tax law (currently 5 years)
- Analytics data: automatically expired per Google Analytics retention settings
- Telemetry data: retained for the duration of the license
7. Your Rights (GDPR)
If you are in the EU/EEA, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Restriction — limit how we process your data
- Portability — receive your data in a structured format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, contact us at ojstack.dev/contact/. We will respond within 30 days.
8. Data Security
We take reasonable measures to protect your data, including HTTPS encryption on our website, secure email communication, and limiting access to personal data. However, no method of transmission over the internet is 100% secure.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated on this page. We encourage you to review this page periodically.
10. Contact
For privacy-related questions or to exercise your data rights:
- Contact form: ojstack.dev/contact/