Privacy Policy

Last updated: 17 July 2026

1. Controller and scope

GLORIAPR LTD operates B5Tools.ly and is the controller for B5Tools operator accounts, platform analytics, billing information we receive, security records, and support communications. We are registered in England and Wales under company number 16313878, at 182-184 High Street North, London E6 2JA, United Kingdom. Our contact address is hello@b5tools.ly and our UK ICO registration number is ZB946447.

When a WordPress operator or API customer sends assessment answers to B5Tools solely to calculate and return a result, that operator is normally the controller and we act as its processor. The operator controls data stored in its WordPress database, browser storage, email system, CRM, webhooks, and other integrations.

2. Personal data we process

Account and authentication data: name, email address, profile image, authentication provider identifiers, verification state, sessions, and account membership.
Connected Site and credential data: site host and domain, aliases, environment, connection history, plugin version, credential name, key prefix, allowed domains, scopes, status, and last-use information. Raw API keys are not stored after issue.
Service, usage, and security data: request time, environment, quota counts, page path, assessment mode, result-type identifier, funnel event, pseudonymous visitor hash, API error, IP-derived security hash, and diagnostic or administrative audit records. Metadata event endpoints are not intended to receive raw answers, contact details, or full trait vectors.
Scoring request data: assessment answers and request data needed to return a result. The scoring API does not write raw answers to the B5Tools application database by default.
Billing data: plan, subscription status, billing interval, amount and currency, renewal or cancellation dates, and Stripe customer or subscription references. Stripe or the merchant of record collects payment-card and billing details; B5Tools does not receive full card numbers.
Support data: messages, troubleshooting information, and records of support actions or account overrides.
Web analytics: page or route, referrer, event time, country or region, browser, operating system, and device category. Vercel Web Analytics reports aggregated data and does not provide B5Tools with an identifiable visitor profile or IP address.

3. Where data comes from

We receive data directly from operators when they create an account, connect a site, use the dashboard, contact support, or call the API. A connected WordPress site sends scoring requests and service metadata on its operator's instructions. Authentication, hosting, analytics, email, and payment providers also return the account, transaction, delivery, or technical information needed to provide their part of the Service.

4. Why we use data and our legal bases

Contract: create and authenticate accounts, connect WordPress sites, score requested assessments, provide plan features, enforce quotas, manage subscriptions, and respond to product support requests.
Legitimate interests: secure credentials, prevent fraud and abuse, troubleshoot failures, maintain audit records, measure aggregated product use, and improve reliability. We balance these interests against the rights of affected people and limit the data used for them.
Legal obligation: keep records and respond where tax, accounting, consumer, data protection, law-enforcement, or other applicable law requires it.
Consent: where an optional activity requires consent under applicable law. Consent can be withdrawn without affecting processing that was lawful before withdrawal.

Account identity and required service metadata are necessary to provide an account, connected site, API access, or paid subscription. If you do not provide them, we may be unable to provide the relevant part of the Service.

5. WordPress data and operator responsibilities

Depending on the operator's settings, the plugin may store settings, credential metadata, visitor progress, saved result summaries, metadata-only analytics, lead records, result-email status, PDF settings, WooCommerce mappings, and integration logs in WordPress or the visitor's browser. B5Tools does not control that local data. Operators must provide their own notices, choose a lawful basis, collect consent where required, and handle requests for data they control.

6. Web analytics

If you allow anonymous analytics through the privacy choices control, we use Vercel Web Analytics to measure browser page views. B5Tools removes query strings and fragments before analytics URLs are sent. You can withdraw that choice at any time through the floating privacy control.

Vercel states that Web Analytics uses an incoming-request hash instead of third-party cookies, discards the visitor-session identifier after 24 hours, and provides aggregated reporting. Separately, the platform records a small set of aggregate server-side product events, such as account creation, WordPress connection, and checkout start. These operational events do not access browser storage and exclude email addresses, API keys, Stripe identifiers, connected-site domains, and assessment answers. See the Cookie Policy for browser storage information.

7. Recipients and subprocessors

We share data only as needed with service providers that host the platform and database, authenticate users, deliver service email, provide analytics, or manage payments. We may also disclose data to professional advisers, regulators, courts, law enforcement, or a purchaser of the business where law permits or requires it. Current providers and their purposes are listed on the Subprocessors page.

8. International transfers

Some providers process data outside the United Kingdom or European Economic Area. Where required, we use an adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard. Contact us for information about the safeguard relevant to a particular provider.

9. Retention

We keep account and service records while an account is active. After closure, we retain only what is reasonably needed for legal obligations, tax and accounting, transaction disputes, security, fraud prevention, support, or enforcement of the Terms. Retention depends on the record: billing and tax data follows legal and merchant-of-record requirements; support and audit records are kept while they remain relevant to the account or a dispute; and usage or security metadata is kept only while needed for quota, reliability, and abuse-prevention purposes before deletion or aggregation.

Raw scoring answers are processed to return the requested result and are not written to the B5Tools application database by default. Local WordPress and browser data remains subject to the operator's settings and retention practices.

10. Security

We use access controls, HTTPS, one-way API-key hashing, short-lived connection secrets, server-side credential handling, scoped credentials, audit records, and provider security controls. No method of transmission or storage is completely secure. Operators must secure their own WordPress installations and integrations.

11. Your rights

Depending on the law that applies, you may have rights to access, correct, erase, restrict, or receive your personal data, and to object to certain processing. Where we rely on consent, you may withdraw it. Where we rely on legitimate interests, you may object and we will assess whether overriding grounds require processing to continue.

Send requests to hello@b5tools.ly. We may need to verify your identity. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live or work when applicable.

12. Automated processing

B5Tools automatically calculates personality type results from submitted assessment answers. B5Tools does not use that calculation to make decisions with legal or similarly significant effects about an operator or visitor. Operators must not use the Service for consequential decisions prohibited by the Terms.

13. Changes to this policy

We may update this policy when the Service, providers, or legal requirements change. We will post the updated policy with a new date and provide additional notice where a material change requires it.