Skip to content
bigbad.
Start a project

Policy · effective 28 October 2026

Privacy policy.

This covers bigbad.agency: reading the site, buying a Pro plugin, and the licence checks a Pro plugin makes. It describes what the site and plugins actually do today. Our apps and games have their own policies, listed at the end.

Who we are

Big Bad Agency, 1616 1 St NE, Calgary, AB, Canada. For any question or request about your data, email hello@bigbad.agency.

When you read the site

  • Google Analytics. The site's pages, including the cart and checkout, load Google Analytics 4. It records the pages you view, how you arrived, and your device and browser, and it sets cookies whose names start with _ga.
  • Shop events. On the cart and checkout pages, Google Site Kit also sends shopping events (for example adding a plugin to the cart, or a completed purchase) to the same Analytics account.
  • No ad pixels. We do not add advertising pixels such as Meta, TikTok, LinkedIn or Pinterest tags.
  • Fonts. The main site serves its own font files. The cart and checkout pages load fonts from Google Fonts, so Google sees your IP address when those pages load.
  • Videos. A few work pages embed YouTube videos in YouTube's privacy-enhanced mode (youtube-nocookie.com). YouTube may set cookies once you play one.
  • Contact. There is no contact form. If you email us, we keep the email in our mailbox so we can reply.

When you buy a Pro plugin

Checkout is WooCommerce on bigbad.agency. You check out as a guest; buying does not create an account.

  • What you enter: your name, email address, billing address and phone number.
  • What WooCommerce saves with the order: what you bought, the price and date, your IP address and browser details, and how you reached the site (the referring site, any campaign tags in the link, how many pages you viewed and your device type).
  • Payment: card payments go through Stripe. You type your card details into Stripe's own form, so they go to Stripe and never reach our server; we never see or store your full card number. Stripe receives the card details and the billing information needed to take the payment, and handles them under Stripe's privacy policy.
  • Emails: WooCommerce emails you about your order (received, completed, refunded). When the order is completed, our licence server emails your licence key to the same address.
  • No mailing list. Buying does not sign you up for marketing email. If we ever want to send you news, we will ask first.

When a Pro plugin checks its licence

When you activate a Pro plugin, and then a few times a day while it is installed (to confirm the licence and to check for updates), the plugin on your site contacts our licence server at bigbad.agency over HTTPS and sends:

  • your licence key;
  • which Pro plugin it is;
  • your site's address (its WordPress home URL).

Our server keeps the list of sites each key is activated on, and a log of each check: the site address, the key, the result, the time, and the IP address of the server that made the request.

Like every request WordPress makes, the request also carries WordPress's standard identifier: your WordPress version and site address. The plugin sends nothing else. No posts, users, orders or customer data from your site reach us.

Who else receives data

  • Stripe, to take payments.
  • Google, for Analytics, the Site Kit shop events and the fonts on the checkout pages.
  • Hostinger, which hosts our website, the store and its database.

Stripe and Google are US companies, so this data can be processed in the United States and other countries. We do not sell personal information, and we share it with no one else unless the law requires us to.

How long we keep it

  • Orders stay in WooCommerce. We keep order records for as long as Canadian tax law requires us to keep business records (generally six years).
  • Licence records and activations are kept while the licence exists.
  • Licence-check logs are not deleted automatically today. Ask and we will delete the log entries for your key.
  • Analytics data is kept by Google under the data-retention setting of our Analytics account.

Cookies

  • _ga, _ga_FRBDF1XYX6: Google Analytics, on the site's pages.
  • sbjs_…: WooCommerce on the cart and checkout pages, short-lived, to record how you arrived (saved with your order).
  • woocommerce_… and wp_woocommerce_session_…: WooCommerce, once you add something to the cart, to keep your cart and checkout working.
  • Stripe's own cookies on the checkout page, which Stripe uses to detect fraud.

You can block or delete cookies in your browser, or stop Google Analytics with Google's opt-out add-on.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. We delete everything we are not required to keep; order records we must keep for tax are kept for that period only. Email hello@bigbad.agency from the address you used at checkout, and we will reply within 30 days.

  • In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
  • In the EU or UK, you also have the GDPR rights to restrict or object to processing and to receive your data in a portable format, and you can complain to your local data protection authority. We use order data to carry out your purchase and to meet tax law, and licence-check logs and analytics for our legitimate interests in preventing licence misuse and understanding how the site is used.

Children

Our plugins and services are for businesses. They are not aimed at children, and we do not knowingly collect information from anyone under 13.

Our apps and games

Apps we publish have their own privacy policies: Tacklist, Fishbone Flinger and Big Bad Agency Tools.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.