FFL Funnels Addons Privacy
This policy explains how I handle information in connection with alearuca.com and with FFL Funnels Addons, the WordPress plugin I provide to clients.
I am Alejandro Aruca, an independent web developer operating as a sole proprietor in Florida, United States. You can reach me at aruca.ale@gmail.com with any question about this policy.
Information collected through this website
If you contact me through this site, I receive the name, email address and message you submit. I use them to reply and to carry out any work we agree on. I do not add you to a mailing list without asking, and I do not sell or share this information.
This website does not use analytics or tracking cookies.
Google user data
FFL Funnels Addons offers an optional feature that displays a store owner's Google Analytics reports inside their WordPress administration area. This section explains what that feature accesses, why, and what happens to the data.
What is accessed
If you choose to connect a Google account, the plugin requests a single permission: https://www.googleapis.com/auth/analytics.readonly. This grants read-only access to your Google Analytics accounts and properties. The plugin cannot create, modify or delete anything in your Google Analytics account, and requests no access to Gmail, Drive, Contacts, or any other Google service.
Why it is needed
The permission is used for exactly one purpose: to fetch the report data you ask for — sessions, traffic sources, product performance, ecommerce funnel and revenue figures — and display it in your WordPress dashboard. A narrower scope does not exist; Google publishes no read permission limited to a single property or to ecommerce metrics alone.
What is stored, and where
When you connect, Google issues a long-lived credential (a refresh token). That credential is stored on the connection service at connect.alearuca.com and is never sent to your WordPress site. Your site holds only a pair of identifiers that work solely against that service and that can be revoked individually. Short-lived access tokens are cached on your own site for at most one hour and are then discarded.
Report data is not retained by me
Report figures are requested from Google when you open a dashboard and are cached temporarily on your own WordPress site to reduce the number of API calls. They are not copied to my servers. I do not read, analyse, or retain your Analytics data.
It is not shared or sold
Google user data obtained through this feature is never sold, rented, or shared with third parties. It is not used for advertising, for training machine-learning or artificial-intelligence models, or for any purpose other than providing the reporting feature to you. I do not read your Google user data, except in the narrow cases Google's policy permits: with your explicit consent while resolving a support request you have raised, where required by law, or as strictly necessary for security investigations or abuse prevention.
Limited Use. FFL Funnels Addons' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How to revoke access
You can disconnect at any time from Google Analytics → Settings inside your WordPress admin, which deletes the stored credential and revokes the grant with Google. You can also revoke it directly at myaccount.google.com/permissions. Revoking stops the reports from loading; it does not affect the tracking the plugin sends to your Analytics property, which uses no Google account access.
Retention
Credentials are deleted immediately when you disconnect, when you revoke access from your Google account, or after 12 months without use.
Data on client websites
When I install FFL Funnels Addons on a client's store, that store collects information about its own visitors — orders, analytics events, and similar. The store owner is responsible for that data and for the privacy notice shown to their visitors. I act on their instructions as a service provider and do not use their visitors' data for my own purposes.
Security
Credentials are encrypted at rest. Access tokens are short-lived. The connection service holds no report data, and access to it is limited to me.
Your choices
You can ask me what information I hold about you, ask me to correct or delete it, and withdraw any consent you have given, by emailing aruca.ale@gmail.com. I do not sell personal information.
Changes
If this policy changes materially, I will update the date above and, where the change affects an active Google connection, notify affected clients directly.