Privacy Policy

Last updated: 16 September 2026

This Privacy Policy explains what BackupYourSite — the SSH-based backup platform at app.backupyoursite.com and the optional cloud storage used by the BackupYourSite WordPress plugin — collects, why, how long it is kept, and what your rights are.

BackupYourSite is owned and operated by Yogya Infomedia Limited, trading as Nurotech — a unit of Yogya Infomedia Limited ("BackupYourSite", "we", "us", "our").

Yogya Infomedia Limited Registered Office: 203, Gupta Arcade, L.S.C Shrestha Vihar, New Delhi – 110092, India Corporate Identification Number (CIN): U72900DL2016PLC289956 Contact: support@backupyoursite.com

If you do not agree with this Policy, do not use the Service, connect a server over SSH, or connect the WordPress plugin to a BackupYourSite account.

1. What this covers — two ways your data reaches us

BackupYourSite has two connection paths and this Policy covers both:

A. The SaaS platform (agentless, SSH). You add a server by giving us SSH access; our platform connects, backs up the files and database on the schedule you set, and stores the result in our offsite storage. Nothing is installed on your server.

B. The WordPress plugin (optional cloud storage). The BackupYourSite plugin runs backups inside WordPress and, by default, stores them on your own server — we never see that data. Only if you create a BackupYourSite account and paste a connection code into the plugin's Account screen does the plugin send anything to us. This section is written to match exactly what the plugin's readme.txt "External Services" section discloses — if the two ever disagree, tell us.

Exactly what the plugin sends, and when

When	What is sent
You press Connect with a pasted code	The connection code, your site's home URL, your site's name, and the plugin version. We return an access token scoped to that one site.
A backup runs with Cloud selected as a destination	The backup archives themselves, in parts. These archives are your site's files — including `wp-config.php` (your database credentials and WordPress authentication salts) — and a full copy of your WordPress database, which includes user accounts, email addresses, password hashes, comments, orders, and any other personal data any plugin on your site stores. A SHA-256 checksum and the archive file names/sizes travel with each part.
You open the Account screen or press Refresh	A request for your plan name and storage quota. We record this as a liveness signal only.
You restore from a cloud backup	A request for a time-limited download URL, then the download of the archive volumes back to your server.
You delete a cloud backup, or disconnect the site	The backup set identifier, or a disconnect request carrying that site's token.

Nothing is sent before you connect. We never receive telemetry, usage analytics, or any data from the plugin unless a backup with Cloud selected actually runs. We never ask for or store your WordPress admin password.

Because a backup archive is a literal copy of your WordPress database, whatever personal data is stored anywhere on your WordPress site — by WordPress core, WooCommerce, a forms plugin, a membership plugin, anything — is inside that archive. You are the one who decides what your site stores; we only store the copy you send us.

2. What we collect directly (both products)

Account data: your name, email address, and a hashed password (we never store your password in plain text and never display it back to you).
Connection data: for the SaaS platform, SSH host, port and credentials you provide, encrypted at rest; for the plugin, the site's home URL, site name and connection token — never your WordPress admin password.
Backup content: your website's files and database, as described above — for the SaaS platform on every connected site; for the plugin, only sites where you selected Cloud as a destination.
Billing data: plan, billing address, and payment status. Card numbers are processed by our payment processor and are never stored on our servers.
Operational logs: backup/restore history, job status, IP address and timestamp of account actions, and security audit events (logins, connects, disconnects).
Support communications: anything you send us at support@backupyoursite.com.

3. Why we process it (lawful basis)

Purpose	Lawful basis (GDPR Art. 6)
Running backups and restores you request	Performance of a contract
Account security, fraud/abuse prevention	Legitimate interest
Billing and invoicing	Contract / legal obligation
Responding to support requests	Contract / legitimate interest
Service and security emails (failures, alerts)	Contract / legitimate interest
Marketing email	Consent — opt-in only, withdrawable at any time

For account data and billing data, Yogya Infomedia Limited is the data controller — we decide why and how that data is processed.

For the content of your backups (your site's files and database), you are the data controller and BackupYourSite acts as your data processor. We process backup content solely to store, verify and, at your instruction, restore it — we do not read, search, analyse or use the content of your backups for any other purpose, and we do not open them except as required to verify archive integrity (checksum/format validation, not content inspection) or to fulfil a restore you initiate.

Data Processing Addendum

If your organisation needs a signed Data Processing Addendum (DPA) to cover our processor role under GDPR Art. 28 — standard contractual clauses, sub-processor list, audit rights — email support@backupyoursite.com and we will provide one.

5. Sub-processors

Sub-processor	Purpose	Location
iDrive e2 (object storage)	Stores encrypted backup archives	Asia-Pacific region (ap-northeast-1)
Our payment processor	Card/payment processing for paid plans	Per processor's own terms
Transactional email provider	Delivery of account, security and backup-alert email	Per provider's own terms

We do not use sub-processors to read or analyse backup content. If we add or change a sub-processor that materially affects how your data is handled, we will update this page.

6. International data transfers

Backup archives and account data are stored with iDrive e2 object storage in the Asia-Pacific region (endpoint ap-northeast-1). If you are in the European Economic Area, the United Kingdom, or another jurisdiction with its own transfer restrictions, this is an international transfer of your data. Where required, we rely on standard contractual clauses or an equivalent lawful transfer mechanism with our storage provider; details are available on request via the DPA above.

If GDPR applies to you, you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — correct inaccurate data.
Erasure — request deletion of your account and its data ("right to be forgotten").
Portability — receive your data in a portable format, or have it transferred.
Restriction — ask us to limit processing in specific circumstances.
Objection — object to processing based on legitimate interest, including marketing.
Withdraw consent — for anything based on consent, at any time, without affecting processing already carried out.

To exercise any of these rights: email support@backupyoursite.com with your account email and the right you are exercising. We will respond within 30 days. For backup content (your site's data), we act only on your instruction as the controller of that data — you exercise rights over it directly on your own site; we will assist with deleting or exporting copies we hold on request.

You also have the right to lodge a complaint with your local data protection supervisory authority.

8. California residents (CCPA/CPRA)

We collect the categories of personal information described in Section 2 above — identifiers (name, email), account and billing information, and, for connected sites, the content of backup archives. We do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months.

California residents have the right to: know what personal information is collected and how it is used; delete personal information (subject to legal exceptions); correct inaccurate information; opt out of sale/sharing (not applicable — we do not sell/share); and non- discrimination for exercising these rights. Exercise any of these by emailing support@backupyoursite.com.

9. India — Digital Personal Data Protection Act, 2023 (DPDP Act)

Yogya Infomedia Limited is the Data Fiduciary, under the DPDP Act, for account and billing data we collect directly. For backup content you send us (SaaS platform) or opt to send us (plugin's Cloud destination), you remain the data fiduciary for the personal data inside that content — including any of your own customers'/site users' personal data — and we process it strictly on your instruction as described in Section 4 above.

Notice and consent. By creating an account, connecting a server, or connecting the plugin, you consent to the processing described in this Policy for the stated purposes. Where the DPDP Act requires a separate notice for a specific processing activity (e.g. marketing email), we obtain that consent separately and it can be withdrawn at any time.

Data Principal rights. If you are located in India, you have the right to obtain a summary of the personal data we hold about you, to correct or update it, to have it erased (subject to legal retention requirements), to nominate another individual to exercise your rights in the event of death or incapacity, and to have a grievance addressed as below.

Grievance Officer Yogya Infomedia Limited (BackupYourSite) Email: support@backupyoursite.com Address: 203, Gupta Arcade, L.S.C Shrestha Vihar, New Delhi – 110092, India

We will acknowledge and address grievances within the timelines prescribed under the DPDP Act and its rules.

10. Security measures

We only make claims here about controls that are actually implemented in the product today:

In transit: all connections to app.backupyoursite.com — including the plugin's connect, upload, status, download and disconnect requests — are HTTPS only. The plugin's API client refuses to send a backup over an unencrypted connection; the only exception is an explicit, wp-config-only local-development override that cannot be reached from a production site.
At rest: SSH credentials (SaaS platform) and the plugin's connection token are encrypted at rest, not stored as plain text.
On our storage: backup archives at iDrive e2 are stored in a private, non-public bucket; nothing is served over a public URL — every download goes through a time-limited, authenticated request.
On your own server (plugin, local storage): the plugin protects its own local backup folder with index.php, .htaccess and web.config rules, and actively tests over HTTP whether those rules work on your specific host, warning you if they do not.
Access controls: access to production backup storage is limited to the engineering personnel who operate the service; every plugin API request is scoped to a single site's token, so one compromised token cannot read another customer's backups.
Retention and deletion on termination: deleting your account stops all further backups immediately. Stored backup content is deleted after the retention/grace window described in Section 11 — we do not indefinitely retain former customers' backup content.

11. Retention and deletion

Backups are pruned according to your configured retention setting; the plugin never deletes a set after a backup run that did not finish cleanly, so at least one working backup is always kept until you have a good one to replace it.
On account lapse or cancellation, backups are kept for a limited grace window (to let you renew without loss) and then permanently removed.
On account deletion, we stop all backups immediately and remove stored backup content and account data after the same grace window, except where we are required to retain billing records for tax/legal reasons.
Operational/security logs are kept for a limited period for security and abuse investigation, then deleted or anonymised.

12. What we never do

We never sell your data or the contents of your backups to anyone.
We never open, read or mine the contents of your backups for any purpose other than integrity verification and the restore you request.
We never send marketing email without opt-in consent — only transactional email (verification, password resets, receipts, backup/failure alerts, and, for the plugin's Cloud storage, the notices described in its readme).
The plugin sends nothing about your site until you deliberately connect an account.

13. Breach notification

If a security incident affects your account data or backup content in a way that creates a risk to you, we will notify you without undue delay by email, and notify the relevant supervisory authority where the applicable law (GDPR, DPDP Act) requires it.

14. Changes to this Policy

We may update this Policy as the service changes. Material changes will be reflected by updating the "Last updated" date above; continued use after a change means you accept the updated Policy.

15. Contact

Questions about this Policy, a data subject/data principal request, or a DPA request: support@backupyoursite.com or the contact page.

Published by Yogya Infomedia Limited, operator of BackupYourSite (https://backupyoursite.com).