Last updated: Aug 16, 2026
The data controller is ExtMonetize.
For any question about your data: extmonetiz@gmail.com.
For developer accounts, we are the data controller: we decide which data is necessary for the Service to work.
For the end users of your extensions, we act as a processor: you, the developer, are the controller. You determine which data is collected through the SDK, and it is your responsibility to inform your users and, where applicable, obtain their consent. We process that data only on your instructions and for the purposes of the Service.
Developer account: email address, password hash (never the password in clear text), company name where provided, authentication provider and external identifier in case of SSO sign-in, Stripe account identifier, API keys (the secret key is only ever kept as a hash), creation and update dates.
Extensions and plans: name, identifier, description, store URLs, allowed origins, prices and paywall settings.
End users of your extensions: email address where provided, device identifier, Stripe customer identifier, usage counter, trial start dates, subscription status and periods.
Usage events: event name, the metadata you send through trackEvent(), and a timestamp. The content of that metadata is your choice: do not put sensitive data in it.
Technical data: IP address and request timestamps, solely for rate limiting and security; delivery logs for the webhooks you configure.
No payment card data passes through or is stored on our servers: payments are handled end to end by Stripe.
We do not sell or rent your data. We rely on the following providers:
We may also disclose data where a legal obligation or a request from an authority requires it.
Some of the providers above may process data outside the European Union. Such transfers are framed by the European Commission’s standard contractual clauses or by any other recognized mechanism. Details applicable to our setup: Stripe, Cloudflare and Google may process data in the United States, under standard contractual clauses and, where applicable, under their certification to the EU–US Data Privacy Framework. PostHog is configured on its European instance, so analytics data does not leave the European Union.
Necessary for the service: the dashboard keeps your session token in your browser’s local storage to keep you signed in. Your cookie choice is stored there too, so we do not ask again on every visit. These do not require consent.
Analytics: we use PostHog to understand how the site is used and improve it. What is recorded: the pages you visit, your interactions with the page — clicks and form submissions, with the label of the element you touched, never what you type into a field — and errors raised in your browser, message and stack trace included, along with the address of the page concerned. These cookies are set only after your explicit consent — until you accept, the script is not even loaded. You can change your mind at any time via “Manage cookies” in the footer; declining does not affect access to the service in any way.
We use no advertising cookies and carry out no tracking for targeting purposes.
Inside your extensions, the SDK keeps the premium status token in extension storage, so that a user’s entitlements can be checked without a constant network call.
Passwords are stored as cryptographic hashes. Traffic is encrypted in transit. Premium status is issued as an RS256-signed token, with the private key remaining exclusively server-side. Outbound webhooks are signed so that you can verify their origin. As no measure guarantees absolute security, we will inform you without undue delay of any data breach affecting you, in accordance with applicable regulations.
Any substantial change to this policy will be notified to you by email or flagged in the dashboard. The date of the last update appears at the top of this page. The applicable contractual terms are set out in our terms of service.