WP Contracts and the DeluxePlugins hosted service
Updated September 27, 2026, for WP Contracts 2.0.
Local WordPress data
Drafts, templates, company settings, permissions and local copies of PDFs are stored on your WordPress installation. Existing contracts keep their local workflow when you upgrade. The plugin does not automatically import those contracts into the hosted service.
Connecting the hosted service
A WordPress administrator must explicitly authorize the connection and approve it while signed in to a DeluxePlugins account. Connection sends the site’s HTTPS address, timezone and a generated installation public key. We verify control of that site’s connection endpoint. The installation private key stays on the WordPress site, encrypted using its security salts. Account, order and licensing records determine eligibility for paid service operations.
Contract information we process and retain
When a connected user issues a contract for PDF export or sending, DeluxePlugins receives and stores the contract terms, company and signer contact details, document settings and relevant images. We retain the issued PDF and subsequent signed versions to provide sending, signing, retrieval and an audit history. This information is not deleted immediately after rendering.
Signers submit their name, signature, optional initials and consent on DeluxePlugins. We record workflow timestamps, the request’s network address, document hashes and delivery outcomes. Private invitation links identify the intended signing record; possession of a link is not an independent verification of a person’s identity. A completed PDF may be emailed to the contract’s signers and the connected account’s email address.
Use, access and security
We use this information to operate the requested contract workflow, authenticate installations, enforce service allowances, prevent abuse and provide support. The contract service does not use contract content for advertising or analytics. Hosting and email providers process information needed to host the service and deliver requested messages. Email delivery necessarily sends recipient details, invitation links and, for completed contracts, the attached PDF through the mail service.
Service API connections use HTTPS. Hosted contract payloads, PDFs, private signing tokens and audit event bodies are encrypted in service storage. Account and operational metadata, including site bindings and usage receipts, are retained separately. Access is restricted to the relevant authenticated installation, authorized account workflows, private signer links and service administration. These controls do not make the service end-to-end encrypted or eliminate all security risk.
Retention and deletion
Hosted records remain available until an authorized administrator requests hosted erasure or an applicable account retention arrangement ends. In Contracts > Hosted service, administrators can retrieve a record, void an unfinished invitation or permanently erase hosted content. Erasure removes the active hosted contract content, PDF, signer records and audit events. A minimal document identity, hash, state and monthly usage receipt remain to prevent resetting the Free allowance. Erasure does not delete separate WordPress copies or PDFs already delivered by email.
Backup copies follow the hosting provider’s backup retention process and are not necessarily removed at the same moment as the active record. Contact support@deluxeplugins.com for access, correction, deletion or retention questions. Issued terms are immutable; corrections require a new contract, and an unfinished invitation can be voided.
Disconnecting and credentials
Disconnecting revokes that installation’s key and stops its new service requests. Existing signing invitations can still finish; disconnecting does not erase hosted records. Reconnecting the same account and site restores access without resetting usage. Installation keys expire after 90 days and are rotated by the connected plugin. Signing links normally expire after 30 days; a reminder may replace an expired link.
The separately downloaded plugin may contact DeluxePlugins for publisher updates and license verification. The WordPress.org edition uses directory updates. Neither edition sends new contract content to the hosted service before connection consent.
10. Store Accounts and Google Sign-In
The statements above about contract information apply specifically to the DP Contracts plugin. When you create or use a Deluxe Plugins store account, we retain the account, order, licensing, and support information needed to provide the store and purchased services.
Pages that display “Continue with Google” load Google Identity Services. As a result, your browser connects to Google and may send technical information such as your IP address, browser or device information, and Google cookies before you use the button. This processing is subject to the Google Privacy Policy.
If you continue with Google, Google provides us with a stable account identifier, your verified email address, and your profile name. We use this information only to create, connect, and authenticate your Deluxe Plugins customer account. We do not receive your Google password or request access to your other Google data. We retain the linked identifier while the connection or account remains active. You may ask us to remove the Google connection through our published contact options.
Google Sign-In disclosure added August 5, 2026.