Subscription Terms & Conditions

1. Can I get a refund?

No refunds. All sales are final.

The only exception is if we’ve messed up. Under most distance-selling regulations, digital products aren’t refundable, and PayPal Buyer Protection doesn’t apply to digital subscriptions either.

2. There is no one-off plan

mySites.guru is a recurring subscription only. There is no one-off option.

When you subscribe we charge you at the start of every billing period (monthly or yearly, depending on the plan) until you cancel. The subscription pages and documentation all make this clear. To stop future charges, cancel your subscription before the next billing cycle.

mySites.guru is not a free service. It is a subscription service. If you repeatedly sign up for multiple accounts to avoid paying for a subscription, all your accounts will be banned and you will be banned for life, or until you contact us and pay for a yearly subscription upfront.

The mySites.guru FREE AUDIT offer is exactly what it says: create an account (there’s no time limit on it), connect one site, and run an audit of that one site. Once the audit completes you get free access to the majority of mySites.guru features, including all the tools in the Snapshot and Audit, but without Backups, Monitoring and some advanced features.

If you attempt to start a new audit, or cancel your running audit, during your free trial, your free trial is instantly over and we would expect you to start a paid subscription.

3. Do you accept PayPal?

Yes, via a linked account at Stripe. We stopped taking PayPal direct years ago because of high cross-border fees and fraud, but bringing it back through Stripe gave us a way to offer it again.

You can also pay with any major card (Visa, Mastercard, Amex) directly on our site. We never see your card details; Stripe handles that.

Fair warning: PayPal fees bite. Between cross-border charges, currency conversion, and Stripe’s own cut, we can lose around £2 on a £19.99 payment. If you can pay by card instead, we’d appreciate it.

EU law requires us to add VAT unless you give us a verifiable EU VAT number for your company.

No refunds. All sales are final.

4. Currency, card fees and VAT

mySites.guru charges in pounds sterling, the currency of the United Kingdom, where our company is registered.

The final price you pay depends on factors outside our control, including cross-border fees, currency conversion fees, and any markup your card issuer or payment provider (such as PayPal) applies for currency conversion or online payments, under the terms you agreed with them.

At all times we charge in pounds sterling, and our fees are set out clearly in defined pounds and pence. The final figure in your local currency will therefore differ from the number you see on our website.

VAT is charged in line with UK and EU law, and in some jurisdictions where we are registered locally for digital services tax. mySites.guru is a business-to-business software solution provided over the internet, so most tax jurisdictions class it as a digital service supplied where the customer is located. Manual consultancy is handled differently for tax purposes: the place of supply is Jersey, Channel Islands. That is why our manual consultancy fees have no VAT or sales tax applied, though they are still charged in pounds sterling and subject to the card issuer and local currency charges explained above.

5. How do I cancel my subscription?

We don’t accept cancellation requests by email, ever. Email isn’t encrypted or authenticated, so for your own protection all cancellations happen inside your account.

You can cancel your subscription in your account settings at any time. These are our terms. If you don’t agree to them, please don’t start a subscription.

To terminate your subscription:

1. Go to Your Plans & Payments inside your account.
2. Click the red request-cancellation button.
3. Give us some feedback - helps us with statistics on why people cancel.
4. Click the final red button: Terminate my subscription now.

Access ends immediately and you’ll get an email confirming the subscription is closed.

What happens after I terminate my subscription?

If you want to delete your sites from our service, do it before cancelling. You won’t be able to afterwards.

After cancellation you’ll keep access to download past invoices and start a new subscription (subject to status), but nothing else. The terms are shown several times during signup and cancellation; we make this as clear as we can.

As part of our cancellation procedure we take one last look at your account and the cached data we hold for your sites. We do this to:

• Understand any issues you hit with audits or backups, so we can improve the service.
• Document the state of your account at termination, for law enforcement and fraud protection.
• Flag anything urgent you may have overlooked - a hacked site, for instance - so you can deal with it after leaving.
• Feed anonymised statistics back into the service and our public figures.

Is this legal?

Yes, perfectly legal.

These are our terms. If you don’t agree to them, please don’t start a subscription.

6. Failed payments and dunning

If a payment fails, we email you and retry a few times (the exact pattern depends on whether you use a card or legacy PayPal). After about three weeks of daily reminders with no successful payment, the account is terminated for non-payment.

Dunning runs automatically at 09:00 UTC every day. If a payment failed in the previous 24 hours we’ll try again, and if it fails we email the account holder.

If an account is terminated for non-payment, you can’t re-subscribe without our approval. This protects us against repeat bad debt.

7. I forgot to terminate my subscription, and you charged me again. Can I get a refund?

No.

If you didn’t terminate your subscription, we’ll keep charging you every period. That’s what you agreed to when you signed up. Subscriptions are powered by Stripe and fully automated.

We don’t refund a payment you noticed a few days late. You have to cancel your recurring billing before the next payment, not after. Keeping track of your renewal date is your responsibility.

8. I terminated my yearly recurring subscription, and now I cannot access my account

Correct.

When you terminate a subscription your account closes immediately - not at the end of the paid period. If you paid for a year, cancel just before renewal to get the most out of it.

Cancelling (or cancelling the recurring PayPal payment) shuts off our tools right away. No refund, no partial refund. That’s how subscriptions work.

A subscription without a recurring payment method isn’t a subscription; it’s a one-off, and we don’t sell those. We plan investment around committed, recurring customers.

9. Plan upgrades and downgrades

If you’re on a single-site plan and add a second site, your subscription is automatically switched to the unlimited-sites plan at the current rate.

You can move between plans at any time; just contact us and we’ll sort the payment.

Downgrades from unlimited to single-site are done manually; contact us if you need one.

10. I thought this was free?

It isn’t. We charge, and we say so on the first page of the signup.

If you sign up for a free trial you’re agreeing to receive marketing and follow-up emails. You can opt out any time from the footer of any email or from the notifications page in your account. Unsubscribes are honoured immediately, but funnel emails already queued may still go out.

11. What about GDPR?

Our service is fully compliant with GDPR. We’re a business; we have to comply.

We hold very little data that GDPR actually applies to: the account holder’s email, postal address, and IP addresses. All of it is needed to provide the service. Our full Privacy Policy is always available, and you can export your data at any time from inside your account.

That covers your own account data, where we are the Controller. For personal data on the websites you connect, including sites you manage for clients, we act as your Processor and our Data Processing Agreement applies. It sets out exactly what we do and do not process from a connected site, every sub-processor we use, and the security measures behind it.

You can ask for Personally Identifiable Information about you to be removed. We also have a right to retain information to comply with other laws, prevent fraud and financial crime, and meet our own obligations as a business (tax law, for example).

Because we don’t store much personal data, there isn’t much we can delete.

GDPR applies only to personal data.

That means information relating to an identifiable person: name, identification number, location data, online identifier, and so on. GDPR doesn’t give you the right to demand we delete everything we hold about your sites - statistics, domain names, audit data, business-related records. Those aren’t personal data, and the regulation doesn’t cover them.

When you delete a site from our service, everything about that site is removed. We retain only a one-way cryptographic hash of the domain name. That hash can’t be reversed to recover the domain, but we can use it to prove a domain was once on our system if law enforcement asks, or if we need to demonstrate it to protect against fraud.

If you have a genuine reason for us not to hold that non-personal data, contact us and we’ll discuss it. There may be reasons we can’t honour the request.

To exercise any of your rights under GDPR, please contact us.

12. Can I delete my account?

We cannot delete accounts on demand.

There is a big difference between your account and your Personal Data. The account itself is a technical record in our systems: we created it and we own it. Your Personal Data (any name you gave us, your email address, IP addresses) is different - you have some rights over it under GDPR. GDPR does not give you a right to remove our technical data, or non-personal data, from your account. A deletion request applies to your Personal Data only, never to the account record itself.

This policy exists to meet our obligations under GDPR, EU VAT regulations, UK Companies Law, and financial reporting requirements, and to protect our platform and users against fraud, abuse, and legal claims.

What happens when you request account deletion

Your account is flagged as abandoned and placed under our standard data retention policy. With immediate effect:

• Your account cannot be accessed or signed into.
• No further emails will be sent to you from the platform.
• Invoice retrieval and service interaction are disabled.
• Domain names previously connected to your account are locked, preventing them from being registered to another mySites.guru account. This protects you.
• Your email address is removed from all automated communications and marketing lists.

How long is my data retained?

No financial relationship: Your account will be permanently deleted approximately one year after your last interaction with us, subject to any subsequent interactions resetting that clock.

Payment history exists: If you have ever made a payment to us, applicable tax law requires us to retain account records for up to 6 years (UK tax law; Jersey tax law; EU VAT where applicable).

Defending the platform, and preventing fraud and abuse

You may have the right to be forgotten, but we keep the right to defend ourselves and our platform.

mySites.guru is a technical service that makes effectively unlimited automated HTTP calls to remote servers and websites on behalf of our users, around the clock. Because that activity reaches other people’s infrastructure, we and our users have to be able to stand behind it. If it is ever challenged, whether by a genuine legal query, attack or lawsuit, or by a malicious accusation, we must be able to show what was done, when, and by whom, and defend both our own actions and those of our users. Keeping a minimal, defensible record is the only way we can do that.

As a business-to-business service we hold very little personal data, and only what you gave us. This may include any name, moniker or username provided to us by you, your email address and IP addresses. Even after a deletion request, we reserve the right to retain that minimal amount where we genuinely need it to:

• Defend against legal claims, and prove who used the platform. We connect to remote servers and websites on your instruction, so if law enforcement or a court asks, we have to be able to show who made a given request, including handing our logs to a court if we are lawfully ordered to.
• Prevent and prove fraud, both financial and technical. Financial such as card testing and card washing; technical such as proving whether our platform was, or was not, used in a cyber attack, and by whom, or defending an accusation or claim of defamation arising from it.
• Protect ourselves and our other customers from repeated abuse, such as personal attacks or the abuse of free trials.

Where we retain data after a deletion request we apply strict data minimisation and strict confidentiality. The personal data we keep (any name, moniker or username you provided, your email address and IP addresses) stays fully encrypted and at rest, is not accessed unless one of the situations above actually arises, and is removed entirely once we are satisfied that no further abuse, fraud or legal defence is possible.

Some of the technical data we keep is stored only as a blind hash, not as encrypted data. A blind hash is a one-way fingerprint: we cannot reverse it to recover the original value, we can only re-hash a value supplied to us in future and check whether it matches. Domain names previously connected to the service are held this way, and IP addresses may also be blind-hashed after a period of time to anonymise them. This lets us protect every user and the platform from abuse (for example, stopping a locked domain from being re-added, or recognising a repeat abuser by IP) without keeping the original values in any recoverable form. Hashing is not encryption: for this data we hold only the hash, never an encrypted copy of the original.

This is permitted under GDPR: the right to erasure does not apply where holding the data is necessary to establish, exercise or defend a legal claim (Article 17(3)), and we rely on our legitimate interests in preventing fraud and abuse (Article 6(1)(f)). Relying on these does not exempt us from the rest of GDPR, so we still minimise what we hold and keep it confidential and secure.

Your rights under GDPR

If you are acting as a natural person (rather than a corporate entity), you have the right to request removal of your personal data only. Such requests are subject to the timescales and conditions set out in the regulations. Our legal obligations for accurate financial and regulatory reporting may take precedence over the right to erasure in certain circumstances, as permitted under Article 17(3) of the GDPR.

You also have the right to request a copy of all personal data we hold on you. We will respond well within the statutory timeframe. You can export your data at any time from your account.

To request account deletion or exercise your GDPR rights, please contact us.

13. Deleting your sites yourself

Yes, we don’t do that for you.

Sites stay on your account until you delete them. A lot of customers come back after a break, and leaving the sites attached means they don’t have to reconnect everything on the other end. It also stops anyone else adding those sites to their own account, which protects you from fraud.

Removing our connector from your site is your responsibility.

The quickest route is to delete the site from our service before cancelling your subscription. Every site has its own encryption key pair, and deleting the site from our end destroys half of it. After that we can’t reach your site even if we wanted to.

On your side, delete the keys folder at plugins/system/bfnetwork/keys (Joomla) or wp-content/plugins/mywpguru/bfnetwork/keys (WordPress).

14. How do I stop this service accessing my site?

Quickest route: delete the site from our service. Every site has its own encryption key pair, and deleting the site from our end destroys half of it for good. After that we can’t reach your site even if we tried.

On your side, delete the keys folder at plugins/system/bfnetwork/keys (Joomla) or wp-content/plugins/mywpguru/bfnetwork/keys (WordPress).

15. I heard if this service gets hacked, then a hacker can access my sites?

I won’t go into specifics here, but we architect for a full database compromise. Even if our database were stolen in its entirety, an attacker still couldn’t run commands against your site through the connector.

The service isn’t on one server either; it runs on a distributed, read-only Docker setup.

If you want to know more, ask. We’re proud of how this is built and happy to talk about it.

16. When I uninstall your plugin why does it not delete its tables?

Joomla extensions don’t delete their tables on uninstall. That’s been best practice for over a decade. An accidental uninstall shouldn’t wipe years of customer data along with the extension.

Our tables all have the bf_* prefix and hold cache data only - one row per file or folder in your webspace. Nothing in them is original; it’s all rebuilt from the files already on your server. Delete them whenever you like. They don’t need backing up.

17. Access to your sites

For this service to work at all, the connector you install gives us full access to every file in your webspace and to the contents of your database. We don’t care about your personal data or your customers’ data; we respect your data and promise to do no evil. See our Privacy Policy for the full position.

The connector source is open and unencrypted, not a generic backdoor. You can read it and see exactly what it does: only the things our service needs to do its job.

Installing the connector grants us that access.

It stays valid for as long as the connection exists - even after your financial subscription ends. Other sections in these terms explain how to revoke it and why the access outlives the subscription.

Our Privacy Policy forms part of these terms and should be read alongside this section.

18. Strong Customer Authentication (PSD2) for card payments

Strong Customer Authentication (SCA) came into effect on 14 September 2019 under Europe’s PSD2 regulation. It changes how European customers authenticate online payments. SCA currently applies to European customers only.

By providing your payment card details you authorise Blue Flame Digital Solutions Limited, trading as mySites.guru, to instruct the financial institution that issued your card to take payments in line with the terms of your agreement with us.

You understand that mySites.guru is a subscription service and that you are initiating a payment or series of payments which we will process on your behalf. The frequency depends on your subscription period (monthly or yearly). The amount depends on your chosen plan and is shown to you several times before you subscribe.

When you submit your card through any payment widget on our site, you give us the right to charge that card for any of our fees without further confirmation. That covers recurring monthly or yearly subscription payments, interest charges, and fixed-fee consultancy charges published on our website.

19. Other terms that apply

Things we’ve had to spell out to people in the past:

No disposable email addresses.

We need a real contact for accounting, financial compliance, and law enforcement. Fake or disposable addresses are blocked on signup or on first manual review.

One domain, one account.

A single domain name can only ever be in a single mySites.guru account. This protects you and the domain or site owner, and it protects us against abuse and fraud by locking a domain to a single user at a time.

Unless you follow the cancellation steps above, your subscription stays active and we keep charging. The process is fully automated; follow it and there’s no way we can charge you again after termination.

Invoices are available inside your account.

Other payment methods may be available for yearly subscriptions depending on your country; ask us.

A subscription requires an active payment method on file. Remove your last one and the subscription terminates. Show us commitment and we invest heavily in the service in return.

You acknowledge that any suggestions, comments, or feedback you provide to us about the site, the services, or any other product or service we provide (collectively, “Feedback”) will be owned by Blue Flame Digital Solutions Limited, including all intellectual property rights in it, and will be treated as our confidential information. You agree that we may use, disclose, reproduce, license, and otherwise distribute and exploit the Feedback as we see fit, without obligation or restriction. At our request and expense you agree to execute documents or take further reasonable actions to help us acquire, perfect, and maintain those rights.

Contact us with any questions before you subscribe.

20. Abuse will not be tolerated

That covers lies about us or our service, dishonest reviews, public complaints about policies we’ve always published, personal attacks, and anything else made in bad faith.

We can terminate an account without notice for abuse, non-payment, or any other reason. Accounts closed for abuse aren’t refunded.

Chargebacks lead to instant termination without appeal. We don’t charge anyone fraudulently.