Content Privacy Policy

This Content Privacy Policy addresses customer website content and related technical materials provided to or accessed by Esposearch in connection with professional WordPress projects, technical assessments and authorized support. It may also apply to materials received during preliminary enquiries, scoping, quotations, diagnostics or troubleshooting before a formal project is accepted.

Our services may include website planning, design and development, WooCommerce, content, SEO, analytics, performance, security, maintenance, migration, AI integration and automation. The particular information required depends on the approved activity. This policy does not replace our separate Privacy Policy for personal information or the applicable project agreement.

Esposearch.net is owned and operated by Esposearch Limited, a limited liability company registered under the laws of the Republic of Kenya and based in Nairobi, Kenya. Esposearch provides professionally managed WordPress solutions for customers worldwide.

Our public website is esposearch.net, and our administrative contact is admin@esposearch.net. AI and automation are specialist capabilities within our broader WordPress services.

Customer Content means materials a customer owns, controls or is authorized to share for the agreed or proposed work. Depending on the assignment, it can include website text, images, videos, documents, spreadsheets, source code, WordPress themes and plugin settings, custom CSS, JavaScript, files, databases, WooCommerce information, form entries, business plans, screenshots, error logs, hosting configurations, DNS information, API settings, datasets, AI prompts, outputs and project correspondence.

Not every project requires every category. We should request, examine or retain only materials reasonably relevant to the authorized purpose.

Uploading, emailing or otherwise making Customer Content available does not by itself transfer ownership to Esposearch. Ownership remains with the customer or the relevant lawful rights holder, subject to applicable agreements and law.

WordPress software, third party themes and plugins, licensed fonts, stock content, external APIs and other protected material retain their applicable licenses and ownership conditions. Ownership of newly commissioned deliverables is addressed separately in clause 23.

By supplying material for authorized work, the customer permits us to access, review, use, copy where necessary, configure, modify, transmit, temporarily store, test, migrate, diagnose or otherwise process that material as reasonably necessary to carry out the approved purpose.

Processing may also be needed for directly related support, project administration, quality review, security, dispute management or legal responsibilities. This limited authority does not permit unrelated resale, publication or promotional use of confidential Customer Content.

Confidential material may include unpublished business information, revenue or commercial records, customer databases, internal reports, customer lists, unpublished website content, proprietary processes, credentials and restricted system configurations.

We should limit use and disclosure of such material to the authorized work and other legitimate contractual, security, administrative or legal purposes. Customers should identify unusual sensitivity or handling restrictions before sharing the information whenever reasonably possible.

Customer Content can contain information about identifiable website visitors, subscribers, purchasers, employees, members or other people. Depending on who determines the purposes and means of an activity, Esposearch may act as a data controller or a data processor, or carry out different roles in different contexts.

Customers who determine how their website users’ personal information is handled remain responsible for their own applicable obligations and for authorizing access lawfully. Our Privacy Policy explains personal information practices more broadly, while a relevant Data Processing Agreement may set out additional responsibilities.

Customers should share only the information reasonably required for assessment or delivery. A relevant screenshot, masked data sample, limited export, test account or specific error log may be sufficient instead of providing an entire production database.

Where practical, remove unrelated records, mask sensitive values, use demonstration data, restrict download rights and select the least extensive access suitable for the task. Ask for a secure transfer arrangement before sharing unusually sensitive information.

Authorized technical work may require access to WordPress, hosting, DNS, SFTP, databases, analytics, Search Console, email administration, application interfaces or connected software. Access should be matched to the accepted scope and granted only with appropriate authority.

Temporary credentials, restricted accounts and permission controls are preferred where workable. Master credentials should not be shared unnecessarily. Customers should review, revoke or rotate temporary access after completion when appropriate, and authorized professionals must not reuse credentials for unrelated work.

WordPress administration can expose unpublished posts, registered users, customer submissions, WooCommerce orders, installed software, site settings and other private information. Access to these areas should be proportionate to the work.

Where a lower privilege account can perform the task, it should be considered before full administrator access. Higher privileges may be required for approved development, diagnosis or security work, but should not be treated as universally necessary.

Infrastructure services may involve hosting accounts, domain controls, DNS records, certificates, server files, backups, configuration settings or staging environments. These systems can expose information unrelated to the immediate project.

We should avoid changing unrelated settings, use only necessary permissions and account for the terms and independent practices of the relevant hosting or infrastructure provider.

WooCommerce stores may include names, addresses, contact details, orders, shipping information, product records, account details and payment related transaction metadata. These records must not be accessed without an appropriate project need.

For testing, use sandbox payment facilities, test orders, staging environments or appropriately masked samples where practical. Do not send complete payment card numbers, security codes, banking passwords or payment provider master credentials through ordinary email or chat.

Database backups and exports may contain user accounts, order history, form submissions, system tokens, configuration details and other sensitive information that does not appear on the public website.

Exports should be requested only when needed, copied as little as practical, protected appropriately and removed when no longer reasonably required, subject to legitimate backups, contractual, security and legal retention.

Project assets may include reports, presentations, spreadsheets, PDFs, datasets, images, videos, source archives and other files. Customers must have lawful authority to provide these materials and request the relevant processing.

We should not publish, market, sell or otherwise use nonpublic customer files outside the authorized purpose without an appropriate legal or contractual basis or specific authorization.

Screenshots, server logs, application error messages, analytics exports and performance reports can reveal usernames, website paths, private URLs, personal information, authentication values or hidden configuration details.

Where reasonably possible, unnecessary sensitive details should be redacted or excluded before files are shared, and diagnostic records should be limited to people who need them for authorized work.

Project messages, account conversations, email, live chat, service instructions and technical notes may be used for delivery, clarification, supervision, support, accounting, dispute handling, security and legitimate recordkeeping.

Customers should not assume that only one individual specialist can see every message. Relevant authorized agency personnel may review communications when reasonably needed for the purposes described. Confidential information must still be handled under applicable duties.

Clients engage Esposearch for managed professional services. We may coordinate suitable specialists who work remotely, including persons whose practical technical competence has been assessed through our professional development and expert admission processes.

Access should be restricted to the materials and permissions required for the accepted assignment and subject to relevant project, confidentiality and legal obligations. Experts must not reuse customer information to solicit business independently, create unrelated databases, advertise their own services, publish customer materials or carry out unrelated work.

Authorized work may involve hosting services, cloud storage, email and communication platforms, backup and security services, technical software, payment systems, support providers and AI tools. These providers may process information under their own service terms and privacy arrangements.

We should consider provider suitability and relevant data risks in proportion to the project, avoid unnecessary transfers and implement appropriate contractual or technical safeguards where required. The provider list depends on the actual services selected and should not be assumed to be identical for every project.

AI assisted tools may support suitable WordPress work, but confidential Customer Content should not automatically be uploaded to external AI platforms merely because those tools are available. The suitability of any such use depends on necessity, the assignment, customer instructions, confidentiality, the presence of personal information and applicable law.

Before external AI processing, relevant provider conditions should be considered, including retention, model improvement settings, human review, international processing, security and any required customer approval. Where the risks cannot be appropriately addressed, a safer configuration or a method without the external AI service may be necessary.

Prompts, datasets, customer supplied reference materials and generated outputs can carry different rights and obligations. External AI providers may apply different settings and terms for storage, monitoring, product improvement and training, depending on the service and account used.

We do not treat every generated output as exclusively owned by Esposearch or by the customer without regard to the agreed terms, provider conditions, copyright law and third party rights. AI generated material may also need factual, security and intellectual property review before use.

Confidential Customer Content must not be repurposed for unrelated advertising, public publication, independent resale, data brokerage, a professional expert’s personal marketing, unrelated datasets or unrelated AI model training without an appropriate legal basis and required authorization.

Content received for one project is not permission to reuse it for another customer, a training course, a future product or any unrelated commercial purpose. Legitimate support, security, contractual or legal processing remains subject to the applicable conditions.

The completion of a project does not automatically authorize public use of confidential screenshots, customer logos, private case details, unpublished files, testimonials or project materials in portfolios, training pages, social media or promotional content.

Where permission is necessary, it must cover the particular intended use. Permission to quote a testimonial does not automatically allow disclosure of private commercial facts, customer identities, internal information or protected third party assets.

Customer supplied content, licensed themes and plugins, open source software, third party materials, Esposearch materials created before a project and new commissioned deliverables may each carry different rights. Ownership or licensing of deliverables is determined by the accepted agreement, applicable payment conditions, existing licenses and relevant law.

Esposearch Courses requires practical product development and assessment. An independently developed learner product may be improved, evaluated and considered for sale through an appropriate separate agreement that addresses ownership, permissions, licensing and compensation. A customer website, confidential project, customer database or protected client deliverable must never be treated as a learner product for sale merely because a trainee or expert worked on it. Any authorized demonstration, adaptation or commercialization of customer work requires a valid rights basis and appropriate safeguards.

Authorized work may require temporary backups, staging sites, database copies, local working files or migration packages to carry out testing, repair, development or protection of a website.

These copies should not automatically become permanent archives. They should be reviewed and removed when no longer reasonably needed, taking account of backup cycles, security, approved maintenance arrangements, dispute records and legal obligations.

Content may be stored or processed in customer websites, authorized project records, technical systems, relevant communications, approved storage services, development environments or providers actually used for the engagement.

Storage location varies with technology and vendor selection. Esposearch does not assert that all content is stored within Kenya. A requested location restriction or hosting jurisdiction must be raised before agreement so its feasibility and any necessary safeguards can be assessed.

Customers, professional contributors and hosting, communication or software providers may operate in different countries. The handling of personal information across borders may therefore engage the transfer rules and safeguards required by applicable law.

International processing is not automatically permitted without considering the actual circumstances, relevant roles, contractual duties and legal requirements. More information about personal data transfers belongs in the separate Privacy Policy and any applicable Data Processing Agreement.

Customer Content may be retained for a period reasonably necessary for accepted work, associated support, legitimate accounting, transaction records, dispute resolution, security investigations, legal claims or legal compliance.

Different classes of information may require different retention treatment. Temporary access details should not be treated in the same manner as invoices, project agreements or required records. No single universal retention period is promised for every item of Customer Content.

Customers may request removal of eligible content that is no longer reasonably needed, subject to applicable legal duties, contract requirements, security records, dispute preservation and legitimate retention needs.

Removal from an active system may not immediately remove every backup or replica. Copies may remain until overwritten, expired or otherwise handled through the applicable backup lifecycle. When technical access is no longer authorized, the relevant permissions and credentials should be reviewed and withdrawn or rotated as appropriate.

We aim to apply safeguards appropriate to the particular engagement, information and systems involved. Depending on circumstances, measures may include restricted permissions, authentication, confidentiality obligations, updates, suitable backups, access reviews and sensible provider selection.

No online service or transmission can guarantee perfect security. This policy does not establish an unverified certification, universal encryption promise or public description of confidential security architecture.

Where an incident involving unauthorized access, disclosure, loss or compromise of Customer Content is suspected or identified, the appropriate response may include investigation, containment, remediation, documentation and cooperation with relevant parties.

Notice to customers, regulators or affected individuals depends on the facts, our legal role, the applicable law and any binding contractual obligations. This policy does not replace specific notification periods that may be required by law or an applicable agreement.

Customers must have authority to share the materials and authorize the relevant access. They should provide lawful content, accurate requirements, suitable approvals, reasonably necessary information and clear notice of unusual restrictions or sensitivity.

Customers should safeguard their own credentials, maintain suitable backups where required, withdraw obsolete access after completion and meet relevant duties to their own website visitors or customers. An individual acting for another organization must have sufficient authority to instruct the work.

Customers must not knowingly use Esposearch to distribute malware, facilitate fraud, breach intellectual property rights, submit unlawfully obtained credentials, request unauthorized intrusion or direct unlawful handling of content or systems.

Esposearch may decline, suspend or discontinue work that raises material legal, technical security or professional integrity concerns, consistently with the applicable agreements, terms and law.

Information may need to be disclosed where reasonably necessary to comply with applicable law, valid legal processes, lawful investigations, prevention of fraud or misuse, protection of systems or the establishment or defence of legal rights.

Where legally permitted and suitable, requests should be considered for validity, authority and scope. Advance notice to the customer cannot be promised in every situation because legal restrictions or circumstances may prevent it.

Customers with special legal, procurement, confidentiality or security needs may request arrangements such as a confidentiality agreement, Data Processing Agreement, restricted expert access, approved vendors, data location conditions, stronger technical controls, specific retention rules or restrictions on AI use.

These requirements should be raised before the relevant engagement is accepted. Esposearch may evaluate proposed terms but does not automatically agree to every requested control, service level or contractual condition.

We may propose revisions to reflect changes in our WordPress operations, project practices, authorized professionals, technology providers, AI tools, security arrangements or relevant legal requirements.

A genuine revision date should be assigned when a new version is approved and adopted. Where notice or agreement is required for a material change, we will address the applicable requirements. A published revision does not automatically override a separate binding agreement or mandatory legal right.

This policy is intended to be read alongside our Privacy Policy, Terms and Conditions, For Clients information, How It Works guide and Help Center. These documents address related but distinct subjects.

An accepted project agreement or a properly concluded confidentiality or data processing agreement may add relevant obligations. Where provisions differ, their legal effect must be assessed under the particular agreements and applicable law rather than assumed from a universal hierarchy.

For a question about customer content, confidentiality, permissions, website access or handling of an existing engagement, contact Esposearch Limited, Nairobi, Kenya, through admin@esposearch.net or our Contact Us page.

Ask before providing restricted databases, confidential project files or credentials. Ordinary email and live chat are not appropriate for passwords, card security details, API secrets or complete sensitive datasets. We can discuss the suitable transfer and access arrangements for a proposed assignment.