Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-20
1. What this policy covers
Karelia Trash ("the Addon") is an addon for Statamic 6 websites. When someone deletes an entry, a taxonomy term, an asset, a global set, a form submission or (if the site switches it on) a user, the Addon keeps a copy in a trash on the site's own server, so it can be restored. This policy explains what personal data the Addon handles and what we, the provider, do and do not receive.
2. The short version
- The Addon runs on the site's own server. It never contacts us, sends no usage data, analytics or telemetry, and has no account with us.
- We cannot read anything the Addon stores. We do not receive content, form submissions, user names, email addresses or files.
- A copy of what is deleted stays on the site's server until it expires (30 days by default), is deleted for good or is restored. The site decides the period.
3. Data handled by the Addon on the site's server
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Deleted content | The fields, slug, date, publish state and place in the page tree of an entry; a term; a global set | Restore it | JSON files in the trash folder on the site's chosen filesystem disk (by default storage/app/private/statamic-trash) | Until restored, deleted for good, or expired (30 days by default, set by the site) |
| Deleted files | The asset file itself and its metadata, up to a size the site sets (100 MB by default) | Restore it | The trash folder | As above |
| Deleted form submissions | Everything the visitor entered in the form | Restore it | The trash folder | As above |
| Deleted users (off by default) | Email address, name, roles, groups and other profile fields. Never password hashes, passkeys or two-factor secrets | Restore the account | The trash folder | As above |
| Who deleted it and when | The id and name of the Control Panel user who deleted the item, and the time | Show it in the trash, so editors know what happened | The trash folder | As long as the item |
| Settings | Retention period, which types are kept, largest file | Run the Addon | The site's addon settings | Until changed |
The Addon adds no cookies, no database tables and no front-end code. Visitors of the website are not affected by it at all.
4. Data sent anywhere
None. The Addon makes no network requests. If the site stores the trash on a cloud disk (for example Amazon S3, which the site configures in Laravel), the files go to that disk under the site's own agreement with its provider.
5. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, site address and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations, for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Licences: licences are sold through the Statamic Marketplace on statamic.com. Statamic handles the checkout, taxes, receipts, licence keys and refunds under its own terms, and payments to us go through Stripe. We receive the information Statamic gives sellers about a sale, such as the buyer's name or company, email address, the licence and the amount.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
Statamic itself checks licence keys with statamic.com. That is part of Statamic, not of the Addon, and is covered by Statamic's own privacy policy.
6. Roles and legal basis
For data handled by the Addon on the site's server, the site operator decides why and how it is used and is the controller. We do not process the site's personal data: the Addon sends us nothing and we have no access to the site's server.
For our own data (support requests and sales records) we are the controller. The legal basis is our contract with you, our legitimate interest in running and supporting the Addon, and legal obligations (bookkeeping).
7. Sub-processors and recipients
We use no sub-processors for site data, because we receive none. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum. Statamic and Stripe handle sales and payments under their own terms.
8. International transfers
Site data stays where the site stores it. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
9. Retention and deletion
- Items in the trash are deleted for good when their retention period ends, by Laravel's scheduler once a day and whenever the trash is opened. A retention period of 0 keeps items until the trash is emptied.
- Anyone with the "Delete items forever and empty the trash" permission can delete single items or empty the trash at once.
php please trash:purge --alldoes the same from the command line. - The site can stop keeping certain types, collections or forms, or switch the Addon off with
STATAMIC_TRASH_ENABLED=false. - Removing the Addon leaves the trash folder in place. Delete the folder to remove what it holds.
10. Security
The trash is stored outside the public web folder by default. In the Control Panel, users see only items they were allowed to see before deletion, restoring needs the same right as creating that kind of item, and only a super admin can restore a super admin. Password hashes, passkeys and two-factor secrets of users are never kept. Files are previewed with headers that stop the browser from running them.
11. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For data on a website that uses the Addon, please contact the operator of that website first, because we have no access to it. For our own data contact support@karelialabs.atlassian.net.
Site operators who receive an erasure request can delete the person's items from the trash with Delete Forever, or keep form submissions and users out of the trash altogether in the settings.
12. Children
The Addon is a tool for website operators and is not directed at children.
13. Changes
We will update this policy when the Addon's data handling changes and publish the new version with a new date. Material changes are announced in the changelog.