cPFence Thank you for your detailed answer. 🙂
Our software is fully GDPR-compliant. IPs are stored only in the client’s database and are not sent to any third party.
That's not quite right about the IP addresses. Just because the IPs are not shared with third parties, they are still processed and this processing is GDPR relevant.
Since it is not necessary to store the IPs, the IPs may not be stored without the visitor's consent. Of course, one could argue that the storage of IPs is security-relevant and can therefore take place without the visitor's consent. However, even then, storage is not permitted for an unlimited period of time, but may only be as short as possible. In this case, for example, 5 minutes. After that, the IPs would have to be deleted from the database in any case.
Regardless of this, the use must always be mentioned in the privacy policy, even if the IPs are stored anonymously. And this again makes it difficult to activate the plugin by default for all customers.
I just wanted to point this out. Perhaps it would be important to simply document somewhere exactly how the plugin works and when which data is processed, so that everyone can make an informed decision for themselves.
