Privacy Policy

Last updated: June 18, 2026

WPPilot ("we," "our," or "us") is an AI consultant for WordPress sites operated by WPPilot. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data.

We've tried to write this in plain English. If anything is unclear, contact us at privacy@getwppilot.com.

1. Who this policy applies to

This policy applies to:

  • Visitors to our marketing website at getwppilot.com
  • Users of the WPPilot service, accessed through our web application at app.getwppilot.com
  • WordPress site owners who install and use the WPPilot plugin to connect their site to our service

If you install the WPPilot plugin but never connect your site to our service, we don't receive any data from your site.

2. What information we collect

2.1 Information you give us directly

When you sign up for WPPilot or connect a WordPress site, we collect:

  • Account information — your email address, and authentication credentials we issue
  • Site connection metadata — the URL of the WordPress site you connect, the plugin version installed, and the connection token used to authenticate your site to our service
  • Communications — if you contact us for support, we keep a record of the conversation

2.2 Information collected from your connected WordPress site

When you connect a WordPress site to WPPilot, our backend reads (with your authorization, via the plugin) certain information from that site to provide the service:

  • Content — posts, pages, custom post types, and their metadata (titles, excerpts, publication dates, authors)
  • Site configuration — installed themes and plugins (names, versions, settings), WordPress version, server environment summary
  • Files — file paths, sizes, modification times, and cryptographic hashes used by our security scanning. We do not store the full contents of every file; we store the metadata needed for change detection and threat analysis.
  • Public-facing snapshots— a rendered screenshot of your site's homepage, used for visual analysis
  • Activity events — WordPress events such as logins, content edits, plugin changes, and theme switches, streamed to our backend for the live activity feed and security monitoring

We do not read or store:

  • WordPress user passwords
  • The personal data of your site's visitors (other than what's necessarily included in pages we render or content you've published)
  • Payment processor data or other sensitive customer data your site may handle

2.3 Information from Google services (Google Analytics integration)

If you connect Google Analytics to WPPilot, we access your Google Analytics data using the analytics.readonly scope. This is read-only access. We never modify your Google Analytics configuration.

We store:

  • An encrypted OAuth refresh token, used to query Google Analytics on your behalf
  • A daily summary of aggregate analytics data for the connected property, used to generate your Briefing and answer questions in chat. The summary includes total sessions, total users, average bounce rate, top pages, top traffic sources, and conversion event counts.

We do not store individual visitor data, IP addresses, user IDs, or any other personally identifiable visitor information from your Google Analytics property. We work only with aggregate metrics.

WPPilot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.4 Information collected automatically

When you use the WPPilot marketing site or web application, we automatically collect:

  • Usage data — pages visited, features used, timestamps, approximate location derived from IP address
  • Device information — browser type and version, operating system, screen resolution
  • Cookies and similar technologies — used for authentication, session management, and remembering your preferences. We do not use third-party advertising cookies.

3. How we use your information

We use the information we collect to:

  • Provide the service — generate Briefings, run security scans, power conversational chat with your site, and execute actions you approve
  • Operate the integrations you've connected — query Google Analytics on your behalf, surface insights in your Briefing
  • Improve the product — analyze how the service is used in aggregate so we can prioritize improvements
  • Communicate with you — respond to support requests, notify you of important changes to the service, send you account-related messages
  • Maintain security — detect and respond to threats against your site and our service
  • Comply with legal obligations

We do not sell your data. We do not share your data with advertisers. We do not use your data to train AI models that are then offered to other customers.

4. AI processing and third-party AI providers

WPPilot's core functionality is powered by AI. To deliver this functionality, we send relevant data from your connected site to AI providers — primarily Anthropic (the maker of Claude). This processing is necessary to provide the service you've signed up for.

What gets sent to AI providers:

  • Content and metadata from your site, as needed to compose a Briefing or answer a chat question
  • Visual analysis screenshots of your homepage
  • Aggregate Google Analytics summary data, if you've connected GA
  • Your chat messages

Our AI providers do not retain your data for training their models and do not share your data with other customers. Anthropic's data handling for the API is documented at https://www.anthropic.com/legal/commercial-terms.

If you do not want your data processed by AI providers, you should not use WPPilot — AI processing is the core of the service.

5. Who we share your information with

We share information only as needed to operate the service:

  • Infrastructure providers — our hosting and infrastructure providers (including Railway for backend hosting, Vercel for the marketing site and web application, and Cloudflare for content delivery and storage)
  • AI providers — primarily Anthropic, as described above
  • Google— when you've connected Google Analytics, we communicate with Google's APIs to retrieve your analytics data
  • Service providers — providers we engage to help us deliver the service (for example, email delivery, error tracking, customer support tooling)
  • Legal authorities — if required by law, court order, or government regulation, and only to the extent legally required
  • Business transfers — if WPPilot is acquired, merged, or undergoes other corporate change, your data may transfer as part of that transaction. We will notify you and provide options if this happens.

We do not share your data with any party for their independent marketing or advertising purposes.

6. Where your data is stored

WPPilot uses infrastructure providers that operate data centers in multiple regions. Your data is primarily stored in the United States and the European Union, depending on the region your infrastructure provider assigns. If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, your data may be transferred to and processed in countries outside your region, including the United States.

We rely on the following legal mechanisms for international transfers:

  • The European Commission's standard contractual clauses
  • Adequacy decisions where applicable
  • Your explicit consent, where required

7. How long we keep your data

We keep data for as long as needed to provide the service to you and for legitimate business purposes, then we delete it.

  • Account data — kept while your account is active; deleted within 30 days after account closure
  • Site content and metadata — kept while the site is connected to WPPilot; deleted within 30 days after disconnection
  • Briefings and chat history — kept while your account is active; deleted with the account
  • Google Analytics tokens and summaries — kept while the integration is connected; deleted within 7 days of disconnection or token revocation
  • Activity events and security logs — kept for up to 90 days for security and audit purposes
  • Backups — may persist for up to 90 days after the live copy is deleted, then purged
  • Aggregate, de-identified analytics about service usage — may be kept indefinitely

If you want your data deleted sooner than these defaults, contact us at privacy@getwppilot.com.

8. Your rights

Depending on where you live, you have certain rights over your data. These include:

  • Access — you can request a copy of the data we have about you
  • Correction — you can request that we correct inaccurate data
  • Deletion — you can request that we delete your data (subject to legal and operational exceptions)
  • Portability — you can request your data in a portable format
  • Restriction or objection — you can ask us to limit or stop certain processing of your data
  • Withdrawal of consent — where processing relies on your consent, you can withdraw it at any time

To exercise any of these rights, contact us at privacy@getwppilot.com. We will respond within 30 days.

8.1 Specific rights for European users (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights above under the General Data Protection Regulation (GDPR) and equivalent laws.

The legal bases on which we process your data are:

  • Performance of a contract— to deliver the service you've signed up for
  • Legitimate interests — to operate, secure, and improve the service
  • Consent — for optional features such as marketing communications
  • Legal obligation — where required by law

You also have the right to lodge a complaint with your local data protection authority.

8.2 Specific rights for California users (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act including the right to know what personal information we collect, the right to delete it, and the right to opt out of sale (we do not sell personal information).

9. Children's privacy

WPPilot is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at privacy@getwppilot.com and we will delete it.

10. Security

We protect your data with industry-standard security measures, including:

  • Encryption in transit (TLS 1.2 or higher) for all data exchanged with our service
  • Encryption at rest for sensitive data, including OAuth refresh tokens
  • Access controls that limit which staff can access your data, and only when necessary
  • Regular security monitoring of our infrastructure
  • The WPPilot plugin uses HMAC-signed requests to authenticate communication with our backend

No security system is perfect. If we discover a security incident affecting your data, we will notify you in line with applicable law.

11. The WPPilot plugin

The WPPilot plugin installed on your WordPress site is a lightweight connector. It:

  • Authenticates the WordPress site to our backend using a connection token you generate during the one-click authorize flow
  • Reads data from your site (as described in section 2.2) on request from our backend
  • Streams WordPress activity events to our backend
  • Does not store our service credentials in plain text on your site
  • Can be deactivated at any time, which severs the connection between your site and our service. After deactivation, our service will receive no further data from your site.

When you deactivate or uninstall the plugin, the plugin removes itself cleanly: no residual database tables, no leftover files, no orphaned cron jobs.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the service before the changes take effect. The "Last updated" date at the top of this policy reflects the most recent version.

13. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us: