Privacy & security

This page describes technical behavior. It is not legal advice and not a privacy policy.

What the plugin stores

WordPress options (among others):

• aiwsa_settings — main toggles, appearance, recovery, analytics, language, fallbacks
• aiwsa_provider_settings — provider/model/timeout (not the raw key)
• aiwsa_credentials — encrypted API keys
• aiwsa_prompts — persona/tone/custom
• aiwsa_tool_settings — per-tool enabled flags
• aiwsa_identity_salt — guest identity hashing
• aiwsa_db_version, aiwsa_cache_version

Custom tables prefixed {prefix}aiwsa_* hold conversations, messages, tool calls, usage, analytics, abandoned carts, stock alerts, audit rows (exact names via Table_Names).

Guest identity: salted hashes; raw IP may pass through filter aiwsa_client_ip for hashing — addresses are not stored in plaintext according to settings comments.

Customer data processed

• Chat message text (length-capped, rate-limited)
• WooCommerce cart session
• Order lookups after ownership / guest verify
• Optional recovery email + consent flag
• Optional restock alert email
• Language code on the conversation

Billing addresses are not included in the shopper UI payload.

Data that may be sent to external AI APIs

When a provider is configured: system prompt fragments, recent messages, tool names/args, and tool results (catalog/cart/order summaries the tools returned). Do not put secrets in Custom instructions.

Providers: OpenAI and/or Google Gemini (or your custom allowed HTTPS base URL).

API key storage

AES-256-GCM in aiwsa_credentials, or wp-config.php constants. Admin Test/Remove AJAX never echoes the key back. manage_options required.

WordPress capabilities

Nonces

Widget HTML has no nonce. GET /aiwsa/v1/config mints one (and X-WP-Nonce header). Cookie auth bootstrap keeps logged-in shoppers from being demoted to guests.

Admin AJAX uses nonce action aiwsa_admin.

REST API security

Namespace aiwsa/v1. Permission callbacks per route (aiwsa_rest_permission filter). Confirmations cannot change product/qty in the body. Extra cart fields ignored. Trace header for support.

Config is readable by visitors by design (flags only, no secrets).

Authentication

• Guests: conversation token + nonce
• Logged-in: WordPress cookies + nonce
• Orders: ownership or guest email+number proof

Uninstall

Cron + transients always removed. Tables/options/logs removed only if Delete all plugin data on uninstall is on.

Deactivate ≠ delete data.

Third-party services

• OpenAI and/or Google Gemini when keys exist
• WordPress/wp_mail for recovery and stock alerts
• No bundled analytics SaaS

What this plugin does not do

• No WordPress personal-data exporter/eraser registration in this version
• No wp_ajax_nopriv admin actions
• No API keys in aiwsaBoot