WPAuditor Privacy Policy: Website, Plugin & AI Data

This Privacy Policy explains how WPAuditor ("WPAuditor," "we," "us," or "our") handles information when you visit our website, contact us, purchase or license WPAuditor, or use the WPAuditor WordPress plugin. It also explains how security data remains inside your WordPress environment and when optional features send data to third-party services.

Who We Are and Scope: WPAuditor provides WordPress security visibility, investigation, and response software and operates from 220, 5 Begum Rokeya Avenue, Dhaka, Bangladesh. This policy covers wpauditor.app, related forms and licensing services, and the WPAuditor plugin. For privacy questions, requests, or the legal identity of the applicable operator or data controller, email [email protected] or write to the address above.
Information Collected Through Our Website: When you visit the website, servers and integrated services may process your IP address, browser and device information, referring page, pages viewed, approximate location, timestamps, and diagnostic or security data. If you request a demo, we collect your first and last name, email address, website, and submission details. If you submit an agency enquiry, we collect your business name, business email, country, estimated license requirement, and submission details. If you contact us through chat or email, we process the information you choose to provide.
Purchases, Licenses, and Updates: Checkout, payment, tax, and transaction data are handled by Lemon Squeezy. We may receive order, customer, product, license, and transaction details needed to deliver and administer your purchase. License activation, validation, and update requests may transmit a license key, site URL or domain, instance identifier, product or plan information, plugin version, request IP address, and technical status data to WPAuditor's licensing or update service. We use this information to activate licenses, verify entitlements, deliver updates, prevent abuse, and maintain transaction records.
Security Data Processed by the Plugin: WPAuditor may process security events, IP addresses, request and source context, login or administrative activity, session information, file metadata and changes, risk scores, and response actions to provide its security features. In WPAuditor Free, this security data is processed and stored within the WordPress environment where the plugin is installed and is not sent to WPAuditor for licensing, analytics, AI, Cloudflare synchronization, or external updates. WPAuditor Pro also keeps security data locally by default, but license activation and official update checks communicate with WPAuditor services as described above. Optional Pro features may send selected data to an administrator-configured AI provider, synchronize selected IP blocklist data with the administrator's Cloudflare account, retrieve operational resources such as current Cloudflare IP ranges, or deliver administrator-configured notifications. The website owner or operator controls local plugin data, its retention, access, optional integrations, and lawful use and should describe this processing in its own privacy notice where required.
AI Analyst and External AI Providers: AI Analyst is optional and works only after a site administrator configures and uses an available AI provider. When used, prompts and relevant security-event, session, log, or investigation context may be sent to the provider selected by the administrator. Requests are generally sent from the WordPress site to that provider using the administrator's configured credentials. Provider terms, privacy practices, data location, and retention rules apply independently. AI configuration, cached responses, and analysis history may remain in the WordPress database until cleared or removed according to plugin settings. Administrators should avoid sending unnecessary personal or confidential information and should confirm that their chosen provider is appropriate for their legal and security requirements.
Cookies, Local Storage, and Embedded Services: The website uses browser local storage to remember theme and privacy choices and may use cookies or similar technologies. Essential preferences and security functions may operate without optional-service consent. Tidio provides live chat, and embedded Google Maps displays our location. These optional services load only after you accept them through our privacy choices control. Cloudflare Turnstile is used as a form-security measure when you choose to submit a protected form. These providers may process identifiers, IP addresses, device or browser information, interactions, and cookie data under their own policies. You can accept or reject optional services when first visiting the website and later change that choice using the “Privacy Choices” control in the footer. Browser and device controls may provide additional restrictions, although some embedded features may work differently. WPAuditor does not currently load Google Analytics or Meta Pixel on this website.
How and Why We Use Information: We use information to operate and secure the website; respond to enquiries; arrange demos; evaluate agency licensing requests; process purchases; activate and validate licenses; deliver eligible updates; detect fraud or abuse; measure website performance and marketing; maintain records; enforce our terms; and comply with legal obligations. We do not use locally stored WordPress security-event data unless a feature you choose requires transmission or you intentionally provide that data to us.
Legal Bases: Where data-protection law requires a legal basis, we rely on performance of a contract for purchases, licensing, and requested services; legitimate interests in operating, securing, measuring, and improving our services; consent for non-essential technologies or communications where required; and compliance with tax, accounting, legal, or regulatory obligations. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
When Information Is Disclosed: We may disclose relevant information to service providers that support payments and licensing, hosting and security, live chat, forms, maps, email, and professional services. Current website integrations include Lemon Squeezy, Tidio, Cloudflare Turnstile, and Google Maps. We may also disclose information when required by law, to protect rights or safety, to investigate abuse, or as part of a merger, acquisition, financing, or transfer of business assets. Providers process information under their own terms and privacy notices.
Sale, Sharing, and Advertising Choices: We do not sell personal information for money and do not currently use Meta Pixel or similar advertising pixels on this website. If analytics or advertising technologies are introduced later, this policy and the website's privacy controls will be updated before those technologies are enabled where consent or notice is required. Depending on your location, you may have the right to object, opt out, or ask us to limit applicable processing. You may contact us to exercise an applicable right and can also use browser privacy controls, cookie blocking, or provider account settings.
International Data Transfers: WPAuditor and its service providers may process information in Bangladesh, the United States, the European Economic Area, or other countries. Those countries may have different privacy laws. Where required, the relevant organization is responsible for using an approved transfer mechanism or other appropriate safeguards.
Data Retention: We retain enquiry and contact information while responding to a request and afterward only while reasonably needed for follow-up, an ongoing business relationship, dispute handling, security, or legal obligations. Demo and agency submissions are reviewed periodically and should be deleted or anonymized when they no longer serve those purposes. Purchase, transaction, and license records are retained for the duration of the customer relationship and afterward for the periods required by applicable tax, accounting, fraud-prevention, contract, and legal rules. Short-term rate-limit records are kept only for the applicable rate-limit window. Chat, payment, and other providers apply their own documented retention settings and rules. Security logs and AI history stored by the plugin remain under the site owner's control and applicable WPAuditor settings. We apply purpose, legal, security, dispute, and technical requirements when deciding a retention period and delete or anonymize information when those requirements end, unless continued retention is required or permitted by law.
Security: We use reasonable technical, administrative, and organizational safeguards appropriate to the information we process. Customers are responsible for securing their WordPress environment, administrator accounts, hosting, backups, API credentials, and access to WPAuditor data. No transmission, storage system, security product, or response measure can be guaranteed completely secure.
Your Privacy Rights: Depending on your location, you may have rights to access, correct, delete, restrict, or receive a copy of personal information; object to or opt out of certain processing; withdraw consent; and complain to a data-protection authority. To submit a request, email [email protected]. We may need to verify your identity and may retain limited information where the law permits or requires it. If the requested data is stored only in a customer's WordPress installation, please contact that site owner because WPAuditor does not control that installation.
Children's Privacy: WPAuditor is a business and website-security product and is not directed to children under 13 or a higher minimum age where local law requires one. We do not knowingly collect personal information from children through our website. If you believe a child has provided information to us, contact us so we can review and, where appropriate, delete it.
Policy Changes: We may update this Privacy Policy as our product, providers, or legal obligations change. The revised policy will be posted on this page with a new effective date. Material changes may also be communicated through the website, plugin, or available contact information when appropriate.
Contact: Questions, complaints, and privacy requests can be sent to [email protected]. Please describe your request clearly and identify the website, purchase, license, or communication involved so we can locate the relevant information.