This Privacy Policy explains how WP SelfOps collects, uses, stores and shares information when you visit wpselfops.com or use the WP SelfOps application, the WP SelfOps WordPress plugin and related services (together, the “Service”).
The Service is operated by María Constanza Rissi (“WP SelfOps”, “we”, “us”), Libertad 458, Quilmes (CP 1878), Buenos Aires, Argentina. Privacy questions and data-rights requests: privacy@wpselfops.com. General support: support@wpselfops.com.
The Service is intended for business use by adults. You must be at least 18 years old to create an account.
1. Two roles: our own processing and processing on your instructions
Please distinguish between two kinds of processing:
- A) WP SelfOps as the responsible party. We decide how to process the information needed to run your account, provide and secure the Service, communicate with you and handle billing. Sections 2 to 4 describe this processing.
- B) Merchant data processed on your instructions. When you connect a WordPress site, a WooCommerce store, Google Analytics 4 or Google Search Console, you (the site or store operator) decide which sources to connect and which questions to ask. We process the resulting data only to provide the functionality you request. This may include personal information about your own customers and visitors, for which you remain responsible. Section 5 describes this processing; our Data Processing Agreement sets out the related commitments.
2. Information we collect for your account and the Service
- Account and profile information: name, email address, preferred language, plan and account settings.
- Authentication: if you register with a password, we store it only as a one-way cryptographic hash. If you sign in with Google, we receive your Google account email and basic profile information and store a session reference; we never receive your Google password.
- Consent evidence: when you accept our Terms and this Policy at registration, we record the accepted version, the date and time and the method of acceptance.
- Connected WordPress sites: site URL, site name, plugin version, connection status, plugin and theme inventory, WordPress and PHP versions, health and performance signals, diagnostics and, when you request it, the content of specific configuration files needed to diagnose an issue. Each site is protected by a site API key that we store only in hashed form.
- Integration credentials: the tokens and keys you authorise us to use (Google OAuth tokens, WooCommerce REST API keys, cPanel API tokens). These are stored encrypted at the application level, are never shown in the browser after entry, and are deleted when you disconnect the integration.
- Support communications: messages you exchange with our in-app support assistant, support cases you escalate, emails you send us, and the requests you submit through our public request forms (including the consumer-protection request forms), together with the reference IDs we issue.
- Subscription and billing identifiers: your plan, subscription status, renewal dates and the customer, order and subscription identifiers issued by our Merchant of Record, Lemon Squeezy, together with the billing event notifications it sends us. We do not receive or store payment-card numbers.
- Operational telemetry and diagnostics: usage counters (for example AI queries per day), feature usage, error and performance logs of the Service, and the technical result of operations you run.
- Security and audit information: records of sign-ins, administrative actions, changes applied to your sites through the Service, backups created before a change, rollbacks, and security-relevant events. Our infrastructure and hosting providers may also process technical connection data such as IP addresses and browser type in server logs.
3. How we use this information
- To create and administer your account, authenticate you and keep your session secure.
- To provide the Service: monitoring, diagnostics, answers, recommendations and the operations you explicitly request.
- To manage plans, entitlements, renewals and billing through Lemon Squeezy.
- To answer support requests and consumer-protection requests, and to keep a record of them.
- To protect the Service and its users: detecting abuse, enforcing limits, investigating incidents and keeping audit trails.
- To send service communications (security notices, billing notices, changes to these terms). We do not send marketing email without your consent.
- To comply with legal obligations, including tax and invoicing obligations in Argentina.
We do not sell personal information and we do not use your data or your sites’ data to build advertising profiles.
4. Cookies and similar technologies
WP SelfOps application (app.wpselfops.com). The application uses browser storage to maintain authenticated sessions and remember user preferences. Its storage and cookie practices are separate from those of the public marketing website.
Public website (wpselfops.com). The website uses CookieAdmin to manage cookie consent. When you first visit, a banner allows you to Accept All, Reject All, or Customize your preferences. Your choice is stored in a first-party cookie named cookieadmin_consent for up to 365 days.
Analytics cookies. With your consent, we use Google Analytics 4, provided by Google LLC, to measure website visits, understand visitor interactions, and evaluate website performance. Google Analytics may set first-party cookies, including _ga and _ga_KXETEFJHWL, which can remain active for up to 400 days. Analytics information, including pseudonymous identifiers and usage events, is transmitted to Google and may be processed in the United States.
Your choices. Until you consent to analytical cookies, the Google Analytics tracking script is blocked. If you reject optional cookies or disable analytical cookies, Google Analytics remains blocked. You can change or withdraw your consent at any time by clicking the cookie preferences icon displayed in the bottom-left corner of the website.
We do not currently use advertising cookies or session-recording technologies on the public website.
Third-party services you visit through external links, such as Lemon Squeezy checkout or Google sign-in, operate under their own privacy and cookie policies.
5. Merchant data processed on your instructions
Depending on what you connect, we may process on your behalf:
- WordPress site data: pages, posts and media inventory, plugin and theme state, configuration relevant to performance, caching, SEO and security, and the outcome of operations you authorise.
- WooCommerce merchant and store information: store URL and configuration, products, inventory levels, orders, revenue figures and commercial aggregates.
- WooCommerce end-customer information: to provide business intelligence such as top customers, order history and stock risk, we may process customer names, order details and commerce aggregates. Customer email addresses are processed in masked form in these analytics. We do not contact your customers.
- Google Analytics 4: read-only aggregated traffic, acquisition and engagement metrics for the properties you select.
- Google Search Console: read-only search performance data (clicks, impressions, queries, pages) for the properties you select.
We process this data only to answer your questions, produce insights and recommendations, and carry out the operations you request. Data fetched from an integration is deleted when you disconnect that integration or delete the site.
Google API data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide and improve user-facing features of the Service that are visible to you, is not used for advertising, and is not transferred to third parties except as necessary to provide those features, for security purposes or as required by law.
Additional WordPress and WooCommerce Data Processing
When a WordPress site is connected to WP SelfOps, the Service may process additional diagnostic and operational information as part of its monitoring, troubleshooting, and authorized automation capabilities.
WordPress diagnostic logs: WP SelfOps may process excerpts of the WordPress debug log (wp-content/debug.log) for troubleshooting purposes. These excerpts may contain file paths, error details, and information included in logged application errors.
Comment management: When a user explicitly requests an authorized comment-cleanup operation, WP SelfOps may process relevant comment metadata, including comment IDs, author names, dates, and moderation status.
WooCommerce analytics: WP SelfOps may process order line items, purchased products, and customers’ billing country and state or region to provide sales analytics, geographic insights, and business recommendations.
Customer email addresses are masked in the relevant WooCommerce data collection flows. Street addresses, telephone numbers, and payment details are not intentionally collected through those flows.
This information is processed to deliver the requested Service functionality, subject to the applicable security controls, retention practices, and Data Processing Agreement.
6. AI processing
WP SelfOps uses third-party large language models to interpret your questions, reason over the data you have connected and draft answers, recommendations and support replies. When you ask a question, the text of your question together with the relevant context (for example site health signals, store aggregates, analytics figures or search-performance figures) is transmitted to the AI model provider for processing. We send only the context reasonably needed to answer. Integration credentials and payment information are never sent to AI models.
The AI model provider processes the transmitted text to generate the response. We have not yet confirmed the provider-specific retention period, if any, that applies to prompts and responses, and we therefore do not claim “zero data retention” for AI processing. We will update this Section when those terms are confirmed.
AI output is informational. It may be incomplete or inaccurate, and it is labelled with its data provenance where possible. Operations that change your site are never executed by the AI on its own; they require your explicit confirmation as described in our Terms.
7. Third parties that process information for us
We share information only with service providers that help us operate the Service, and only for the purposes described above:
- Emergent — application hosting, infrastructure and integration services (including routing of AI requests).
- OpenAI — AI model processing of questions and context, as described in Section 6.
- Google LLC — Google sign-in, Google Analytics 4 API and Google Search Console API when you connect these services. We also use Google Analytics 4 on the public WP SelfOps website to measure traffic and visitor interactions, subject to the visitor’s consent to analytical cookies. Analytics information may be processed on Google’s infrastructure, including in the United States.
- Brevo — transactional and support email delivery, including delivery-status notifications.
- Lemon Squeezy — Merchant of Record for checkout, payment processing, invoicing to the payer, taxes on the sale and subscription management. Lemon Squeezy processes your payment-card information under its own privacy policy; WP SelfOps never stores card details.
We may also disclose information when required by law or a competent authority, to protect the rights and safety of WP SelfOps and its users, or in connection with a transfer of the business, in which case this Policy will continue to apply to the transferred information.
8. International processing
WP SelfOps is operated from Argentina. The WP SelfOps application and its database are hosted by our infrastructure provider, Emergent, in the United States (Google Cloud, us-central1 region). Emergent’s platform operations may also involve processing in the United States and India, and the other providers listed in Section 7 (OpenAI, Google, Brevo, Lemon Squeezy) may process information in the United States or other countries where they operate. Emergent publishes its own data-processing terms and subprocessor list; we are currently completing the incorporation of those terms and the standard contractual safeguards applicable to transfers, and we do not claim that any specific transfer instrument is in force until that process is complete.
Where the personal information of people in Argentina is transferred abroad, we rely on the recipient providing an adequate level of protection or on appropriate contractual safeguards, as permitted by Argentine data-protection law. We do not claim compliance with, or certification under, any specific foreign regime (such as the GDPR or SOC 2 / ISO standards). We will update this Section when the pending documentation is complete.
9. Security
We apply technical and organisational measures appropriate to the nature of the data, including encrypted transport (HTTPS), hashed passwords and site keys, application-level encryption of integration credentials, per-account data isolation, role-based administrative access and audit logging. No system is completely secure; if we become aware of a security incident affecting your information we will inform you without undue delay and provide the information reasonably needed for you to meet your own obligations.
10. Retention and deletion
- Account data is kept while your account is active.
- Integration data (tokens and fetched data) is deleted when you disconnect the integration or delete the site.
- Account deletion: you can request deletion at any time by writing to privacy@wpselfops.com from your account email. We will verify the request and then run our deletion routine, which removes your profile, sites, integrations, connected-data snapshots, conversations, insights and preferences from our active systems.
- What we keep after deletion: billing records and the transaction notifications received from Lemon Squeezy (for tax and accounting obligations), pseudonymised security and audit logs, and records of consumer-protection or privacy requests, for as long as the applicable legal obligation or limitation period requires.
- Backups: our infrastructure provider keeps rolling backups of the application database (hourly backups retained 7 days, daily 7 days, weekly 4 weeks, monthly 12 months and yearly 1 year, plus 7-day point-in-time recovery). Data you delete therefore persists in those backups until each backup generation expires under that schedule. The physical storage location of the backups and the exact timeline for deletion from every backup generation have not yet been confirmed to us; we cannot guarantee immediate removal from backups.
11. Your privacy rights
Subject to applicable law, you may request access to the personal information we hold about you, its correction, updating or deletion, and you may object to or ask us to restrict certain processing. You can update most account information directly in the application and disconnect integrations at any time.
To exercise a right, write to privacy@wpselfops.com from the email address associated with your account. We may ask for reasonable additional information to verify your identity. We aim to respond within the time frames required by applicable law and in any case within a reasonable period.
Under Argentina’s Personal Data Protection Law No. 25,326, the Agencia de Acceso a la Información Pública, in its role as supervisory authority, has the power to handle complaints and claims from data subjects whose rights have been affected by a breach of data-protection rules.
If you are a customer or visitor of a merchant that uses WP SelfOps, please direct your request to that merchant first; we will assist them in responding as described in our Data Processing Agreement.
12. Changes to this Policy
We may update this Policy to reflect changes in the Service or in applicable law. We will post the updated version with a new effective date and, for material changes, notify you by email or in the application before they take effect.
13. Contact
WP SelfOps — María Constanza Rissi
Libertad 458, Quilmes (CP 1878), Buenos Aires, Argentina
Privacy: privacy@wpselfops.com · Support: support@wpselfops.com