Privacy policy
Last updated :
This describes what the service actually does with your data. The controller is KIPDEV SAS, reachable at yohann@kipdev.io.
What we keep
| Data | Why | Legal basis |
|---|---|---|
| Email, name, password (bcrypt hash) | Create and secure your account | Performance of the contract |
| Your WordPress site addresses, API key id and secret | Talk to your site on your behalf | Performance of the contract |
| Activity log: action, resource, timestamp, IP address | Let you check what was done to your site | Legitimate interest (traceability, security) |
| Agent conversations and tool results | Give you the history and let the agent follow the thread | Performance of the contract |
| Scheduled tasks and their runs | Run what you scheduled | Performance of the contract |
| Stripe customer and subscription ids, usage counters | Billing and quota enforcement | Contract, accounting obligation |
Your API key secret
That secret signs every request we make to your site: it is equivalent to access to your WordPress. It is encrypted at rest with AES-256-GCM and is never sent back to your browser, not even in your own account pages. You can revoke it at any time from the plugin, on the WordPress side: revocation takes effect immediately and does not depend on us.
The free plan sends nothing to an AI model
This is a difference in processing, not a sales line. The Discovery plan reads your site and shows its audit, which the plugin computes on your own server. No data from your site reaches an AI provider until you subscribe to a paid plan.
On paid plans, the content your request needs — and only that — is sent to Anthropic to be processed by the model.
Who else processes this data
Transfers outside the European Union (Anthropic, Stripe) rely on the European Commission’s standard contractual clauses.
| Sub-processor | Role | Where |
|---|---|---|
| Hostinger International Ltd | Hosting of the service and database | Paris, France |
| Anthropic PBC | AI model — paid plans only | United States |
| Stripe | Payments and invoicing | Ireland / United States |
| Mailjet (Sinch) | Transactional email | France |
| Kipstats | Audience measurement, no cookie, no profiling | France |
Cookies and analytics
This site sets no advertising cookie and does not use Google Analytics. The only cookie we set is your login session, strictly necessary to operate the service: it needs no consent and ends when you log out.
Audience measurement is done by Kipstats, with no cookie and no individual identifier.
How long
- Account and sites: as long as your account exists, deleted when you close it.
- Activity logs: 7 days on Discovery, 30 days on Solo, 90 days on Agency. Purged automatically.
- Conversations and scheduled tasks: until you delete them, or until the account is closed.
- Invoices: 10 years, as French commercial law requires.
Your rights
You have the right to access, rectify, erase, restrict, object and port your data. Write to yohann@kipdev.io and we answer within 30 days. Deleting your account cascades to your sites, logs, conversations and tasks.
If our answer does not satisfy you, you may lodge a complaint with the CNIL (cnil.fr).
Data breach
If a breach is likely to result in a high risk to your rights, we inform you without undue delay and notify the CNIL within 72 hours.
See also