Data about your FlitAgent use is kept in three places: on your site, on flitagent.com and at your AI app’s provider.
On your site
In FlitAgent’s own database tables and settings:
- Change requests, approvals and receipts: the tool, its arguments, the result, the values before and after, the user, the AI app and the time.
- Settings: Access for AI tools, auto-approve, approval expiry and the uninstall choice.
- The connection to flitagent.com: connection ID, a masked account email address, the access, when it was connected and flitagent.com’s public keys.
- The AI apps that reached the site, at most 20: app ID, name, access, when each was first and last seen and the connection, and the AI tools you disconnected. Nothing from the requests themselves.
It holds no tokens or passwords for your AI apps. What deleting the plugin removes: Disconnect and uninstall.
On flitagent.com
- Your account: email address, password hash and when you registered.
- Your sites: address, access, connection ID, when each was connected and last reached, the last error, and the site name and FlitAgent, WordPress and PHP versions the site reports.
- Your AI apps: name, the addresses it registered, when it connected and was last used, and its tokens.
- Usage records: for each tool call the account, site, app, tool, whether it reads or writes, the outcome, the duration and the sizes. No arguments, no results and no IP address. Kept for 90 days, and daily totals for 25 months.
- Abuse limits: to limit repeated requests to the account forms, connections, AI app logins, downloads and the contact and newsletter forms, a hash of your IP address (and, on account forms, of your email address) in temporary storage, deleted within about a day.
- Server logs: our host keeps standard server logs, which include IP addresses and browser details, for a period set by the host.
Tool calls and their results pass through flitagent.com in transit only. Everything flitagent.com keeps, and for how long, is in Privacy.
At your AI provider
What your AI app reads from the site, and what it asks to change, goes to the app’s provider, for example OpenAI or Anthropic, under that provider’s terms. Read tools such as wp_rest_get, get_user_meta and get_post_meta return what WordPress gives the administrator who connected the site. That can include the names, email addresses and postal addresses of your customers and users, and it goes to the provider too. Values under secret-looking names, such as passwords, keys and tokens, are masked. list_orders also masks customer names and email addresses; do not count on that for other tools.
Your controls
- Keep a site read only: pick Read only when you approve the site on flitagent.com, or later under Access for AI tools in FlitAgent → Settings.
- Stop one tool, one app or the whole site: Disconnect and uninstall.
- Delete your account: Your flitagent.com account.
- Ask for an export or erasure of your data: write to hello@flitagent.com.