Get PowerWP

Data and privacy

What stays on your site, what your AI app sees, what the update service receives, where backups are kept, and what deleting the plugin removes.

Updated 29 October 2026

PowerWP AI keeps its working data on your own site. The only contact it has with PowerWP is the update and license check, and that check carries no content, orders or customers. What your AI app does with the results it receives is up to that app.

What stays on your site#

  • Your content, orders and customers stay in your WordPress database, as they always did.
  • PowerWP AI's own records are kept in database tables whose names start with wpai_mcp_ after your table prefix: connections (key hashes only), the activity log, the change log and checkpoints, sign-in records, and the site memory and recipes.
  • Snapshots and backups are kept in a private folder on your server. A snapshot holds the earlier state of whatever was changed, so it can contain personal data if you changed orders or users.
  • Backups are built on the server and downloaded to your computer. The server copy is deleted once the download is confirmed. If you never download it, it is deleted after 48 hours by default.

What your AI app sees#

An AI app sees what the tools return, and nothing else. Some tools filter what they return:

  • wc_order_inspect keeps personal data out unless the call asks for full_address=true. The customer e-mail is masked, and the IP address, browser, names, street, city and postcode are left out.
  • Passwords, keys and license keys are masked unless the connection has the Secrets permission. db_query also masks license-key and serial columns.

Other read tools return what is asked for. With the always-granted Read & diagnostics permission, an app can read orders, customers and users through tools such as rest_request, db_query and users_list. Give each connection only the permissions it needs, and ask your AI app to read only what the task needs.

Important

Everything a tool returns reaches your AI app, and that app's own terms and privacy policy apply to it. PowerWP AI cannot see or control what an AI app does with the data it receives. Read your AI app's data policy before you let it read orders or customer data. Local models, for example in LM Studio, run on your own computer.

What the update service receives#

PowerWP AI connects to the PowerWP update service at api.powerwp.ai to deliver plugin updates, to check your license and to count the sites that use PowerWP AI.

  • When: once a day, when WordPress checks for updates, when the plugin is activated, updated, deactivated or deleted, and when you activate or deactivate a license.
  • What is sent: a random installation id (on a copied site also the id of the installation it was copied from), why it reports (for example the daily check, an update or a deactivation), the site and home address, the site name, the versions of PowerWP AI, WordPress, WooCommerce, PHP and the database server, the active theme, the web server software, the site language, whether it is a multisite, the environment set in PowerWP AI (production, staging or development) and the edition (pro with an active paid license, otherwise free). Once you activate a license, its key is sent too. The service sees the server's IP address but does not store it.
  • Never sent: content, customers, orders, users, connection keys, logs or anything about AI activity.
  • What it can do: nothing on your site. It can only offer a new version, and WordPress installs it only when its signature matches the PowerWP release key built into the plugin.

The same description is shown in Settings › Updates & privacy. See also the privacy policy.

The activity log#

The activity log records each request: which connection and administrator, the IP address and user agent, the tool, its arguments with secrets redacted, a short preview of the result and how long it took. Under Settings › Activity log, Log retention sets how long entries are kept (60 days by default), and Store response previews switches the result previews off.

Where snapshots and backups are stored#

By default, PowerWP AI creates a folder named like wp-content/wpai-mcp- plus a random suffix, with subfolders for snapshots, backups, restores and transfers. It is protected by deny rules and index files, and the dashboard tests whether the web server honors them. Snapshots are kept for 30 days by default (Rollback window) within a storage cap of 2048 MB (Snapshot storage cap).

To keep them outside the web root, which is the recommended setup, define a folder in wp-config.php:

define( 'WPAI_MCP_STORAGE_DIR', '/var/www/private/wpai-mcp' );

On nginx, which ignores the protective .htaccess files, add this rule to the server block, or use the constant above:

location ~* /wp-content/wpai-mcp-[a-z0-9]+/ { deny all; }

What deleting the plugin removes#

Deleting the plugin from the Plugins screen runs a clean-up. It also gives the license's place on this site back and sends one last report to the update service. Under Settings › Uninstall, Delete all data on uninstall decides the rest, and it is on by default.

  • On: the plugin removes its tables (connections, site memory and recipes, activity log, change history and sign-in records), its settings and the private folder with snapshots and backups.
  • Off: your data stays, but every connection is revoked, so a key never outlives the plugin.

The site memory and your own recipes are not part of site backups. Export them from PowerWP AI › Memory first if you want to keep them.

Privacy policyHow PowerWP handles personal data.Security modelThe layers that limit access.Backups and restoreCreate, download and restore backups.
↑↓ moveEnter open