Privacy Policy

Last updated: August 7, 2026

This Privacy Policy explains what information WP Fleet ("the Service", "we", "us") collects from users of this installation, how it is used, and how it is protected.

1. Information We Collect

When you create an account and use the Service, we collect:

• Account information: name, username, email address, and a securely hashed password (we never store your password in plain text).
• Profile information (optional): profile picture, designation, company website, location (country/state/city), phone number, and social media links you choose to add.
• Connected WordPress site credentials: site URL and WordPress Application Password, encrypted at rest, used only to connect to sites you add.
• FTP/SSH credentials (optional): host, port, username, password/private key, and root path, encrypted at rest, used only for backups and file-based plugin/theme updates on sites you add.
• Third-party API keys you provide (optional): AI provider keys (Anthropic Claude, OpenAI, or Google Gemini), a Google PageSpeed Insights API key, LinkedIn/X OAuth app credentials (client ID/secret), and WhatsApp Cloud API credentials (Phone Number ID and access token) — all encrypted at rest and used only to perform the actions you request.
• OAuth tokens: if you connect a LinkedIn or X account via the Social Accounts settings, we store the access token (and refresh token for X, where applicable) needed to publish content on your behalf, encrypted at rest.
• Activity logs: a record of significant actions on your account (logins, websites added, connection tests, scans, plugin/theme updates, backups, PDF downloads, AI suggestions, social shares) for troubleshooting and audit purposes. Super administrators have read-only access to all users' activity logs.
• Technical data: standard web server logs (IP address, browser type, timestamps) and a session cookie required to keep you signed in.

2. How We Use Information

Information is used to:

• Operate and maintain your account and the Service;
• Connect to the WordPress sites, FTP/SSH servers, and third-party services you configure;
• Generate AI-assisted SEO suggestions and scores (titles, descriptions, and Yoast-style traffic light scores) for the content types on your websites;
• Run Google PageSpeed Insights tests on URLs you specify;
• Publish content to social accounts you connect (LinkedIn and X) and send WhatsApp messages, at your request;
• Perform plugin and theme updates, backups, and fetch RSS feeds for your WP RSS Feed page;
• Send transactional emails (welcome, password reset, website added notifications) using the SMTP settings and email templates configured by the super administrator;
• Maintain security and audit logs for operational and compliance purposes.

We do not sell your information, and we do not use your data for advertising.

3. Third-Party Services

Depending on which features you choose to configure, the Service sends limited data to the following third parties, using credentials you provide:

• AI providers (Anthropic Claude, OpenAI, or Google Gemini) — page content (titles, meta descriptions, excerpts) is sent to generate SEO suggestions and scores, only if you've configured an AI provider and key in your Settings.
• Google PageSpeed Insights — a page URL is sent to run a mobile and/or desktop speed test, only if you've configured a PageSpeed Insights API key and run a test.
• LinkedIn and X (Twitter) — post content (title, description, link) is sent to publish on your connected account, only if you've connected an account via Settings → Social Accounts and chosen to share something from the Post Automation page.
• Meta / WhatsApp Cloud API — message content is sent to deliver a WhatsApp message, only if you've configured WhatsApp credentials (Phone Number ID and access token) in Settings → WhatsApp and chosen to send something.
• The WordPress sites you add — used to read plugin/theme/content data, perform updates, publish posts (via Post Automation), and run SEO reports, using the Application Password you provide.
• WordPress.org API — plugin and theme version information is checked against the public WordPress.org Plugins/Themes API to determine update availability.

Each of these third parties has its own privacy policy and terms governing how it handles data you send it; we encourage you to review them.

4. Data Security

Passwords are hashed with bcrypt and never stored or transmitted in plain text. All credentials and API keys (WordPress application passwords, FTP/SSH passwords and private keys, AI/PageSpeed/social API keys and OAuth tokens, SMTP passwords) are encrypted at rest using AES-256 encryption tied to this installation's application key (APP_KEY). We recommend the operator of this installation serve it over HTTPS and keep the application key confidential and out of version control.

5. Data Retention

We retain account data for as long as your account is active. Activity logs, share history (social shares), and feed item caches are retained to support auditing, troubleshooting, and the operation of the Service. You may request deletion of your account and associated data by contacting the administrator of this installation.

6. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete the personal data we hold about you, and to withdraw consent for optional integrations (AI providers, PageSpeed Insights, social accounts, WhatsApp) at any time by removing the relevant credentials from your Settings pages. To exercise these rights, contact the administrator of this installation.

7. Cookies

The Service uses a single session cookie required for you to stay signed in. We do not use third-party advertising or tracking cookies. The light/dark mode preference is stored in your browser's localStorage.

8. Children's Privacy

The Service is not directed at children and is not intended for use by anyone under the age of 16 (or the applicable age of digital consent in your jurisdiction).

9. Changes to This Policy

This policy may be updated from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions about this policy or your data should be directed to the administrator of this installation at the contact details provided on the Service's contact page or in the Terms of Service, or at noreply@wpfleet.org.