This page sets out precisely what leaves your store when the AI features are switched on. In short: aggregate country totals only — never customer data.
What is sent
When a summary, recommendation or answer is generated, the plugin builds a small digest of the report you are looking at and sends it to the one provider you selected. The digest contains:
- Country codes and country names.
- Order counts per country.
- Gross and net sales totals per country.
- Average order values.
- Percentage change against the previous period.
- Your store’s base currency code, and the date range on screen.
- For the Ask feature only — the question you typed.
The whole digest is typically under two kilobytes — about the size of a short email.
What is never sent
| Data | Sent? |
|---|---|
| Customer names | Never |
| Email addresses or phone numbers | Never |
| Billing or shipping addresses | Never |
| Order IDs or order numbers | Never |
| Payment or card details | Never |
| IP addresses | Never |
| Product names or SKUs | Never |
When it is sent, and to whom
Requests are made only at the moment a summary or recommendation is generated, or when you ask a question — not on a schedule and not in the background. Summaries are cached for 24 hours, so repeatedly viewing the same report does not repeatedly send data.
Data goes to the single provider you select and to no other. Their terms govern how it is handled:
| Provider | Endpoint | Terms and privacy |
|---|---|---|
| Anthropic (Claude) | api.anthropic.com | anthropic.com/legal/commercial-terms · anthropic.com/legal/privacy |
| OpenAI (ChatGPT) | api.openai.com | openai.com/policies/terms-of-use · openai.com/policies/privacy-policy |
| Google (Gemini) | generativelanguage.googleapis.com | ai.google.dev/gemini-api/terms · policies.google.com/privacy |
Country anomaly alerts send nothing
Anomaly detection is not an external service. It is a statistical calculation performed on your own server against your own database, and it works whether or not you have an API key. No data leaves your site for this feature at any point.
How your API key is stored
Your key is encrypted before being written to the database, using a secret derived from your site’s own WordPress salts. It is never returned to the browser after saving — the settings screen shows a masked hint only. You can remove a stored key at any time by ticking Remove key and saving.