AI Data & Privacy for Subscriptions

AI Insights is disabled by default and does nothing until you switch it on and enter your own API key. This page documents exactly what leaves your store when you do.

Which service is contacted

You choose one provider and supply your own key. Requests are sent directly from your store to that provider and are billed to your own account with them. Nothing is routed through zorem.com, and no data is sent to any provider you have not configured.

Provider	Endpoint	Terms and privacy
Anthropic (Claude)	`api.anthropic.com`	Commercial terms · Privacy policy
OpenAI (ChatGPT)	`api.openai.com`	Terms of use · Privacy policy
Google (Gemini)	`generativelanguage.googleapis.com`	Gemini API terms · Privacy policy

API access is governed by each provider’s commercial or API terms, not their consumer product terms.

Who can trigger a request

Enabling AI, saving a key, and clicking Generate, Regenerate, Group answers or Test connection all require the manage_woocommerce capability — an Administrator or Shop manager.

There is no separate, lower-privilege AI permission and no per-user spending limit. Anyone who can open these reports can send store data to your provider and spend against your key. If several people have shop-manager access, set a spending cap in your provider’s console.

What is sent

There are three summaries. Two send aggregate numbers only. The third sends customer-written text and has its own separate setting.

Overview summary — numbers only

The date range, your store currency, monthly and annual recurring revenue for the current and previous period, counts of new / cancelled / ended subscriptions, renewal order count and revenue, and churn-risk band totals.

Forecast summary — numbers only

The forecast horizon in days, your store currency, the gross amount and number of renewals scheduled in that window, the expected collectable amount and its range, your renewal success rate as a percentage, how many months of history that rate is based on, and the amount and count of renewals belonging to high-risk subscriptions.

Cancellation themes — contains customer-written text

If you switch on cancellation feedback, customers are shown an optional question on their account page after they cancel. Enabling the separate Group answers with AI setting sends those written answers to your chosen provider to be grouped into themes.

Before anything is sent, each answer is stripped of email addresses, web links and any run of seven or more digits (phone numbers, card numbers, account references), and is truncated to 500 characters. No subscription IDs, customer IDs, names or dates accompany the text.

Stripping reduces the risk, it does not eliminate it. A customer can type anything into a free-text box, including their own name or a complaint that identifies them. If your privacy policy treats customer-written feedback as personal data, treat this setting accordingly and consider reading the answers yourself rather than enabling AI grouping.

Both settings are off by default and either can be used without the other — you can collect feedback and read it yourself without ever sending it anywhere.

What is never sent

No customer names, email addresses, user IDs, order IDs, addresses or payment details.
No product names, and no product or order records.
Your API key is never sent to zorem.com.

When a request happens

A request is only made when you click Generate, Regenerate or Group answers on a report, or when you use Test connection on the settings screen. Nothing is sent on a schedule or in the background. Cancellation feedback is never sent unless you have explicitly enabled that specific setting.

What is stored on your own site

Where	What	Kept for
`zorem_subscription_ai_insights` table	The generated summary text, with the provider and model used	90 days, then deleted automatically
Subscription meta	Cancellation answers, as `_zorem_cancellation_reason` on the subscription	Until the subscription record itself is deleted
WordPress options	Your settings and your encrypted API key	Until you change or remove them
WooCommerce logs	Errors only — see below	WooCommerce’s own log retention

A cached summary is matched on a hash of the whole metrics payload, so when the underlying numbers change the summary regenerates rather than serving a stale one.

What is logged

Failures are written to WooCommerce → Status → Logs under the source subscription-analytics. Exactly two things are recorded: a note that a generated summary could not be saved, and a failed provider request with the transport error returned by your server.

Your API key is never written to the log, and neither the data sent nor the text returned is logged. Only the error itself. Successful requests are not logged at all.

What your provider does with it

Once a request reaches your provider, their terms govern it — not ours. Two things are worth checking on your own account before enabling anything, because they differ between providers and between plans:

Whether your data is used to train models. On paid API plans the major providers do not train on submitted data by default, but free tiers can behave differently — Google’s free Gemini API tier is used to improve their products, while the paid tier is not. Use a paid API key if this matters, and confirm the current position in the policies linked above.
How long requests are retained. Providers typically hold API requests for a limited period for abuse monitoring. The window is theirs to set and can change; it is stated in their policy and is not controlled by this plugin.

If you are in the EU or UK. All three providers may process requests outside your region, so enabling AI means transferring store data to a third-country processor. For the two numeric summaries that data is aggregate figures. For cancellation themes it is customer-written text, which is a materially different decision — any data processing agreement you need is with your chosen AI provider, not with Zorem, which never receives this data.

Personal-data requests

Cancellation answers are stored as meta on the subscription they belong to, and are removed if that subscription record is deleted.

The plugin does not add these answers to WordPress’s built-in personal-data export and erasure tools. If you receive a subject access or erasure request covering a customer who left cancellation feedback, that answer will not appear in the standard export and will not be removed by the standard eraser — handle it manually on the subscription record. If you rely on those tools for compliance, consider leaving cancellation feedback switched off.

Key storage

Your API key is encrypted before it is written to your own database, using a secret derived from your site’s own WordPress salts. After saving, the key is never sent back to your browser — the settings screen shows only a masked hint.

If your WordPress security salts change, you must re-enter your API key. The key is encrypted against the salts in wp-config.php. Rotating them — which some security plugins do, and which can happen during a migration — makes the stored key impossible to decrypt on this site. The key is not lost at your provider; this site simply can no longer read it.

How to stop it completely

To…	Do this
Stop the panels appearing	Turn off AI Insights at WooCommerce → Settings → Subscription Analytics.
Stop collecting customer feedback	Turn off the cancellation feedback setting on the same screen. Answers already collected remain on their subscriptions.
Stop this store using your key	Remove the saved key on the same screen.
Stop being billed for that key entirely	Revoke the key in your provider’s console — Anthropic, OpenAI or Google AI Studio. Removing a key from WordPress stops this store using it; only the provider can deactivate the key itself.

Churn-risk scoring

Churn-risk scoring is calculated entirely on your own server and never contacts an external service, whether or not AI Insights is enabled. It is a deterministic weighted sum, not a model. See Churn Risk.