Privacy

This page describes how the SiteRank AI plugin behaves with data when it runs on your WordPress site. It is a description of the software, not a legal notice about a service we operate, because we do not operate one — the plugin runs on your server, stores its results in your database, and sends nothing to us.

If you are writing your own site's privacy policy, the section below on what leaves the site is the part you need.

Where the data lives

Everything SiteRank AI produces is stored in your own WordPress database, in tables and options prefixed to the plugin. That includes:

• The content corpus it extracts — the text, headings, links, images and metadata it reads from your posts, pages and custom post types in order to analyse them.
• Audit findings — each with the URL it was observed on, the observed value, a severity and an evidence tier.
• Topic clusters — computed locally from your content by a lexical engine.
• Crawler and structured-data inspections — what your robots.txt says, what JSON-LD your pages carry.
• Tracked sites — the URLs you register for comparison, your own and competitors', plus the results of the bounded surface checks run against them.
• Prompts and observations — the monitoring prompts you wrote, and the provider responses returned for them, with full provenance.
• An activity log — what ran, when, and what it produced, redacted before storage.

None of it is copied off your server. There is no telemetry, no usage analytics, no phone-home check, no error reporting to us, and no account with us to create.

What leaves your site, and when

One thing, in one situation.

If — and only if — you configure an AI provider and enable visibility monitoring, the prompt text you wrote is sent to that provider through its official API, using your own key, at the times you scheduled. That is the complete outbound payload.

The request is constructed from the stored prompt row alone, which means the boundary is a property of how the code is written rather than a rule someone applies. There is no other path in the plugin that sends data to a third party.

The provider's response comes back and is analysed on your server for mentions and citations. The response is stored with you, not with us.

What is never transmitted

The following are never sent anywhere, under any configuration:

• Post, page and custom post type content — the body text of anything you have written.
• URLs from your site — your permalinks, your internal link graph, your sitemap.
• The content corpus — the extracted, normalised text the analysis runs on.
• Site metadata — your domain, WordPress version, plugin list, theme, or configuration.
• User data — accounts, email addresses, roles, comments, or anything about your visitors.
• Your API credentials — which go to your provider and to nobody else, and are never returned to the browser or written to a log.

Because the analysis engine runs locally with no outbound request at all, this is not a matter of us choosing not to collect these things. There is no code path that would send them.

Visitors to your site

SiteRank AI is an administration tool. It sets no cookies for your visitors, adds no tracking script to your front end, and collects nothing about the people who read your site. The one front-end artefact it can produce is an /llms.txt file, and only if you explicitly draft, review and publish one.

Retention and control

• Observations are retained so history stays verifiable, with a retention period you set. They are kept with their full provenance rather than rolled up, because an averaged row cannot be audited later.
• Raw provider payloads are stored only if you turn that on. They are redacted before they are written and bounded by both size and retention period.
• Logs are redacted by a single component that scrubs credentials by pattern and by registered value, so a key cannot end up in a log line, an exception message or a diagnostics export.
• Corpus and findings are regenerated by each scan and can be cleared by re-running or by removing the plugin’s data.

Your provider's terms apply to your prompts

When a prompt goes to OpenAI or any other provider you configure, that request is governed by your agreement with that provider, not by anything here. How they retain the request, whether they log it, and how they use it are their policies to state and yours to accept. You are their customer; we are not in the relationship.

Two practical consequences. First, read the terms of the provider whose key you are using — they differ, and they change. Second, treat prompt text as something that will leave your server, and do not put confidential information into a monitoring prompt. Prompts should read like questions a member of the public would ask, because that is what they are for.

Removing the data

• Deactivating the plugin stops its scheduled jobs and clears runtime state. It destroys nothing.
• Uninstalling preserves your data by default, so that removing and reinstalling does not lose your history. To have everything removed, enable the delete-on-uninstall setting in advanced settings before you delete the plugin; the plugin’s tables, options and capabilities are then dropped on removal.
• Credentials are always removed on uninstall, regardless of that setting.
• Individual records — prompts, tracked sites, observations — can be deleted from the admin at any time.

Because all of it lives in your database, a database export includes it and a database restore brings it back. Treat the plugin's tables as you treat the rest of your site's data.

Changes to this page

This page describes the behaviour of the current release. If a future release changes what is sent, stored or retained, this page changes with it and the review date at the top moves. The formulas and definitions behind the stored data are on the methodology page, and the security controls around it are on the security page.