Privacy Policy
Last updated: 16 October 2026
Data we process
WP Agent Bridge is designed to minimize stored personal data. When an administrator uses passwordless Cloud Account features, the email address they enter is sent to our authentication provider so a one-time verification code can be delivered.
WordPress connection data
When a site is enrolled into WP Agent Bridge Cloud, we may process the site origin, privacy-safe site and installation hashes, Bridge version, WordPress version, PHP version, locale and multisite status. These values are used to identify installations, prevent conflicts and provide account/fleet features.
Usage data
If a Cloud account is linked, aggregate daily counters may be synchronized, including total operations, read/write/error counts and normalized route counters. We do not include prompts, request bodies, WordPress content, IP addresses, passwords, payment-card data, access tokens or refresh tokens in usage synchronization.
Authentication
Passwordless authentication is provided through Supabase Auth. Email delivery may be handled by the configured transactional email provider. Authentication sessions stored inside WordPress are encrypted locally; raw session tokens are not exposed through public status tools. If OAuth access is enabled, compatible AI/MCP clients may receive revocable access and refresh tokens only after explicit user authorization.
External services
| Service | Purpose |
|---|---|
| Supabase | Authentication, OAuth authorization, account/fleet records, entitlement state and privacy-safe usage synchronization. |
| Railway | Hosts Quick Connect and WP Agent Bridge public web services. |
| Openverse | Used only when an administrator explicitly requests stock-media search/import. |
| Google Search Console / PageSpeed Insights | Used only when explicitly invoked and configured for diagnostics or SEO workflows. |
Payments
Paid checkout is currently disabled. WP Agent Bridge does not currently collect or store payment-card data. If paid billing is enabled in the future, this policy will be updated to identify the payment provider and its data handling.
Retention and control
Local WordPress audit, snapshot and operational data remains under the site administrator's control. Cloud account data is retained as needed to provide the service, maintain security and comply with legal obligations. Administrators can disconnect the local Cloud session from WordPress at any time. OAuth grants can be revoked and are not a substitute for WordPress administrator authorization.
Contact
Privacy questions can be sent to [email protected].