Privacy Policy

1 Overview

The Chitty – AI Live Chat plugin ("Plugin", "Chitty", "we", "us") is a WordPress plugin developed by Mubashir Hassan. When installed on a WordPress website, it displays a chat widget to website visitors. This Privacy Policy applies to data collected through that widget and the plugin's admin functionality.

This policy is intended to help WordPress site owners (the "Site Owner") comply with their privacy obligations — including GDPR, CCPA, and WordPress.org Guideline #7 — when using the Chitty plugin on their websites.

2 Data We Collect

The Chitty plugin may collect the following types of data from website visitors:

2.1 Voluntarily Provided Data (Lead Capture Form)

When a visitor submits the pre-chat lead form, the following information is collected:

2.2 Automatically Collected Data

2.3 WooCommerce Data (if WooCommerce is active)

3 How Data Is Used

Data collected by the Chitty plugin is used exclusively for the following purposes:

• Providing the AI chat service — visitor messages are sent to the selected AI provider (Anthropic, OpenAI, OpenRouter, or NVIDIA NIM) to generate a response
• Lead management — storing visitor contact info in the WordPress database for the Site Owner to view and follow up
• Personalisation — recognising returning visitors by name using browser localStorage (SK-bound)
• Email notifications — notifying the Site Owner when a new lead is captured (if enabled)
• Drip email sequences — sending Day 1, Day 3, and Day 7 follow-up emails to leads who have provided marketing consent
• Revenue tracking — matching WooCommerce orders to chat sessions to measure conversion attribution
• AI quality improvement — thumbs up/down ratings used to identify high-quality conversations for the auto-learn feature (optional)
• Real-time web search — visitor messages may trigger a web search query via the configured search engine API (Serper, Brave, or SerpAPI)

4 Data Storage

All visitor data collected by Chitty is stored exclusively in the Site Owner's own WordPress database. Chitty does not operate external servers, does not upload data to Chitty/developer servers, and does not have access to the collected data.

4.1 Database Tables Created

4.2 WordPress Options Table

Plugin settings (API keys, Knowledge Base content, appearance settings) are stored in the WordPress wp_options table. API keys are stored server-side only and are never exposed to the visitor's browser or included in front-end JavaScript.

5 Cookies & Local Storage

5.1 Cookies Set by Chitty

5.2 Browser localStorage

5.3 Browser sessionStorage

6 Third-Party Services

Chitty integrates with optional third-party services. No third-party service is contacted without explicit configuration by the Site Owner. Each service is only used when the Site Owner provides an API key and enables the feature.

7 AI Providers & Data Transmission

When a visitor sends a chat message, that message — along with contextual system prompt data (business knowledge base, conversation history) — is transmitted to the AI provider selected by the Site Owner. No AI provider is contacted without the Site Owner providing a valid API key.

7.1 What Is Sent to AI Providers

• The visitor's chat message(s) and conversation history (up to the configured history limit)
• The system prompt (business knowledge base content configured by Site Owner)
• Visitor journey pages (page titles visited, if journey tracking is enabled)
• Optionally: a summarized version of earlier conversation (rolling summarization)

7.2 What Is NOT Sent to AI Providers

• Visitor email addresses, phone numbers, or IP addresses
• Lead form data (name/email/phone are captured separately, not injected into AI context)
• WooCommerce order or payment data
• WordPress admin credentials or API keys

8 Email Communications

8.1 Lead Notification Emails

When a visitor submits the lead capture form, an optional notification email is sent to the Site Owner's admin email address. This email contains the visitor's name, email, phone, and their last chat message.

8.2 Drip Email Sequences

If the Site Owner enables the drip email feature and the visitor has provided explicit marketing consent, the plugin sends automated follow-up emails on Day 1, Day 3, and Day 7 after lead capture.

• Emails are only sent if marketing_consent = 1 AND unsubscribed = 0
• Every drip email contains a one-click unsubscribe link
• Emails include a List-Unsubscribe header per RFC 2369
• Visitors can also unsubscribe by typing "unsubscribe", "stop", "opt out", or similar in the chat
• The Site Owner can manually unsubscribe any lead from the WordPress admin Leads panel

8.3 Unsubscribe Mechanism

Each unsubscribe link contains a unique token (unsub_token) stored in the database. Clicking the link sets unsubscribed = 1 for that lead, permanently stopping all future drip emails.

9 WooCommerce Data Integration

If WooCommerce is active on the site, Chitty listens to woocommerce_order_status_completed and woocommerce_payment_complete hooks to automatically match completed orders to existing chat sessions.

Matching Logic

1. Plugin retrieves the customer's email, phone, and billing name from the completed order
2. Searches for a matching chat session (created within the last 24 hours) using email first, then phone, then name
3. If a match is found, the session record is updated: converted = 1, order_id, order_total
4. A duplicate guard prevents the same order from being recorded twice

10 Data Retention

Data Deletion on Uninstall

When the Chitty plugin is deleted (not just deactivated) from WordPress, all plugin database tables (wpc_sessions, wpc_chat, wpc_ratings, wpc_drip) and all plugin options are removed from the WordPress database.

11 User Rights (GDPR / Data Subject Rights)

Chitty is built to support GDPR data subject rights. The Site Owner is responsible for honouring these rights when requested by visitors.

WordPress Privacy Tools Integration

Chitty fully integrates with WordPress's built-in privacy framework:

• Personal Data Export — Chitty registers a data exporter that includes all chat sessions and messages associated with a given email address
• Personal Data Erasure — Chitty registers a data eraser that deletes all sessions and messages associated with a given email address

12 Children's Privacy

The Chitty plugin is designed for use on business websites and is not directed at children under the age of 13 (or 16 in the EU). The plugin does not knowingly collect data from children.

Site Owners whose websites may be accessed by children are responsible for implementing appropriate age verification and obtaining parental consent where required by applicable law.

13 Security Measures

• API keys stored server-side only — AI provider keys, search API keys are stored in WordPress options and never exposed in front-end JavaScript or HTML
• Nonce verification — All AJAX and REST API requests are verified using WordPress nonces to prevent CSRF attacks
• Input sanitization — All visitor inputs are sanitized using WordPress sanitization functions before storage
• Prompt injection protection — The system prompt includes explicit instructions to prevent visitors from manipulating the AI through injection attacks
• IP anonymization — Site Owners can enable IP anonymization to store only the first 3 octets of IPv4 addresses (e.g., 192.168.1.x)
• Capability checks — All admin actions require manage_options capability; no frontend access to admin data
• Prepared statements — All database queries use WordPress $wpdb->prepare() to prevent SQL injection
• Unique unsubscribe tokens — Generated using wp_generate_password(32) for secure, unguessable unsubscribe links

14 Site Owner Responsibilities

As the WordPress site owner using the Chitty plugin, you are the data controller under GDPR. Your responsibilities include:

• Maintaining your own Privacy Policy that discloses the use of the Chitty chat widget, AI processing, and data collection
• Obtaining valid cookie consent from EU/EEA visitors before the chat widget sets the wpc_sk cookie
• Ensuring legal basis for processing visitor data (consent, legitimate interest, etc.)
• Informing visitors that their chat messages are processed by an external AI provider (Anthropic, OpenAI, etc.)
• Honouring data subject access, erasure, and portability requests within the legally required timeframe (30 days under GDPR)
• Configuring appropriate data retention periods and regularly cleaning up old chat sessions
• Ensuring that email marketing (drip sequences) is only sent to visitors who have given explicit consent
• Complying with CAN-SPAM, CASL, or other applicable email marketing laws in your jurisdiction

Recommended Privacy Policy Disclosure

We recommend including the following (or similar) language in your website's Privacy Policy:

15 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the plugin's functionality, legal requirements, or third-party service integrations. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this document
• Include a changelog note in the plugin's WordPress.org readme.txt
• Notify users via the WordPress admin notice system if the change is material

Continued use of the Chitty plugin after a policy update constitutes acceptance of the updated terms.

16 Contact & Data Requests

For questions about this Privacy Policy, data handling practices, or to submit a data access/erasure request regarding Chitty plugin development data, please contact: