Privacy Policy

1. Who we are and our two roles

TalkToWP ("Service") is operated by Beyondt Consultancy & Services Pvt. Ltd. ("Company", "we", "us", "our"). Our company details and registered office are on our Legal & company information page.

We act in two roles, and the difference matters:

• Controller for your account, billing and usage data: the information we need to run your account and our website.
• Processor for WordPress site data, where you (or, for an agency, your client) decide why and how that data is processed. If you connect sites you manage for clients, you are the controller or a processor for those clients, and we are your processor or sub-processor. Our Data Processing Addendum covers this and forms part of our Terms.

2. Information we collect

2.1 Account and billing

• Email address and, optionally, your name
• Payment information, which is processed and held by Dodo Payments, our Merchant of Record. We do not store your card details.

2.2 Site technical data

The TalkToMonitor plugin sends us the following about each connected site:

• WordPress and PHP versions, installed plugins and themes with versions, pending updates
• Server performance, memory and disk figures, SSL certificate status, security headers
• Database size, health and table status, revision and transient counts, autoload statistics
• Cron and cache configuration, and error-log line counts
• The contents of your WordPress debug log, when debug logging is on
• Administrator accounts: the username, email address and registration date of any administrator account that appears after the first baseline scan, so we can alert you to an unexpected admin user
• Content flagged by the malware scan: the title and the first 120 characters of any post it reports
• The username of the logged-in user, when you push data manually from wp-admin

2.3 Data processed on your instruction

Only when you enable Site Actions, or connect an AI assistant that uses them, we process the content you ask us to act on: the contents of files read from or written to your site, post and page content, WooCommerce product data, and WooCommerce order status and notes. This can include personal data of your site's authors and of your store's customers.

2.4 Usage data

When you use our website or app we collect your IP address, browser and device information, the pages you visit, features you use, and timestamps.

3. How we use it

• Account and billing data: to run your account, take payment, send transactional email, and meet tax and legal obligations.
• Site technical data: to detect incidents, alert you, and generate plain-English explanations and fixes.
• Data processed on your instruction: only to carry out the action you or your connected assistant requested.
• Usage data: to keep the Service secure, prevent abuse, understand how it is used, and improve it.

4. Collective Plugin Intelligence

TalkToWP learns from patterns across the sites in its network, for example that a particular plugin version tends to break on certain PHP versions. This analysis uses plugin slugs, version ranges, hashed error patterns and hashed environment fingerprints. It does not use user IDs, site IDs or domain names. We describe these as pseudonymised aggregates rather than anonymous data, because hashing is not the same as anonymisation under data-protection law.

5. Sub-processors

These providers process data on our behalf. The same list, with the data each one handles, is in our Data Processing Addendum.

We will tell customers before we add or replace a sub-processor, and you may object, as set out in the DPA. AI assistants you connect yourself (section 9) are chosen by you and are not our sub-processors.

We do not sell your personal information.

6. Lawful bases

• Contract: delivering the Service, including monitoring, alerts, AI explanations, billing and support.
• Legitimate interests: securing the Service, preventing fraud and abuse, and improving the product, including Collective Plugin Intelligence. We have weighed these interests against your rights in a written legitimate-interests assessment, which we can share on request.
• Consent: analytics cookies and similar identifiers, and any marketing email. You can withdraw consent at any time.
• Legal obligation: tax, accounting and other records we must keep.

7. Your rights

EEA and UK residents (GDPR / UK GDPR)

• Access: a copy of your personal data
• Rectification: correction of inaccurate data
• Erasure: deletion of your personal data
• Portability: your data in a machine-readable format
• Restriction: limiting how we process it
• Objection: to processing based on legitimate interests
• Withdraw consent at any time

You also have the right to complain to your local supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA, the authority in your country of residence, work or the place of the alleged infringement.

California residents (CCPA / CPRA)

• Know and access the personal information we hold about you
• Delete it, and correct it
• Opt out of sale or sharing: we do not sell personal information. Some analytics tools may count as "sharing" under California law; you can opt out through our cookie preferences or by emailing privacy@talktowp.com.
• You will not be treated differently for using these rights.

India (Digital Personal Data Protection Act, 2023)

• Access a summary of the personal data we process and who we share it with
• Correct, complete, update or erase your personal data
• Grievance redressal, as described in section 17
• Nominate another person to exercise these rights if you die or become incapacitated

How to exercise your rights

Email privacy@talktowp.com. You can also delete your account yourself in the app under account settings; this cancels your subscription first and stops if the cancellation fails. We may ask you to confirm your identity before acting on a request, using details we already hold. We respond within 30 days. If you are an agency's client, contact the agency first, because it controls that site's data and we act on its instructions.

8. Access to your WordPress site

By default the TalkToMonitor plugin only reads your site. It collects the data in section 2.2 and sends it to us. It makes no changes to your site.

8.1 Site Actions

Site Actions is off by default and needs two independent switches: a per-site permission in your TalkToWP dashboard, and a master toggle inside your own WordPress admin, which overrides the dashboard. While either is off, every action endpoint in the plugin refuses. Each request is signed with your site's API key, is valid for only a few minutes, and cannot be replayed.

When enabled, and per permission group, requests may:

• Maintenance: update plugins, themes and WordPress core, activate or deactivate a plugin, clear caches, and roll back an update
• Content: create, edit, publish and delete posts, and bulk-import posts
• Design: create and edit pages and block templates
• WooCommerce: create, edit, delete and bulk-import products, and change an order's status or add an order note. If an order note is marked as a customer note, WooCommerce emails it to the store's customer.
• Files: read files from your WordPress directory, and write files inside wp-content/
• Access: issue a single-use link, valid for 60 seconds, that signs the requester into wp-admin as your site's lowest-ID administrator account. That is not necessarily your own account: on a client site it is usually the client's own admin user, and everything done in wp-admin afterwards is recorded in WordPress under that person's name.

Where the plugin supports it, we take a snapshot before maintenance actions and keep it on your own server for 7 days. File writes are not snapshotted and cannot be rolled back.

8.2 What the plugin can never do

Whatever permissions you grant, the plugin cannot install plugins or themes from an arbitrary source, delete plugins or themes, change users or roles, run database queries, or write outside wp-content/. It refuses to read or write wp-config.php, .env files, .htpasswd and private keys, and it resolves symlinks first so a planted link cannot reach them. This means those files are not sent to us through these tools. It does not mean the values can never reach us by another route: if a configuration value is written to your debug log, the debug log is part of what we collect.

8.3 Records of actions

When an action runs, we store a record of it: the action, its status, its outcome and its time, together with the parameters and result of the request. For file actions that is the content of the file read (up to a 512 KB window) or written; for content actions it is the post or page body; for WooCommerce it is the product data. These records currently have no expiry; see the retention table in section 12.

9. Connecting an AI assistant

TalkToWP can be connected to a third-party AI assistant, such as Claude or ChatGPT, through the Model Context Protocol (MCP). No assistant has access until you connect one and approve it on our own consent screen, which requires you to be signed in to your dashboard. An access token cannot approve itself.

What the assistant can read. Once connected, an assistant acting for you can retrieve: your site names and addresses; WordPress, PHP, plugin and theme inventories; hosting, SSL and caching configuration; uptime and response-time history; performance metrics; security posture including headers and DNS records; incidents, including raw error text and the analysis we generated; activity logs; pending updates and aggregated plugin reliability data; the contents of files in your WordPress directory, excluding the credential files in 8.2; account-level totals; and the record of every action with its status and outcome.

Where that data goes. To the provider you connected. From that point it is handled under that provider's privacy policy and retention terms, not ours. We do not control how they store, process, train on or retain it. Connect only providers whose terms you accept.

What it can change. Nothing, unless you have separately enabled Site Actions and granted the relevant permission group.

Untrusted content. Plugin names, error messages and file contents reach the assistant as data from sites we watch but do not control, and anyone who can edit such a site can place text there. We mark this data as untrusted and instruct our own AI never to follow instructions found inside it, but no safeguard against this is complete. Keeping Site Actions off, or limited to the groups you need, is your most effective control.

What we store about the connection. The authorisation grant and its tokens, the client name, version and platform the application reports, a per-session identifier, and connect and last-seen times. Access tokens last 1 hour, refresh tokens 60 days.

Revoking access. Disconnect any application from the MCP page of your dashboard. Access stops within one minute. Disconnecting does not delete data the provider already received; ask them directly.

10. International transfers

We operate from India. Our sub-processors process data in other countries, including the United States and the European Union. Supabase and Railway host data in Sydney, Australia (Supabase) and Singapore (Railway). Where data leaves the EEA or UK we rely on the European Commission's Standard Contractual Clauses and, for the UK, the UK Addendum, with each sub-processor. Transfers from India are made in line with the DPDP Act.

11. Security

What we do, specifically:

• TLS for data in transit; encryption at rest through our database provider
• Dashboard API tokens stored only as SHA-256 hashes, shown once. Per-site API keys are shared signing secrets, so they cannot be hashed and are stored in recoverable form.
• Row-level security and a tenant-isolating storage layer, so one account cannot read another's data
• A guard against server-side request forgery on every outbound request to a customer URL
• Rate limiting on public endpoints
• Signed, timestamped, single-use requests for every site action, with a five-minute window

Reporting a vulnerability: email security@talktowp.com. We will acknowledge your report and keep you informed.

If there is a breach: we will notify the relevant authorities as the law requires, and notify affected customers acting as controllers without undue delay and within the period set in our DPA.

12. Retention

Removing a site. Sites are soft-deleted: removing a site from your dashboard marks it deleted and stops collection, but does not immediately erase its history. Soft-deleted sites are purged after 90 days.

Deleting your account. You can delete your account yourself in the app, or email privacy@talktowp.com. The app cancels your subscription first and does not delete the account if the cancellation fails.

13. Cookies and tracking

• Essential: a session cookie that keeps you signed in. Always on.
• Preferences: remember your settings.
• Analytics: Google Analytics 4 and PostHog, loaded for us by Cloudflare Zaraz, to understand aggregate use of the website and app.

Analytics is not essential, so it needs your consent. We are introducing a cookie preferences control that lets you accept or refuse it, and change your mind at any time from a link in the footer. Once it is live, analytics cookies and identifiers will be set only after you accept. Until then these tools load without a prompt, and you can block them in your browser or with a content blocker.

14. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. Under India's DPDP Act we do not track or monitor children or send them targeted advertising. If you believe a child has given us personal data, email privacy@talktowp.com and we will delete it.

15. Changes to this policy

We will update the "Last updated" date when this policy changes. For a material change we will also email account holders, at least 30 days before it takes effect where we can.

16. Contact

Email privacy@talktowp.com for anything in this policy, or support@talktowp.com for general help. Company identity, registered office and our contact person are on our Legal & company information page. Our representative in the EU and UK under Article 27 of the GDPR is being appointed and will be named on that page.

17. Grievance redressal (India)

Under the Information Technology Act, 2000 and the DPDP Act, 2023, you can raise a grievance about how we handle your personal data by emailing grievance@talktowp.com. We acknowledge grievances within 24 hours and resolve them within 30 days. Our Grievance Officer is named on the Legal & company information page.