Privacy and data
Geeky Bot stores chat data in your own WordPress database and sends nothing to an AI service until you choose one. This page lists what is stored, the settings that control it, and every outside service the plugin can contact, so you can describe your setup in your store’s privacy policy.
The privacy settings are under Geeky Bot → AI & Privacy, in History, retention and rate limits.
What Geeky Bot stores
Section titled “What Geeky Bot stores”| Data | Where | Stored when |
|---|---|---|
| Conversation: a random session key, the WordPress user ID for logged-in shoppers, a hashed IP address (keyed with your site’s salt, not reversible), the browser user agent, and start and last-activity times | Your database | Save conversation history is on, and for guests Save guest conversations is on |
| Shopper messages (up to 1,000 characters each) and replies, with the products and policy pages referenced and the detected intent | Your database | Same as above |
| Unanswered questions, with a reason | Your database | Same as above |
| Product and policy-source clicks from the chat | Your database | Same as above |
| Missed-search suggestions and phrases Rescue answered (Commerce Pro) | Your database | Rescue or learning is running |
| Smart Catalog search words for each product | Product meta | Smart Catalog is on |
| Rate-limit counters, keyed on a hash of the visitor | Your database (temporary) | Every chat request |
| The chat history and whether the chat is open | The shopper’s browser (local storage) | Save conversation history is on |
Shoppers can clear the chat in the widget, which removes the history from their browser.
With Commerce Pro, the add-on also stores leads and buying-action events. See Leads and handoff and Sales insights.
Storage and retention settings
Section titled “Storage and retention settings”| Setting | What it does |
|---|---|
| Save conversation history | Stores conversations. Needed for Conversations, Analytics and the unanswered-question review. When off, nothing a shopper sends is stored and the widget keeps no history in the browser. |
| Save guest conversations | When off, guests can still chat, but nothing they send is stored. Logged-in shoppers’ conversations are still stored. |
| Retention days | 1 to 365 days (default 30). Conversations with no activity for longer are deleted, with their messages, unanswered questions and clicks. Browser-side history expires after the same number of days. |
| Delete data on uninstall | When on, deleting the plugin removes its tables, settings and Smart Catalog words, and Commerce Pro data. Leave off on live stores. |
Old conversations are deleted at most once a day, the next time a shopper uses the chat.
Rate limiting
Section titled “Rate limiting”Rate limits protect your store and your AI bill from floods of messages.
| Setting | What it does |
|---|---|
| Rate limit shopper messages | Messages per visitor per window, 20 to 1,000 (default 120). |
| Rate limit window minutes | Length of the window, 1 to 60 minutes (default 5). |
| Trusted proxies in front of this site | 0 to 10 (default 0). Leave at 0 unless a CDN such as Cloudflare sits in front of the store (then 1). Too high lets visitors fake their address to dodge limits. |
Administrators and shop managers are not limited. Visitors are recognised by a hash of their IP address and browser, or their user ID when logged in.
Personal-data export and erasure
Section titled “Personal-data export and erasure”Geeky Bot adds Geeky Bot conversations to WordPress’s own privacy tools under Tools → Export Personal Data and Tools → Erase Personal Data.
- Open Tools → Export Personal Data or Tools → Erase Personal Data.
- Enter the customer’s email address and send the request as usual.
- When the request is confirmed, the export includes each conversation’s session key, user ID, dates, messages and product and source clicks. Erasure deletes those conversations with their unanswered questions and clicks.
Conversations are matched to the WordPress user account with that email address. Guest conversations carry no email address, so they can’t be found this way. Find them on Geeky Bot → Conversations by searching for the shopper’s words.
With Commerce Pro, a second entry, Geeky Bot Commerce Pro leads and analytics, covers the add-on’s data.
Outside services
Section titled “Outside services”In local mode with the Standard search level, Geeky Bot sends nothing about your shoppers anywhere. The only server requests are translation downloads on sites not in English and, once you enter a Commerce Pro licence key, licence and update checks. Every other request happens only after you choose or use a service.
| Service | What it receives | When |
|---|---|---|
OpenAI (api.openai.com) |
The shopper’s question, a grounding instruction, relevant visible-product summaries and relevant excerpts from your approved policy pages | OpenAI BYOK is the answer mode and a key is saved |
| OpenAI or Zywrap, Smart Catalog | For each visible product: title, categories, tags, attributes and a summary of up to 240 characters. No shopper data. | Smart Catalog is on, a product is added or changed, or you ask for words to be rewritten |
| OpenAI or Zywrap, Rescue (Commerce Pro) | The wording of a search that found nothing, and a list of your category and product-type words. Answers are reused for 30 days. | A search finds nothing at the Smart Catalog + Rescue level |
| OpenAI or Zywrap, learning (Commerce Pro) | The text of recent shopper messages that found no products, with the same list of store words | Once a day, at the Smart Catalog or Smart Catalog + Rescue level |
Zywrap (api.zywrap.com/v1/proxy, or the address you enter) |
The shopper’s question, a grounding instruction, relevant visible-product context and relevant approved policy-page context. Zywrap runs in the United States and passes the request to the AI model provider it uses, currently OpenAI. | Zywrap endpoint is the answer mode and a key is saved |
Zywrap, account sign-up (api.zywrap.com/v1/connect/wordpress/) |
The email address and optional name you enter, your site’s address and name, a key name (“Geeky Bot – “ and your domain), and where the sign-up came from (Geeky Bot, its version and UTM tags) | Only after you tick the consent box and select Email me a code or Sign in on zywrap.com |
| geekybot.com, translations | Nothing about your site. It downloads the translation for your site’s language, checked against a published SHA-256. | On sites not in English: on install or update, when the site language changes, and once a day |
| geekybot.com, Commerce Pro licence | The licence key, site address, WordPress, PHP and Geeky Bot versions, site language and whether the site is a multisite. Update checks send the key, site address and installed versions. | After you enter a Commerce Pro licence key: on activation, about once a week, on install or update, and twice a day for update checks |
Which of OpenAI or Zywrap search features use is explained in Search levels. A site-wide daily and monthly limit applies to all AI calls. API keys are stored encrypted and never sent to the storefront.
To stop translation downloads, add define('GEEKYBOT_TRANSLATIONS_AUTO', false); to wp-config.php. See Constants and Languages.
Links to geekybot.com and zywrap.com in the admin open in your browser. Links to zywrap.com carry the same UTM tags, and Sign in on zywrap.com opens zywrap.com with the sign-up details in the address.
What to say in your privacy policy
Section titled “What to say in your privacy policy”You are responsible for describing your setup in your own privacy policy. Geeky Bot can’t write it for you, and this is not legal advice. Points store owners usually cover:
- That the store has a chat assistant, and whether chats are stored, for how long (your Retention days), and whether guest chats are stored.
- That a hashed IP address, the browser user agent and, for logged-in customers, the account are linked to stored chats.
- That chat history is kept in the shopper’s browser and can be cleared from the chat.
- Which AI provider receives shopper questions, if you use OpenAI BYOK or Zywrap endpoint, and a link to that provider’s privacy policy.
- If you use Rescue or learning, that the wording of searches that found nothing is sent to that provider.
- How customers can ask for a copy or deletion of their chats, and that guest chats may need extra details to find.
- With Commerce Pro, what the lead form collects and who receives it.
WordPress’s own Settings → Privacy page helps you build the policy page.