SaleSave up to 20% on Pro with code SALE20See pricing →

Upgrade to Pro

Chatbot

View All Docs

Security and Privacy (7)

User Information Protection

Reading Time: 2 minutes
Download Markdown

Overview

This page explains how WPiko AI Chatbot protects your visitors’ information and what you can do to keep it safe. For a full list of what’s collected and where it’s stored, see Data Handling.

Built-in Protections

  • Safe message display: visitor and AI messages, and downloaded transcripts, are escaped so they can’t run code in the browser. This was hardened in version 2.1.0 after a responsibly reported stored-XSS issue, so keep both plugins updated.
  • Access control: only administrators can see conversations and visitor details in WordPress. Admin-only actions check permissions and nonces. With Pro, staff with the Live Agent role can see and reply to conversations only in the Mobile App.
  • Input sanitization: everything visitors type is sanitized before it’s stored.
  • Server-side AI calls: requests to OpenAI are made from your server over HTTPS. Your API key is encrypted and never sent to the browser.
  • Order privacy (Pro): orders are never uploaded to OpenAI. Guests must match an order number and checkout email to see basic status, lookups are rate-limited, and emails, addresses and payment details are never passed to the AI.
  • No technical details for visitors: visitors see friendly error messages. Only admins see the real cause.

Privacy Controls You Can Use

  • Email Capture is optional (Pro). Explain why you ask for an email in its description text.
  • Delete conversations when a visitor asks, or turn on Automatic cleanup (Pro) in Conversations.
  • Transcript downloads can be turned off in Chat Widget → Appearance → Menu Options.
  • Delete all data on uninstall in Advanced → Debug Log → Plugin data.
  • User Limits protect against abuse with per-visitor and site-wide caps. They’re on by default.

Best Practices

  • Keep WordPress, WPiko AI Chatbot and WPiko AI Chatbot Pro updated.
  • Use HTTPS on your whole site.
  • Give admin access only to people who need it. Use the Live Agent role for support staff.
  • Tell visitors in your privacy policy that chats are processed by OpenAI, and link it from the chatbot’s welcome message or Email Capture text.
  • Don’t ask visitors to share sensitive data such as passwords or card numbers in the chat.
  • Back up your database regularly and have a plan for responding to a data breach.
Have a Question?