1. Data Controller
The website owner operating the EasyHelp plugin is the data controller for any personal data collected through the plugin. This policy describes how the plugin handles data on behalf of site owners.
2. Data Collected
2.1 User Accounts
When users register or are created via the plugin, the following data is stored in the WordPress database:
- Email address
- Display name
- WordPress user role (
helpwp_user,helpwp_agent, orhelpwp_manager) - Login credentials (hashed password)
2.2 Tickets
The ticket system stores the following user-provided data:
- Ticket title, description, and custom field values (e.g., order ID, urgency, product, reason)
- Comments and replies on tickets
- Agent assignment metadata
- Ticket status history
2.3 Documentation
The documentation module stores:
- Documentation content authored by site editors
- Vote/feedback data (upvote/downvote per doc)
2.4 AI Auto-Responder
When the AI auto-responder feature is enabled:
- Ticket title, client name, email, and order information
- Full client and agent comment transcript
- Product taxonomy terms and urgency metadata
- The above data is sent to the remote HelpWP RAG endpoint (
/respond) for generating AI replies - The remote service does not persistently store this data beyond processing the request
2.5 Authentication Codes
When using the passwordless login flow:
- A one-time verification code is stored in a WordPress transient (5-minute expiry) keyed to the user’s email address
- The code is sent via email to the user
2.6 Chatbot Widget
If the optional chatbot widget is embedded:
- The external script loaded from
helpwp.dev/cdn/chat.min.jsmay set cookies or collect usage data - Data handling is governed by the chatbot service provider’s privacy policy
- The
data-brandingand otherdata-*attributes are configurable by the site owner
3. Data Storage
All plugin data is stored in the WordPress database on the site owner’s server:
| Data | Storage Location | Retention |
|---|---|---|
| User accounts | wp_users, wp_usermeta | Until user deleted or site destroyed |
| Tickets | wp_posts (type helpwp_ticket) | Until ticket deleted or site destroyed |
| Comments | wp_comments | Until comment deleted or site destroyed |
| Taxonomies | wp_terms, wp_term_taxonomy | Until term deleted or site destroyed |
| Settings | wp_options (key helpwp_settings) | Until explicitly reset |
| Transient codes | wp_options | 5 minutes |
| Log files (debug) | wp-content/uploads/easyhelp-logs/ | Until logs rotated or deleted by site owner |
4. Data Sharing
4.1 Third-Party Services
When the AI auto-responder is enabled, ticket data is sent to the remote HelpWP API endpoint. No other third-party sharing occurs by default.
4.2 Email Notifications
The plugin sends transactional emails through the WordPress wp_mail() function. Email content may include ticket details, user names, and authentication codes. The email delivery path depends on the site’s configured mail server.
5. User Rights
Depending on applicable law (GDPR, CCPA, etc.), users may have the right to:
- Access: Request a copy of their personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion of their account and associated tickets
- Restriction: Limit processing of their data
- Data Portability: Receive data in a structured format
- Objection: Object to processing (including AI auto-responder processing)
Site owners should provide mechanisms to exercise these rights through their WordPress installation.
6. Data Security
The plugin implements the following security measures:
- Passwordless login uses time-limited, email-verified codes
- User creation is gated by capability checks (front-end ticket creation requires verified email)
- REST API routes are protected by permission callbacks (
is_admin,is_agent,is_user,is_guest,has_nonce) - All output is escaped to prevent XSS
- ABSPATH guards prevent direct file access
- Nonce verification on authenticated requests
7. Cookies
The plugin itself does not set cookies. The optional chatbot widget loaded from helpwp.dev/cdn/chat.min.js may set its own cookies; the site owner should review the chatbot provider’s cookie policy.
8. Changes
This privacy policy may be updated as the plugin evolves. Site owners are responsible for reviewing and updating their own privacy policies accordingly.