Privacy policy
Last updated 16 October 2026
This policy explains what data the TricksBiz Product Optimizer WordPress plugin, the service at app.tricksbiz.com and this website process, and why. The service and website are operated by Tricks Biz ("we").
1. Summary
- The plugin sends product content only from your store, and only after an administrator connects the store. Customers, orders, payments and WordPress users are never sent.
- To write suggestions, part of that product content is sent to an AI provider. Prices, stock and image files are not.
- For your account we keep your name, email address and usage records.
- We do not sell data, show ads or use analytics or tracking cookies on this website or the service.
2. Data the plugin sends from your store
Nothing is sent until an administrator clicks Connect store and approves the connection. After that:
| When | What |
|---|---|
| Connecting, and every six hours (heartbeat) | Store URL and name, WordPress, WooCommerce, PHP and plugin versions, active SEO plugin, site language, the plugin's notification URL, a random installation ID, and which optional WooCommerce features exist. |
| Product import: after connecting, on demand, and shortly after a product is created, edited, trashed or deleted | Product ID, name, SKU, slug, permalink, type, status, short and long description, price, regular and sale price, currency, stock status, GTIN, brands, categories, attributes, variation options and count, image IDs, URLs, file names, sizes and ALT text, SEO title and meta description, FAQ, last-modified time and content hashes. For deleted products, the ID only. |
| Opening the plugin screen or the Products screen | A request for your account summary and product scores. |
| Applying or rolling back a change you approved | The result and a hash of the stored value. |
The service sends signed notifications to /wp-json/tbpo/v1/ping on your site, telling the plugin to check for new work. When the plugin connects, rotates its key or disconnects, the request's IP address and user agent are recorded in the audit log.
3. Data about you
- Account: name, email address, password (stored as a one-way hash), email verification and last login time.
- Plan requests: the plan, and the optional phone or WhatsApp number and message you add.
- Usage and billing records: credits granted, reserved and used, AI requests (action, provider, model, token counts, cost, duration, status), and generated suggestions with the product data they were based on.
- Security logs: an audit log of important actions with IP address and user agent, and server error logs.
- Support messages sent through this website: name, email, optional store URL, topic, message and IP address. They are delivered by email to our support team and not stored in the application database.
4. Why we use it
- To analyse your products, produce suggestions and apply the changes you approve.
- To run your account, count credits and handle plan requests.
- To keep the service secure: signed requests, rate limits, abuse prevention and audit logs.
- To send account emails (verification, password reset, replies to plan requests) and answer support messages.
5. AI providers and other processors
When you ask for a suggestion, the service sends this part of the product to the AI provider configured for the service: name, brand, categories, product type, attributes and variation options, short and long description, SEO title and meta description, FAQ, and image IDs, file names and ALT text. Prices, stock, image files, customer data and your account details are not sent. The exact data sent is stored with each suggestion.
The provider in use is one of:
- OpenAI (privacy policy)
- Groq (privacy policy)
Data sent through these providers' APIs is processed under their own terms and retention rules. Our hosting and email providers also process data on our behalf to run the service.
6. How long we keep data
- Account, product, suggestion and credit records: while your account exists.
- When you delete a store from your account, it is disconnected and removed from your store list; its records are kept with the account for usage history and auditing.
- Server error logs: up to 14 days.
- Login sessions: until you log out or the session expires.
- Support emails: in our support mailbox for as long as needed to handle your request.
7. Cookies
This website and the service only use cookies needed to work: a session cookie and a security (CSRF) token cookie. There are no analytics, advertising or third-party cookies.
8. Your choices
- Disconnect the store in WordPress or in your account at any time; the service loses access immediately.
- Delete a store from your account.
- Uninstall the plugin to remove its settings and credentials from WordPress.
- Access, correction or deletion of your account: use the support form with the subject "Privacy or data request". Account deletion is handled by our team on request.
9. Security
Connections use https. The store key and signing secret are stored encrypted in WordPress. Store keys are stored hashed on the service, AI provider keys are encrypted, and notifications to your store are signed. No method of storage or transmission is completely secure.
10. Changes and contact
We will update the date at the top when this policy changes. Questions: use the support form .