Documentation · Reference
Data, privacy and deletion
What the plugin sends, what Operanse keeps, and how to delete it. The policies themselves are the Privacy Policy, the Data Processing Addendum and the Sub-processors list; the security page describes how the boundaries are enforced.
Before pairing
Nothing is sent. Activating the plugin records nothing. Pairing sends a one-time pairing token, the site's address, and the plugin, WordPress and PHP versions.
After pairing
The plugin sends the same data on every plan. Free text is redacted on your server before it is buffered.
| Family | What is sent | What is never sent |
|---|---|---|
| Heartbeat, every five minutes | Versions, the site address, whether cron is running, the buffer's state, scheduled-action and renewal counts, and whether the store can take an order: how many payment methods are on, the status of the checkout, cart and shop pages, how many products are in stock. | Order or customer details, page titles or ids. |
| Orders, payments, refunds, subscriptions | The order or subscription number, status, payment method, created-via, total, currency and item count; refund amounts; a subscription's total and billing period. When Stripe refuses a payment, Stripe's short reason code. | Anything about the customer. Stripe's message, the customer or the card. |
| Integrations | Submissions and failures per form; whether WordPress handed mail to your mailer, as counts and error classes; the host names your site calls with outcome and timing; your WooCommerce webhooks' topic, status, delivery host and consecutive failures. | Addresses, subjects or message content. Paths, queries, headers or bodies. A webhook's name, full address, secret or payload. |
| Changes and who made them | Plugin, theme and WordPress changes; saves of WooCommerce, payment, shipping, tax, permalink, site-address, caching and SMTP settings by name and which fields changed; a product's status, price or stock status changing; whether the cart, checkout, my-account and shop pages were published or edited; role changes. Each with the user id, role and route. | Setting values. Prices and amounts. Page content. Login names, display names or email addresses. |
| Request timings | A 2 % sample: route type, duration and status code. | Addresses, visitors, cookies or sessions. |
| PHP errors | New lines from the PHP error log, at most 1 MB per run, redacted before buffering; counts by level and three samples per level. | Anything the redactor removes: paths are reduced to file names. |
| Server resources | CPU, load and memory from /proc and cgroup files, free disk space, database status counters, PHP cache status, PHP-FPM worker counts. | A process list, environment, hostname, user name or home path. Web server access logs and syslog are never read. |
| Structure discovery | Hook names, REST routes, scheduled hooks, external domains called, table names, class and function names of your active plugins and theme. For each page a form is on, the page's id, title and address. | Source code. wp-config.php or .env files. |
| Answers to read jobs, paid plans | To investigate an order: its line items (product id, quantity and line total) and up to ten of its internal order notes, redacted first. | Notes are free text, so avoid writing card or identity details into order notes. |
No visitor data exists anywhere in this: no addresses visited, referrers, cookies, sessions, IP addresses or visitor identifiers.
Operanse also contacts your site
Our servers request your home page and a status address (/?wc-api=operanse-probe, which answers only when the site is paired) to check uptime. The requests identify themselves with a user agent beginning operanse-uptime/. In the direct inbound connection mode only, Operanse sends signed requests to the REST route operanse/v1/read.
Retention
Raw events are kept for 30 days on Watch and Monitor and 90 days on Insight. Aggregated metrics are kept to provide baselines and history. Evidence for an incident is kept with the incident. On Watch, the dashboard shows 7 days and alerts come from the heartbeat and uptime checks only; the rest is kept so an upgrade can build a baseline straight away, and none of it goes to an AI provider. On Insight, labelled and redacted evidence about a critical incident is sent to Anthropic to write the review, under an agreement that does not allow it to be used to train models.
Deleting your data
On your site. Deactivating the plugin stops its scheduled work and leaves its data in place, so reactivating picks up where it left off. Deleting it (Plugins → Delete, or wp plugin uninstall operanse-agent) removes everything the plugin put on the site and nothing else: its options and transients, its two tables, its scheduled events, and its buffer directory, but only when that directory holds nothing except the plugin's own files. The directory you named in OPERANSE_DATA_DIR is left for you to remove.
On Operanse. Deleting the plugin does not delete the site's data here. Open the site in the dashboard and use Settings → Delete this site; to close your account, use Account → Close account. Both disconnect the plugin and remove the stored data. The record of who deleted a site stays in the organisation's audit log. If you cannot sign in, email privacy@operanse.com.