AI Support Chat for WooCommerce
Privacy Notice
Last updated: 29 August 2026
This notice covers the AI Support Chat for WooCommerce plugin specifically. For how Mondivio Solutions handles data as a company — this website, sales, and client work — see our company privacy policy.
AI Support Chat runs entirely on your own WordPress server. Conversations, customer email addresses and order data are stored in your own database. They are never sent to Mondivio, and we have no technical means to read them.
That makes you the controller of that data under the GDPR, and it is your own privacy policy that must describe it to your customers. Mondivio is not your processor for it, because it never reaches us.
1. What the plugin stores on your server
On activation the plugin creates three database tables inside your WordPress installation:
| Conversations | Session key, start and last-activity time, language, visitor IP address, WordPress user ID (if the visitor is logged in), message count, and the email address used for a hand-off, if any. |
|---|---|
| Messages | The text of each message in the conversation, with its role (customer or assistant) and timestamp. |
| Tickets | Ticket reference, customer email address, a summary, and the conversation transcript. |
Nothing else is written, and none of it leaves your server except as described in section 2.
Your controls
- IP storage is configurable: off, anonymised, or full.
- Conversation retention is limited and configurable; older conversations are pruned automatically.
- API keys are encrypted at rest in your database.
- WordPress privacy tooling is supported: an export or erasure request raised through WordPress removes or exports that customer’s conversations and tickets.
2. What leaves your server, and where it goes
Three things can leave your server. Each is listed here in full; there is no fourth.
a. Your AI provider — on every question
To answer a question, the plugin sends the conversation and the relevant store context (matching products, prices, stock, and the knowledge pages you have added) to the AI provider you select, using your own API key. Supported providers are OpenAI, Anthropic and Google, plus any OpenAI-compatible endpoint you configure, such as OpenRouter or a self-hosted gateway.
Your relationship with that provider is direct: their terms, their data-processing agreement, their retention policy, their region. Mondivio is not a party to it and receives no copy. Because you bring your own key, you can choose a provider whose terms suit your business and switch at any time.
b. Your ticket webhook — only if you configure one
You may optionally set a single HTTPS endpoint to receive new tickets. When set, each new ticket is POSTed to that URL as JSON, signed with an HMAC-SHA256 signature so the receiver can verify it came from your store. The endpoint is whatever you point it at — a helpdesk inbound URL, an automation platform such as Zapier or Make, or your own service. This is off by default, plain HTTP URLs are rejected, and the data only ever goes where you send it.
c. Freemius — licensing, and optional usage data
The plugin bundles the Freemius SDK to validate a paid licence and deliver updates. Licence validation contacts Freemius so your subscription can be confirmed.
On activation, Freemius separately asks whether you want to share basic environment and usage data about your site. This is opt-in. You can decline and keep using the plugin in full. If you accept, that data goes to Freemius under their privacy policy.
3. Email hand-off
When the assistant cannot resolve a question, it can offer a hand-off. With the customer’s consent and email address it creates a ticket with a reference number and the transcript, and sends it by email to the address you configure — using your own WordPress mail configuration. The message goes from your server to your inbox; it does not pass through Mondivio.
4. Guest order lookup
A customer asking after an order must supply both the order number and the billing email address on that order. The two are verified together before anything is returned, lookups are throttled per IP address to prevent enumeration, and the assistant is only ever given a safe summary of the order rather than the full record.
5. What Mondivio receives
In the ordinary course of running the plugin: nothing. We receive data from you only when you choose to send it — when you email support@mondivio.com, or when you buy a licence, in which case Freemius as Merchant of Record shares your licence and billing email with us so we can support you. Both are described in our company privacy policy.
If you send us a screenshot, a log or an export while asking for support, please redact anything you would not want us to see. We keep support correspondence only as long as we need it to help you.
6. What you should tell your own customers
Because you are the controller, your own privacy policy is where this has to be disclosed. At minimum, tell your customers:
- that an AI assistant handles support chat on your store;
- which AI provider receives their messages, and a link to that provider’s policy;
- that conversations are stored on your server, and for how long;
- where their ticket data goes if you have configured a webhook or an external helpdesk.
If it helps, we are happy to review your wording — just email us.
7. Questions
Email support@mondivio.com for anything about the plugin, or info@mondivio.com for anything about Mondivio. We reply within one business day.
Note that we cannot act on a request about data held inside a AI Support Chat installation on a shop you visited — we have no access to it. Please contact that shop directly.
8. Changes
If we change this notice we will update the date at the top of the page. Changes that affect what leaves your server will be announced in the plugin changelog as well.