Your site's data, and what we do with it.

1. What we collect

• Your account. Your name, your email address and a bcrypt hash of your password. We never store the password itself.
• The sites you connect. The site address, its WordPress, theme and plugin details, and the results of its health checks and daily security scans.
• Your requests. What you ask for, the replies, and the page content a request is about.
• Your change history. Drafts, approvals, rejections, restore points and an append-only log of what was done. This is what makes undo and the audit trail work.

We don't collect payment card numbers on this website, and this marketing site runs no analytics or advertising trackers.

2. What the plugin can't read

The plugin reads your site through WordPress. Its file search refuses, by filename and before anything is opened, wp-config.php, wp-config-sample.php, .env, .env.local and .htpasswd. Those files are never read, sent or stored. The plugin has no way to write files on your server.

When you connect a site, you sign in with your Kepteo email and password inside WordPress. The password is used for that sign-in only and is not saved on your site.

3. How the AI sees your requests

No AI runs on your server. On the Managed plan, your request and the parts of your site it concerns are sent to AI models through OpenRouter, a service that routes requests to model providers, so a draft can be prepared. On Self-Serve, the AI client you connect (such as Claude, Codex or Cursor) receives that information under your own account with that provider.

Whichever plan you're on, what the AI prepares is a draft. Nothing reaches your live site until you approve it.

4. Cookies

We set one cookie when you sign in: ss_session. It is httpOnly, so scripts on the page can't read it, and it keeps you signed in for up to 30 days. Signing out removes it. We set no tracking or advertising cookies.

5. Where it's stored

Kepteo runs on Fly.io. Our primary region is Singapore. Our AI provider processes requests on its own infrastructure, as described above.

6. How long we keep it

Your change history is kept while your account is open, because undo depends on it. If you want your account and its data deleted, email us and we'll confirm when it's done.

7. Your choices

• Disconnect a site at any time by deactivating the plugin. Kepteo can no longer reach it.
• Ask for a copy of the data we hold about you.
• Ask us to correct or delete it.

We never sell your data, and we don't use your site's content to advertise to you.

8. Contact

Questions about privacy, or any of the requests above: hello@kepteo.com.