Privacy Policy & Data Storage Practices

1. Information We Collect

When you register and use the Digent Smart AI Cloud Gateway platform, we collect the following categories of information:

• Account Information: Your name, email address, hashed passwords, and account subscription details.
• Connected Site Metadata: Your site URL, WordPress installation version, plugin version, site UUID, and connection status.
• Cryptographic Authentication Keys: Symmetric HMAC-SHA256 secret keys generated during the 1-Click Connect flow. These are stored strictly in AES-256 encrypted format.
• Relay Telemetry & Invocation Logs: Timestamps of tool invocations, tool names called (e.g. execute_wp_cli), latency duration, HTTP response status codes, and error codes. We do not persist payload contents indefinitely.

2. How We Store & Protect Site Secrets

Security is foundational to the Digent Cloud Gateway architecture. All site secret keys (sec_*) are encrypted using AES-256-CBC encryption before being written to the database.

The cryptographic key used to encrypt secrets is held securely in hardware security modules / isolated server environment variables, completely isolated from public-facing endpoints. When requests arrive from your AI client, the signature is computed dynamically in memory and the secret is immediately released.

3. Zero AI Model Training Guarantee

Digent Smart AI functions solely as a zero-knowledge pass-through gateway between your AI client (such as Claude Desktop, Cursor, or ChatGPT) and your WordPress server. We do not use your WordPress post contents, database entries, customer data, source code, or tool call inputs/outputs to train, fine-tune, or improve any machine learning or large language models.

4. Data Retention & Log Pruning

We retain invocation logs only as long as necessary to provide debugging, rate limiting, and security auditing:

• Free Tier Accounts: Relay invocation metadata is pruned automatically after 24 hours.
• Pro Accounts: Invocations are retained for 30 days for debugging and audit logs.
• Agency Accounts: Invocations are retained for up to 90 days.

When you disconnect or delete a site from your dashboard, the site UUID, associated secret keys, and invocation logs are immediately and permanently erased from our active database.

5. GDPR & CCPA Privacy Rights

Depending on your geographic location, you have statutory rights regarding your personal data:

• Right of Access: You may request an export of all account and telemetry data associated with your account.
• Right to Rectification: You may update your profile or account email at any time via your settings panel.
• Right to Erasure ("Right to be Forgotten"): You may delete your account and all connected site data instantly.
• Right to Restrict Processing: You may disable cloud relay traffic at any moment by revoking your API keys.

6. Contact Our Data Protection Officer

If you have questions about our privacy policies, data encryption, or data processing agreements (DPA), contact us at: privacy@digentsmartai.com.