Data, GDPR and retention
What data Aimogen Pro sends to AI providers, what it stores locally, retention controls, and what GDPR compliance requires of you.
This page describes the data flows so you can make an informed compliance assessment. It is not legal advice.
What leaves your site#
Every AI request sends its prompt to the configured provider. Depending on the feature, that prompt can include:
| Feature | Sends |
|---|---|
| Content generation | Your prompts, keywords, topics, and any injected context |
| AI Content Editor | The full content of the posts being edited |
| Chatbot | Every visitor message, plus the conversation history, plus Bot Context |
| Chatbot with user placeholders | Whatever %%user_email%%, %%user_name%% and similar resolve to |
| Retrieval | The retrieved chunks of your indexed content |
| Internet access | Scraped page content |
| File and PDF chat | The uploaded document |
| Agents | Everything their tools return, including database rows |
| Image generation | The image prompt |
| Text-to-speech | The text spoken |
| Transcription | The audio file |
Requests go to whichever provider you configured. If you use AiomaticAPI or OpenRouter, there is an additional party in the chain.
Your site also contacts wpinitiate.com for licence verification and update checks.
Provider retention#
Store AI Prompts On OpenAI's Part maps to the provider store parameter. With it off, the provider
is asked not to retain the request beyond what its own policy requires.
The setting exists separately for the writer (Settings › Advanced AI Settings), the chatbot (AI Chatbot › API Parameters), AI Forms and per rule.
Providers publish their own retention policies and offer data processing agreements. Review those for the providers you use.
What is stored locally#
| Data | Where | Controlled by |
|---|---|---|
| Every API request: user, IP, model, tokens, price | {prefix}aiomatic_logs | Enable Usage Tracking |
| Prompt and response text | {prefix}aiomatic_logmeta | Enable Detailed Usage Tracking |
| Chatbot conversations | aiomatic_user_data posts | Remember Chat Conversations |
| Captured leads | aiomatic_lead posts | Lead capture |
| Uploaded chatbot images | Media | Chatbot AI Vision Uploaded Files Expiration Date |
| Uploaded PDFs | Media | Uploaded PDF Files Expiration Date |
| AI Form submissions | Post data | Disable AI Form Saving |
| Agent execution history including prompts | {prefix}aiomatic_agent_runs | Agent usage |
| Indexed content as embeddings | Your vector store | Indexing |
Three of these hold personal data by default on a site with a public chatbot: the logs (IP addresses), the conversations, and the leads.
Retention controls#
| Control | Where | Governs |
|---|---|---|
Auto Clear Logs | Settings › General Settings | Scheduled log clearing |
| Retention options | System & Logs › Limits & Statistics Settings | What is kept, and for how long |
Chat Logs Expiration Time For Not Logged In Users (Seconds) | AI Chatbot › History & Logs | Guest conversations |
Maximum Stored Conversations Count | AI Chatbot › History & Logs | Per-user and per-guest caps |
Chatbot AI Vision Uploaded Files Expiration Date | AI Chatbot | Uploaded images |
Uploaded PDF Files Expiration Date | AI Chatbot › PDF Chat | Uploaded PDFs |
Delete Logs | System & Logs › Maintenance | Immediate clearing |
Expiry is enforced by the aiomatic_expired_post_delete cron event.
Set these. Storing indefinitely is a choice, and under GDPR it is one you would have to justify.
GDPR obligations, practically#
If you are in scope, these follow from the flows above.
A lawful basis. For a chatbot, that is usually legitimate interest or consent, documented.
Transparency. Your privacy policy should state that conversations are processed by an AI provider,
name the provider or the category, and state retention. Chat Compliance Text puts a short notice under
the chat input; %%privacy_policy_url%% links your policy from a prompt.
Consent where required.
Require GDPR Consent Before Users Can Access The Chatbot shows a consent gate before the conversation.
See Moderation, GDPR and limits.
A processing record. Aimogen Pro is a processor of the data you put through it; the AI provider is a sub-processor. Your Article 30 record should reflect that chain.
Data subject rights. You need to be able to find and delete a person data. Conversations are
aiomatic_user_data posts; leads are aiomatic_lead posts; log rows carry userId and ip. All are
queryable and deletable.
International transfers. Most providers process outside the EEA. Check the transfer mechanism your provider relies on.
A DPA. Have one with each provider you use.
Reducing exposure#
The most effective measures, in order:
- Do not store what you do not need. Turn detailed usage tracking off in production.
- Set short retention on conversations and uploads.
- Turn provider retention off.
- Tell visitors not to send sensitive data. One line in
Chat Compliance Textcosts nothing. - Do not put personal data in prompts unless the feature requires it. Avoid
%%user_email%%in Bot Context unless the bot genuinely needs it. - Use Ollama with a self-hosted vector store where the data must not leave your infrastructure at all.
That last option is the only configuration where no content reaches a third party.
Children and special category data#
If your site serves children, or handles health, financial or other special category data, the analysis is materially stricter. A general-purpose chatbot is probably not appropriate without specific advice.
Related#
Still stuck? Open a support ticket and include the diagnostics from Aimogen Pro › System & Logs › System Info.