Privacy policy
The short version
- This website sets no cookies and runs no analytics or advertising trackers.
- Unstale is bring-your-own-key. Your key lives in WordPress, not in the plugin, and neither your key nor your content is ever sent to our servers.
- Payments are processed by Paddle, our merchant of record. We never see your card details.
Who we are
Unstale is a product of Web & SEO Ltd ("we", "us"), a company registered in Hong Kong under company no. 1826120, at Unit G, 15/F, Tal Building, 49 Austin Road, Jordan, Kowloon, Hong Kong. Web & SEO Ltd publishes the Unstale WordPress plugin and the Unstale Pro add-on, operates the unstale.ai website, and is the data controller for the personal data described in this policy.
For any question about this policy or your data, write to [email protected], or to the postal address above.
What we collect on this website
Our web server keeps standard access logs: IP address, browser user agent, requested URL and timestamp. We use them for security and to keep the site running, and we delete them within 30 days.
This site currently sets no cookies at all, which is why you do not see a cookie banner. If that ever changes, this policy will be updated first.
When you buy Unstale Pro
The checkout is run by Paddle, our merchant of record. Paddle collects your name, email address, billing address, payment details and the information required to handle taxes. Their processing is described in the Paddle privacy policy.
From Paddle we receive your name, your email address, the product you bought and the transaction reference. We use them to issue your license key, send it to you by email and provide support. We never see your full card number.
When you activate a Pro license
The Pro add-on contacts our license server when you activate, validate or deactivate a license. Each request contains your license key, your site URL and the plugin version. We store this to enforce the site limit of your plan, deliver Pro updates and apply the 14-day grace period if validation fails. We do not sell or share this data.
What we never collect
- Your AI provider credentials. Since WordPress 7.0 they are held by WordPress itself, in Settings > Connectors, and the plugin never reads them: it only checks that a provider is connected. Every AI request goes directly from your server to the provider you connected.
- Your posts, drafts, rewrites or any other site content. The rewrite pipeline runs entirely between your server and your AI provider.
- Any browsing or usage analytics. The only request the free plugin makes to unstale.ai is the anonymous model catalog fetch described below.
The model catalog
The free plugin fetches https://unstale.ai/api/v1/models.json once every 24 hours. It is a public, static JSON file listing the supported model ids, their prices and their notes, so that a new provider model shows up in your settings without a plugin update.
The request is an unauthenticated GET. It carries no content, no credentials, no license key and no site identifier. As with any web request, our server logs record the originating IP address, and those logs are deleted within 30 days as described above. If the request fails, the plugin keeps using the catalog bundled in its own files.
Third-party AI providers
When WordPress calls the provider you connected, that traffic is between your server and the provider, under their own terms: Anthropic, OpenAI or Google. Pick the provider whose terms suit your content.
Support email
If you write to us, we keep the conversation so we can help you and improve the product. Ask us to delete it at any time.
Your rights
You can ask for a copy of the data we hold about you, have it corrected or deleted, or object to its processing. Email [email protected] and we will answer within 30 days.
Changes to this policy
Any change will be posted on this page with a new "Last updated" date. Material changes will also be listed in the changelog.