Privacy policy

Last updated: October 7, 2026

The short version

This website sets one cookie, and only if you arrive through a partner's link: it remembers which partner sent you, so they can be credited if you buy. It measures audience with Cloudflare Web Analytics, without cookies, without tracking you across sites and without storing anything on your device, to produce anonymous, aggregated statistics. It runs no advertising trackers, and you can use the site and buy without accepting this cookie: only the attribution to the partner will not work. The one third-party player, used by the videos in the docs, loads from YouTube only when you click play, and Google then handles what it collects under its own policy.
Unstale is bring-your-own-key. Your key lives in WordPress, not in the plugin, and neither your key nor your content is ever sent to our servers.
Payments are processed by Paddle, our merchant of record, under the Paddle privacy policy. We never see your card details.

Who we are

Unstale is a product of Web & SEO Ltd ("we", "us"), a company registered in Hong Kong under company no. 1826120, at Unit G, 15/F, Tal Building, 49 Austin Road, Jordan, Kowloon, Hong Kong. Web & SEO Ltd publishes the Unstale WordPress plugin and the Unstale Pro add-on, operates the unstale.ai website, and is the data controller for the personal data described in this policy.

For any question about this policy or your data, write to hello@unstale.ai, or to the postal address above.

What we collect on this website

Our web server keeps standard access logs: IP address, browser user agent, requested URL and timestamp. We use them for security and to keep the site running, and we delete them within 14 days.

We do not use any advertising trackers on this website. The one third-party player, used by the videos in the docs, loads from YouTube only when you click play, as described under Videos from YouTube below.

The content refresh checklist remembers the boxes you tick in your own browser, in its local storage, so they survive a reload. That record never leaves your device: nothing about it is sent to us or to anyone else. The Untick all button, or clearing this site's data in your browser, deletes it.

This site sets one cookie, aff_ref, and only when you arrive through a link from one of our affiliate partners (a link that ends in ?ref= followed by the partner's code) and you click "Accept" on the banner shown on that first visit. It holds that code and nothing else, lasts 60 days, is sent back only to unstale.ai, and cannot be read by scripts (HttpOnly, Secure, SameSite=Lax). If you click "Refuse" or close the banner without choosing, no cookie is set and no affiliate-related request is made. When you buy, the code, if present, travels with your order to Paddle, our merchant of record, so that the partner who referred you can be paid a commission. You can withdraw your choice at any time via "Manage cookies" in the footer, which will delete the cookie if it was set.

On that first visit, and only after you click "Accept", your browser also loads a 1x1 image from partners.licenseos.net, our affiliate service, which counts the visit once per day. For that count it creates a daily pseudonymous fingerprint of your IP address (HMAC-SHA256 of the IP and the current date with a secret key we hold), never the IP address itself, and its server log keeps the page you came from (referrer) and your browser type (User-Agent) for 14 days. The fingerprint changes each day; without our secret key it cannot be linked from one day to the next, but with the key, which we hold, we could verify whether a known IP address visited on a given day. Arriving without a partner link, or declining the banner, sets no cookie and loads no such image.

When you click "Accept" or "Refuse" on that banner, or delete the cookie under "Manage cookies", we record the choice with its date and time and the version of the banner you saw, without your IP address or the partner's code, so that we can prove it. We keep each record for at least 6 months and delete it within 7 months.

Analytics without cookies: measuring the audience of unstale.ai

We measure audience with Cloudflare Web Analytics (Cloudflare, Inc., USA). Cloudflare acts as our processor under its Data Processing Addendum at https://www.cloudflare.com/cloudflare-customer-dpa/. That Addendum incorporates the EU Standard Contractual Clauses, and Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers to the United States are covered by that certification and, where it does not apply, by those Clauses.

The beacon (from static.cloudflareinsights.com) sets no cookie and uses no localStorage or sessionStorage, does not fingerprint you, and does not track you across sites. For our site it counts page views, page path, referrer, country-level location, browser and operating system, device type and Core Web Vitals, only to produce anonymous, aggregated statistics for us. Cloudflare keeps full-detail data for 7 days and then only a sample of about 10%; we can see the last 6 months of statistics.

You can object at any time: turn on Do Not Track or Global Privacy Control in your browser, or click "Object to analytics" below. Your choice is kept in this browser's local storage, and the beacon will not load on your next visits from this browser.

Cloudflare also collects and stores Network Data: models, observations, reports, analyses and statistics derived from traffic in the course of providing the service, including service uptime and availability, request volumes, error rates, cache rates and IP threat scores, for its own security and operations. That processing is done by Cloudflare as independent controller under its privacy policy and not as part of our audience measurement.

Videos from YouTube: the videos in the docs

The videos on the documentation page are hosted on YouTube. Until you click play, nothing loads from YouTube or from any other Google service: the page shows a still image served by unstale.ai and a link for each video. When you click play, your browser loads the player from youtube-nocookie.com, run by Google. From then on Google receives your IP address and the usual data your browser sends with any request, such as its type and the fact that you came from unstale.ai, and the player may store data in your browser, such as cookies or local storage. Google handles that data under Google's privacy policy, and may transfer it to the United States, where Google LLC is certified under the EU-U.S. Data Privacy Framework.

If you would rather not, do not click play: the written steps on the same page cover everything the videos show. Without JavaScript, the play button is a plain link that opens the video on youtube.com.

When you buy Unstale Pro

The checkout is run by Paddle, our merchant of record. Its script loads only when you click a buy button on the pricing page. Paddle collects your name, email address, billing address, payment details and the information required to handle taxes. Their processing is described in the Paddle privacy policy.

From Paddle we receive your name, your email address, the product you bought and the transaction reference. We use them to issue your license key, send it to you by email and provide support. We never see your full card number. When you tick the box giving consent to immediate delivery on the pricing page, that consent, the version of its wording (2026-10-07.1) and the time of purchase travel with your order to Paddle as custom data. On our side, our license server at licenseos.net records that consent, its version and the server time of the Paddle webhook, and retains it for as long as your license remains valid and for 7 years thereafter so that we can prove it; Paddle also stores the custom data as part of the transaction record subject to its own retention.

When you activate a Pro license

The Pro add-on contacts our license server when you activate, validate or deactivate a license. Each request contains your license key, your site URL and the plugin version. We store this to enforce the site limit of your plan, deliver Pro updates and apply the 14-day grace period if validation fails. We do not sell or share this data.

We retain the email, transaction reference, license key and activation records for as long as your license remains valid and for 7 years thereafter to handle renewals, proof of purchase and tax records, unless a longer retention is required by law. Site URLs removed on deactivation are deleted from active records within 30 days.

What we never collect

Your AI provider credentials. Since WordPress 7.0 they are held by WordPress itself, in Settings > Connectors, and the plugin never reads them: it only checks that a provider is connected. Every AI request goes directly from your server to the provider you connected.
Your posts, drafts, rewrites or any other site content. The text of your posts goes only from your server to your AI provider. The public addresses of the YouTube videos a post embeds are checked with YouTube, as described below.
Any browsing or usage analytics from the plugin. The only request the free plugin makes to unstale.ai is the anonymous model catalog fetch described below.

The model catalog

The free plugin fetches https://unstale.ai/api/v1/models.json once every 24 hours. It is a public, static JSON file listing the supported model ids, their prices and their notes, so that a new provider model shows up in your settings without a plugin update.

The request is an unauthenticated GET. It carries no content, no credentials, no license key and no site identifier. As with any web request, our server logs record the originating IP address, and those logs are deleted within 14 days as described above. If the request fails, the plugin keeps using the catalog bundled in its own files.

YouTube video checks

When the free plugin refreshes a post that embeds YouTube videos, it asks YouTube's public oEmbed endpoint (https://www.youtube.com/oembed) whether each video is still available, and checks a replacement video the same way before using it. Each request is an unauthenticated GET sent from your server to YouTube, not to us. It carries the public address of one video and none of your post's text, no credentials and no license key. Each answer that settles whether a video is available is cached on your site for 24 hours. YouTube handles these requests under Google's privacy policy.

Third-party AI providers

When WordPress calls the provider you connected, that traffic is between your server and the provider, under their own terms: Anthropic, OpenAI or Google. Pick the provider whose terms suit your content.

Support email

If you write to us, we keep the conversation so we can help you and improve the product. Ask us to delete it at any time.

Your rights

You can ask for a copy of the data we hold about you, have it corrected or deleted, or object to its processing. Email hello@unstale.ai and we will answer within 30 days.

You also have the right to lodge a complaint with a supervisory authority in the EU, for example in the Member State of your habitual residence, place of work or where you consider an infringement occurred.

Changes to this policy

Any change will be posted on this page with a new "Last updated" date. Material changes will also be listed in the changelog.