WotWP

Legal

Privacy Policy

Last updated: October 14, 2026. This policy explains how WotAI handles personal information through WotWP at wotwp.com. WotWP provides WordPress-to-static-site assessment and migration services.

Who is responsible

WotWP is operated by WotAI. In this policy, “WotAI,” “WotWP,” “we,” and “us” refer to the operator of this website and the candidate-site process. Privacy questions and requests can be sent to hello@wotwp.com.

Information we collect

Candidate-site form

The form collects:

Never send credentials through this form. Do not provide WordPress, hosting, domain, DNS, analytics, or other passwords, access tokens, private keys, or login details. The form does not ask for them.

Instant site check

When you ask for the instant check, WotWP’s server loads a limited number of pages and files from the address you entered, such as the home page, robots.txt, and sitemaps, and shows you what they reveal. The check reads only pages and files that anyone can load without logging in. It identifies itself as WotWPSiteCheck with a link to this policy, stops if the site’s robots.txt asks all automated tools not to crawl, and does not log in, submit forms, or change the site.

An instant check you do not submit is not kept in WotAI’s records or operational logs. Its only trace is one added to an anonymous daily count of completed checks, grouped by the check’s result (a good fit, needs a closer look, or probably not a fit); that count holds no address, site, IP address, or other detail about you or the site. Your IP address and the address you entered are used briefly to verify the Turnstile challenge and to limit how often checks can run. The result WotWP sends back to your browser is signed so the form can show it was not changed, and a signed result expires 30 days after the check. If you submit the form, the instant-check summary is included in the confirmation email described below and stored with the candidate request.

Essential technical information

Cloudflare helps deliver and secure the site. Its services may process network and device information such as an IP address, request details, browser information, and security signals. The candidate form uses Cloudflare Turnstile to distinguish people from automated traffic. Turnstile processes the challenge token and browser or device signals needed for that security check; WotAI sends the token and, when available, the request IP address to Cloudflare for verification. Turnstile is not used to read the answers typed into the form.

Email and correspondence

Cloudflare sends the automated submission confirmation from notifications@wotwp.com to the business email provided. The submitted details are also routed privately to WotAI’s Google Workspace inbox for response and to Attio for customer-relationship management. Google Workspace handles replies and later correspondence. These systems process the submitted candidate-site details and any information you later choose to send by email.

Candidate-request records

After Turnstile verifies a submission, WotWP stores the form fields listed above in a Cloudflare D1 database together with a reference number, receipt time, confirmation-email delivery status, and the result of the instant check on the site you submitted — the same findings the confirmation email shows you, or a note saying the check did not run. That result is the checker’s own fixed list of observations about a public site, not free text. When a check ran, the record also holds its fit result, the price estimate WotWP calculated from it, and when the check was run. The record notes whether you were offered the referral fee for people who build sites for clients, and any referral code you entered. That offer follows the relationship you choose, or, if you are signed in, whether the site lists you keep with WotWP hold more than three sites. A request made before the readiness audit was retired may also hold the payment-link token WotAI issued for it and the time it was issued; that link no longer opens a checkout. WotWP does not store the Turnstile token, request IP address, or hidden spam-trap value in that candidate-request record.

The form has no field intended for passwords or access credentials, and WotAI does not intentionally collect them. Free-text answers are stored and included in the confirmation email as submitted, so a credential entered there by mistake may be processed. If that happens, rotate or revoke it immediately and email hello@wotwp.com to request deletion.

Account sign-in

WotWP has no passwords and never asks for one. If you ask for a sign-in link, WotWP stores a record of that request in its Cloudflare D1 database: your email address, the time it was asked for, the time it expires, and the time it was used. It also stores a record of the session that link opens: your email address, and when that session was created and expires.

The same email carries a six-digit code for signing in on another device. WotWP stores only a one-way digest of the code, filed under a one-way digest of your address, with when it was sent and when it expires, fifteen minutes later. The record is deleted when the code is used or a newer one replaces it. To stop anyone guessing codes, the times codes were sent and wrong codes were tried for that digest of your address are kept for 24 hours and then deleted, and nothing else about the attempt is kept.

Neither record holds the link or the session value itself, only a one-way digest of each, so the stored record cannot be turned back into a way to sign in. Two cookies are used, both of which your browser will not let a page script read: one ties a sign-in link to the browser that asked for it, and one carries the session. Signing out deletes the session record, not just the cookie.

Payment records

Payment is taken on Stripe’s own hosted page. WotWP never receives, sees, or stores card numbers, security codes, or any other card details, and no part of the site has access to them.

WotWP no longer sells the readiness audit. For an audit paid for before it was retired, WotWP keeps the payment record Stripe’s notification created in the same Cloudflare D1 database: the request reference, Stripe’s checkout session, payment intent and customer identifiers, the amount and currency Stripe reported, the time it was paid, and the delivery status of the payment confirmation email. WotWP does not store your card details, billing address, or the payment method you chose.

Hosting records

When WotWP launches your site, offers to host it, or hosts it, WotWP keeps these records in the same Cloudflare D1 database, each filed under the site’s request reference. A hosting subscription is paid on Stripe’s hosted page in the same way as other payments.

WotWP stores no Stripe customer identifier for hosting. To start a subscription, WotWP gives Stripe the site’s request reference. If you paid for a readiness audit with the address you signed in with, WotWP bills the subscription to the Stripe customer your own earlier audit payment created, so your invoices stay together; otherwise it gives Stripe that email address instead.

WotAI’s own inbox is emailed about every change in a subscription’s status (started, payment failed, payment recovered, cancelled, or ended), with the site’s reference, the old and new status, when serving ends, and Stripe’s identifier for the subscription. If one site ever has two live subscriptions, the email names the site’s reference and both of Stripe’s subscription identifiers with their statuses. It is also emailed when an export is requested, and when a monthly check finds the site got worse. The monthly certificate itself is emailed to the business email address the site was submitted with.

Portfolio scan records

If you are signed in, you can paste a list of sites you look after so WotWP checks them a few at a time. WotWP stores that list in the same Cloudflare D1 database against the email address you signed in with: each site's address reduced to its scheme and host (so http://, https:// and www. spellings of one site count once), whether it has been checked yet, the result of each public check, and when it ran. An address WotWP will not check is shown back to you with the reason, and is not stored.

Each site in a list is checked the same way the instant check on the homepage checks one site: WotWP reads public pages only, stores no page content, and never signs in to anything. A single-site instant check that you do not submit as part of a list is not stored at all.

A portfolio list is visible only to the signed-in address that submitted it. It is kept while that relationship is active and deleted with the rest of your records on request.

Site audit records

When a business asks WotWP for a preview, or when WotWP is preparing to contact a business, WotWP may look up public search, business-listing, and AI-answer data about its website through a data provider, DataForSEO. WotWP sends DataForSEO the website’s address, the business’s trade and town, and, when WotWP has it, the business name. Without a business name, WotWP sends up to three phone numbers instead, so DataForSEO can find the business’s listings: the one WotWP has for the business, if any, and those the site’s own public home page lists. DataForSEO returns public information about the business and its website: the search terms the site appears for, its positions in local search results, the Google Business Profile listings that match the business (their names, addresses, phone numbers, categories, ratings, and review counts), one ChatGPT answer to a question about the trade and town with the websites it cites, links to the site from other websites, and speed measurements of its home page. WotWP also reads the site’s public home page the same way the instant check does, and notes the phone numbers, business name, and address the page states.

WotWP stores the request, the results described above (the search terms and positions, the matching listings, the ChatGPT answer’s cited websites, link counts, and speed measurements), and the phone numbers, business name, and address read from the site’s home page in the same Cloudflare D1 database, with the cost and time of each lookup. It does not store review text, reviewers’ names, or the provider’s full responses. Audit records are seen only by WotWP’s operator; no page of this site shows them.

Optional analytics

Google Analytics and PostHog are not loaded until you choose “Allow analytics.” If you consent, they may process a browser identifier, IP-derived or approximate location, device and browser details, referring page, pages viewed, page-leave information, and limited interaction events such as CTA clicks, whether the instant check finished or could not run, and whether the candidate form was started, completed, or encountered an error.

WotWP does not intentionally send your name, email address, organization name, relationship to the site, candidate URL, instant-check results, approximate URL count, dynamic-feature selections, free-text form answers, request reference, or any payment amount or identifier to analytics. PostHog autocapture and session recording are disabled, and WotWP does not identify visitors to PostHog. Google advertising signals and ad-personalization signals are disabled in the site configuration.

WotWP operators may label their own browser traffic as internal for measurement hygiene. When analytics consent is present, this adds only an internal event property in PostHog and an internal traffic type in Google Analytics; it is not used to identify ordinary visitors.

Why we use information

We use information to:

Where applicable law requires a legal basis, the basis may be taking steps you request before a possible contract, WotAI’s legitimate interests in responding to business inquiries and operating a secure website, your consent for optional analytics, or compliance with law. Submitting the form does not create a client relationship.

Public-site review authorization

By checking the authorization box and submitting a candidate URL, you confirm that you may share that URL and authorize WotAI to review pages and resources that are publicly accessible without logging in. This permission is limited to a read-only preliminary review of the public site. It does not authorize access to WordPress, hosting, domain, DNS, analytics, or any non-public system, and it does not transfer ownership of the site or its content.

A submission is only a request for review. It does not guarantee acceptance, pricing, results, or eligibility, and no client relationship begins unless WotAI and the client sign a separate written agreement.

Service providers and disclosures

WotAI uses service providers only as needed to operate WotWP:

We may also disclose information when required by law, to protect rights or safety, to investigate abuse, or as part of a business reorganization where the recipient assumes the relevant privacy obligations. WotWP does not sell personal information.

International processing

These providers operate across countries. Information may be processed in the United States and other places outside the country where you live, where privacy laws may differ. Provider terms and privacy notices describe their processing locations and transfer safeguards. WotAI will use any additional transfer protections required by applicable law.

Retention and deletion

WotAI keeps D1 candidate-request records, D1 payment records, D1 hosting records, D1 sign-in and session records, D1 portfolio-scan records, D1 site-audit records, Attio CRM records, confirmation emails, and related correspondence only while reasonably needed to evaluate and respond to the request, manage a resulting business relationship, protect the service, meet legal or accounting obligations, or resolve disputes. Cloudflare and other providers may also retain delivery, security, or service logs under their own terms.

When information is no longer needed, WotAI will delete it or de-identify it where practical. You may request deletion by emailing hello@wotwp.com. A request may not remove information that must be retained by law or is needed to establish or defend legal claims.

[OWNER DECISION REQUIRED: retention schedule] Approve a written operational schedule and deletion process for declined, inactive, and completed D1 candidate-request records, Attio CRM records, and related email.

Your privacy choices and rights

Depending on where you live, you may have rights to ask for access, correction, deletion, restriction, objection, or portability of personal information, and to withdraw consent. You may also have the right to complain to a privacy regulator. These rights can be subject to legal exceptions.

Use the control to withdraw or change analytics consent. This does not affect processing that occurred before withdrawal. To make another privacy request, email hello@wotwp.com. We may ask for enough information to verify that the request concerns you.

Changes to this policy

We may update this policy as WotWP’s services or legal obligations change. We will post the revised policy here and update the date above. Material changes will be highlighted where reasonably appropriate.