Vidal Security AI — Privacy Policy

The short version

The free plugin works entirely inside your WordPress site and sends us nothing. If you activate the AI Guardian (premium), your site sends us security events only — never passwords, never payment data, never your customers' order content — so our service can tell an attack from noise and explain it to you.

1. The free plugin (no connection)

Installed on its own, Vidal Security AI runs 100% locally on your server: security scans, hardening settings, email alerts, bot shield, checkout protection, anti-fraud scoring, payment monitoring and two-factor authentication all operate inside your WordPress database. Anti-fraud scores and payment monitoring are computed locally. No order, customer or payment data ever leaves your site. The plugin sets no visitor cookies of its own. If you enable Cloudflare Turnstile with your own keys, Cloudflare's widget applies under Cloudflare's policy.

2. The AI Guardian (premium, opt-in)

When you enter a site key and enable the Guardian, the plugin periodically sends security event batches to our service. What is sent: event type (failed login, probe, file change, etc.), timestamp, the visitor IP address involved, browser user-agent, requested path, and the username that was attempted. What is never sent: passwords (typed or hashed), payment details, order contents, customer records, post content, or your site's files. Why: our service aggregates events into patterns and uses an AI model (provided by OpenAI) to classify each pattern as noise or attack, decide a proportionate response (temporary IP block) and write a plain-language explanation for you. IP addresses are processed for the legitimate interest of securing your site; blocking decisions are automated but always reversible by you, and your allowlist always wins.

3. Retention

Raw event patterns and verdicts are kept while your subscription is active and for up to 90 days afterwards, then deleted or anonymised into aggregate statistics. Your site key is linked to your domain and billing account solely to operate the service.

4. Sharing

We do not sell your data, and we never use it for advertising. Data is shared only with the processors needed to run the service (hosting and the AI model provider) under their security terms.

5. Your rights and controls

Disconnect at any time: remove the site key and the plugin returns to full local (free) operation; no further data is sent. You may request export or deletion of your site's service data through the contact form on this website. Site owners remain the data controllers of their own WordPress sites; for Guardian processing we act as your processor.

6. Changes

We will post changes on this page and note them in the plugin changelog. Last updated: October 15, 2026. Vidal Security AI is operated by Vidal Digital Miami.