Legal
Privacy policy
Last updated: 21 October 2026
Draft — have this reviewed before launch
Highlighted items in [brackets] are placeholders for company details.
What we collect when you use AKAISO, why, who we share it with and how long we keep it. In short: we collect what we need to check and monitor your websites, we never receive your files’ contents or card details, and we don’t sell data or track you with cookies.
1.Who we are
AKAISO (https://akaiso.com) is run by [Company legal name], [Registered address] (“we”, “us”). For account, billing and website data we decide how it is used, so we are its controller.
When the WordPress plugin reports activity from your site (for example, who logged in), that data is about your site’s users. For that data you are the controller and we process it for you, as described in the data processing summary.
2.What we collect
Your account
- Sign-in is handled by Clerk. Clerk holds your name, email address, password or sign-in method, and the organisations (workspaces) you belong to.
- We keep your Clerk user and organisation IDs, your workspace’s name and a contact email for it, and your plan.
Billing
- Payments are handled by Stripe. We keep your Stripe customer and subscription IDs and the subscription status.
- You enter card details on Stripe’s pages. They never reach our servers.
The websites you add
- The domain, how and when you proved you own it, and any notes you write about the site.
- Check results: the grade, each finding, the technologies we detected, and the issues they create, with their status.
- Subdomains found in public certificate logs, and look-alike domains registered by others.
- AI security reviews you request (the written report is stored).
- Results of AI security scans, where your plan includes them.
From the WordPress plugin
Nothing is sent until an administrator connects the plugin. After that it sends:
- Inventory: the site address, the WordPress and PHP versions, and the name, version and active state of each plugin and theme.
- File monitoring (can be switched off): the path, size, modification time and MD5/SHA-256 fingerprints of code files. File contents are never sent.
- Activity log (can be switched off): the type and time of logins, failed logins, account changes and plugin or theme changes, with the username, role and IP address involved. We add the country, looked up from the IP address.
- Findings we raise from this data, which can name a file path or a username (for example, “new administrator”).
Alerts, branding and connections
- Where you want alerts sent: email addresses and Slack, Microsoft Teams, Discord or webhook URLs, plus a record of each alert we sent.
- Branding for reports (Agency plan): a company name, a contact line, an accent colour and a logo. We store a PNG copy we re-encode ourselves, never the file you uploaded.
- If you connect Cloudflare: your API token (encrypted), and the zone’s name and ID.
- API keys and share links: we store only a fingerprint (hash) of each key or link, never the key itself.
The free check (no account needed)
- The free check only reads public pages: it visits the home page and a few public addresses (such as security.txt) the way a browser does, reads the TLS certificate and looks up public DNS records. It never logs in or tries to break in.
- We keep the latest result for each domain so it can be reused for an hour. It is not linked to you.
- We record your IP address and the time of each fresh check, so one address can run only a limited number of checks per hour.
Security records
- An audit log of important actions in your workspace: who did it (user ID), what they did, to which item, when, and the IP address the request came from.
- For AI features we record which issue or site was involved, the AI model used and how much it was used, so we can apply your plan’s monthly allowance.
Error reports
- When a page of the app fails, your browser sends us an error report: the error message, the page path (without the part after a “?”) and, if included, the browser’s user agent.
- Errors in our own servers produce a technical report of the failure. It does not include request bodies, cookies, IP addresses or the values of variables, and share-link tokens are removed from the page address.
- To rate limit these reports we keep your IP address only in memory, for up to an hour. It is not stored with the report or forwarded.
- Before a report is logged or forwarded we remove anything that looks like an email address, a token or a key. We then send it to our error-tracking service, [Error tracking provider], so we can fix the problem.
3.How the AI features use your data
Two features send data to an AI provider, and only when you use them:
- Ask about this issue (the assistant) sends the issue, the technology we detected on the site, your notes about the site and the conversation so far. We don’t store the text of your questions or the answers. We only keep the usage record described above.
- AI security review sends what we already know about the site: the domain, your notes about the site, check results, open issues, the plugin inventory, open monitoring findings (which can name a file path or a WordPress username), subdomains and look-alike domains. The review never contacts your website. The report it writes is stored in your workspace.
AI security reviews go only to Anthropic (Claude). The assistant’s requests go to Anthropic or to OpenRouter, which passes them to the AI model we have chosen. None of it is used to show you ads.
4.Why we use it (and our legal bases)
- To provide the service you signed up for
- Running checks, monitoring, alerts, reports, AI features and your account. Legal basis: performing our contract with you.
- To bill you
- Subscriptions and invoices through Stripe. Legal basis: our contract, and our legal duty to keep financial records.
- To keep the service safe
- Rate limits, the audit log, preventing abuse and investigating problems. Legal basis: our legitimate interest in a secure, reliable service.
- To protect your website users
- The activity log and alerts help you spot account takeovers. Legal basis: your legitimate interest as the site owner, with us acting on your instructions.
- To contact you about the service
- Alerts, the weekly digest (which you can switch off) and important account notices. Legal basis: our contract.
- To meet legal obligations
- When the law requires us to keep or disclose information.
6.International transfers
Some providers above process data outside your country, including in the United States. Where the law requires it, we rely on [Transfer safeguard, e.g. Standard Contractual Clauses].
7.How long we keep it
- WordPress activity log: on the Free plan it is not stored (it is only used to send alerts). Starter keeps it for 30 days. Pro and Agency keep it for 90 days. Older entries are deleted every day.
- Everything else about a website (checks, issues, file fingerprints, findings, reviews, scans): until you remove the website or delete your workspace’s data.
- Your workspace and settings: while your account exists. A workspace admin can delete all of it at any time (except while a workspace is suspended) in Settings → Delete workspace data. It is deleted immediately: websites, results, reports, AI reviews, activity logs, alerts, alert settings, API keys, branding and WordPress connections. Any subscription is cancelled first. If we close a workspace ourselves, we delete its data within [Deletion period after closure].
- The audit log: kept for 1 year so we can investigate abuse, then deleted every day. Deleting your workspace’s data deletes its audit log at once.
- Alert history: kept for 1 year, and deleted with its website or workspace.
- Free-check IP records: used to rate-limit free checks and count usage, and kept for 30 days, then deleted every day.
- Backups: deleted data can remain in backups for up to 30 days.
- Billing records: as long as tax and accounting law requires.
9.How we protect it
- All traffic to the service uses HTTPS.
- Secrets we must keep, such as a Cloudflare token, are encrypted in the database.
- API keys, plugin connection keys and share links are stored only as hashes.
- Each workspace can see only its own data, and actions are recorded in the audit log.
10.Your rights
Depending on where you live, you can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- limit how we use it, or object to a use based on legitimate interests;
- send it to you or another provider in a common format.
You can remove a website, and everything about it, yourself from its page, and a workspace admin can delete all of the workspace’s data in Settings → Delete workspace data. For anything else, write to [Contact email]. You can also complain to your data protection authority.
If you use a website that one of our customers monitors, the website owner controls that data. Please contact them first; we will help them answer you.
11.Children
The service is for businesses and is not meant for children under 16.
12.Changes to this policy
We will update the date at the top when we change this policy, and tell you by email or in the app before any important change takes effect.
13.Contact
[Company legal name], [Registered address]. Email: [Contact email].