Privacy policy for the WordPress plugin

1. About this page

This page explains what the TagDuck WordPress plugin sends to TagDuck and what we do with it. It adds to the main Privacy policy, which says who is responsible for your data and describes your rights. Our Terms apply as well.

2. What is sent, and when

Nothing is sent until you connect an API key. After that, the plugin contacts TagDuck only in these cases:

• When you describe images or add photos with TagDuck. We receive the images you chose, the texts you entered (context, keywords, notes) and the output language. For product images in WooCommerce on the Pro and Agency plans, we also receive the product name, category and variant (for example “Color Red”). For new photos, we also receive the location you picked and your file-name settings.
• Once a day, the plugin checks whether a newer version is recommended. This sends the plugin version and your site address, and no API key.
• When you press “Test connection”, and while results are being collected, the plugin identifies itself with your API key.

Photos may contain embedded metadata such as EXIF, including GPS location, if the original photo has it. That metadata is part of the files that are sent.

3. IP addresses

• For requests made by your website's server, we see the server's IP address. For photos you upload from your browser, we see your browser's IP address.
• For each API key we store when it was last used and the IP address of its last request made by your server, to protect accounts against misuse (our legitimate interest). The browser IP address of a photo upload is not stored on the key.
• Our servers also keep technical access logs, including IP addresses, for security and abuse prevention for 14 days, and rate limiting uses short-lived counters.
• When you revoke a key, its stored IP address is deleted. The key's name, the site address it was tied to and the time it was last used stay until you delete your TagDuck account.

4. What we send back and keep

We send back the generated alt text, description, keywords and file names. We keep a record of your requests and results (the texts you entered, original file names, the generated texts, and the location for new photos) for as long as your TagDuck account exists. If you delete your account, this is removed after a 30-day grace period.

5. How long photos are kept

• Images you describe: the image is deleted from our storage as soon as it has been processed.
• Photos added with TagDuck: the processed photo and its small preview are kept for 7 days after you last worked with those photos, then deleted.
• If you cancel or something fails, any leftover file is deleted after 7 days without activity.

6. Service providers and transfers

To process requests from the plugin we use AI service providers and hosting and file storage providers. Our AI service providers process photos only to generate the text you asked for, do not use them to train their models, and keep them for no longer than 30 days (longer only where required by law or to investigate misuse).

Our servers and file storage are in the EU. Some of our service providers, including AI service providers, are outside the European Economic Area, with appropriate safeguards such as Standard Contractual Clauses; see section 4 of the main Privacy policy.

7. What the plugin does not send

• No data about your website's visitors.
• No post or page content, and no media other than the images you chose.
• Nothing at all before you connect an API key.

8. Map tiles from a third party

The location map in the plugin's admin screens loads its map data directly from OpenFreeMap in your browser. This is a third party, not TagDuck. Your browser sends its IP address and the map area shown. See the OpenFreeMap privacy policy.

9. How to stop

• Revoke the API key in your TagDuck account. Nothing more is sent after that.
• If you uninstall the plugin, it removes its own settings, API key, waiting list and the notes it stored on images. Alt texts, descriptions, the keywords you accepted and your images stay in WordPress. Data already sent to TagDuck follows the retention above; to have it removed sooner, delete your TagDuck account or contact us.

10. Contact

Privacy questions or requests: contact@tagduck.io