What Data Stays on Your WordPress Site (Privacy Overview)

SEOvault AI is designed to keep your data on your WordPress site. Core SEO features operate entirely server-side without sending content to external servers. Optional features like the web app connection, IndexNow, and analytics involve external services, but only when you explicitly enable them.

This guide covers what is stored locally, what is sent externally, and how to control data retention on uninstall.

Data stored on your WordPress site

SEO settings and metadata

All SEO data is stored in your WordPress database:

Plugin options – stored in the wp_options table with the seovaultseo_ prefix. Includes output mode, homepage title, description, templates, robots policy, social defaults, schema settings, sitemap settings, and more.
Post meta – stored in wp_postmeta with the _seovault_ prefix. Includes per-post SEO title, meta description, focus keyword, canonical URL, robots directives, Open Graph data, Twitter/X Card data, and schema instances.
Term meta – stored in wp_termmeta with the _seovault_ prefix. Includes per-term SEO title, description, canonical URL, and robots directives.

This data never leaves your site unless you explicitly connect the web app or use the import/export tools.

Connection credentials

Site key – stored in wp_options as seovaultseo_site_key (autoload disabled)
Scoped API keys – stored as seovaultseo_site_read_key and seovaultseo_site_write_key
Connection status – stored as seovaultseo_connection_verified and seovaultseo_connected_at

These credentials are used only for authenticating REST API requests. They are not exposed in frontend HTML or in any public-facing response.

404 monitor logs

When the 404 monitor is enabled, the following data is stored in a custom database table (wp_seovaultseo_404_logs):

Requested URI
Timestamp
Referring URL (in advanced mode only)
Visitor User-Agent (in advanced mode only)

Visitor IP addresses are not stored by the 404 monitor.

Redirect rules

Redirect rules are stored in a custom database table (wp_seovaultseo_redirects). Each rule contains:

Source URL
Destination URL
Redirect type (301 or 302)
Status (active or inactive)
Hit count and last accessed timestamp

API audit log

The audit log is stored in a custom database table (wp_seovault_api_audit). For each API request, it records:

SHA-256 hashed IP address (not raw IP)
SHA-256 hashed User-Agent (not raw User-Agent)
Route and HTTP method
Event type and timestamp
Success or failure status

Raw IPs and User-Agents are never stored in the audit log. Only hashed versions are retained.

Rate limiting data

Rate limiting uses WordPress transients (temporary data stored in the options table). Transients store:

Hashed IP identifiers (not raw IPs)
Request counts per key hash and bucket
Lockout timestamps

Transients expire automatically based on their configured window. They are also cleaned up on deactivation and uninstall.

AI crawler visit logs

When crawler logging is enabled, the plugin stores:

SHA-256 hashed visitor IP address (not raw IP)
SHA-256 hashed User-Agent (not raw User-Agent)
Request URL and timestamp
Crawler type and visit metadata

Raw IPs and User-Agents are not retained. Only SHA-256 hashes are stored.

Site Health Monitor logs

When the Site Health Monitor is active:

PHP errors at or above the configured severity may be written to wp-content/debug.log
If the optional Site Health must-use helper is installed, fatal errors may be recorded under your uploads directory
These files remain on your server unless optional off-site reporting is configured

Local SEO data

Local SEO locations are stored as a custom post type (seovault_locations) with an associated taxonomy (seovault_locations_category). This includes business name, address, phone, hours, geo-coordinates, and other local business information.

Schema templates

Schema templates are stored as a custom post type (seovault_schema). These are schema type configurations that define how structured data is generated for specific content types.

Sitemap cache

Sitemap cache files may be stored under wp-content/uploads/seovault-seo/ for performance. These are regenerated automatically when content changes.

Data sent to external services (all optional)

SEOvault AI web app

When: you connect your site using the site key.

What happens: authorized API clients connect to your WordPress REST API and may read and update SEO-related content and settings, including full post content needed for SEO workflows.

What is not sent: the plugin does not automatically upload posts to SEOvault AI servers in the background. Data is only exchanged when the web app explicitly requests it through the REST API.

Control: connecting is optional. The plugin works without it. Disconnect at any time from General Settings > Connection.

IndexNow

When: you enable IndexNow and publish or update content.

What happens: the plugin submits your published or updated URLs to the IndexNow API at https://api.indexnow.org/ to notify search engines. A verification key file is placed in your site root (publicly accessible by design of the IndexNow protocol).

Control: enable or disable at General Settings > IndexNow.

Site Health Monitor (off-site reporting)

When: you configure an HTTPS webhook URL in Site Health settings.

What happens: critical or warning error summaries (message, sanitized relative file path, line number, timestamp, hash, and site URL) may be POSTed to the webhook URL shortly after the error occurs. Authentication uses the X-Site-Key header.

Control: do not configure a webhook URL to keep all logs local.

Google Analytics

When: you enable analytics with a Measurement ID or custom tracking code.

What happens: the plugin outputs Google tag / gtag code that loads from googletagmanager.com and sends analytics data according to your Google Analytics configuration.

Control: enable or disable at General Settings > Analytics.

Google Maps

When: you configure a Maps API key and use Local SEO map shortcodes.

What happens: the plugin loads the Google Maps JavaScript API from maps.googleapis.com on pages that display the map.

Control: do not configure a Maps API key to prevent Google Maps loading.

Schema import from URL

When: an administrator enters an external URL in the schema import tool.

What happens: the plugin fetches that URL to parse schema markup locally. The fetched content is processed on your server and not stored permanently.

Control: this is an admin-initiated action only. It never runs automatically.

What is not sent

SEOvault AI does not include:

Hidden telemetry or analytics phone-homes
License check calls to external servers
Automatic background uploads of your content
Tracking pixels or advertising scripts (unless you explicitly enable Google Analytics)
Any data transmission to SEOvault AI servers without your explicit configuration

The plugin’s core SEO features (meta tags, schema, sitemaps, social tags, robots, 404 monitoring, redirects) operate entirely on your WordPress server.

WordPress privacy policy integration

SEOvault AI registers suggested privacy policy text with WordPress. To add it to your site’s privacy policy:

Go to Settings > Privacy in WordPress admin.
Click Create or edit your privacy policy page.
The SEOvault AI section appears in the suggested content list.
Copy the suggested text into your privacy policy page.

The suggested text covers all data storage and external service interactions described above. A full product privacy policy is also available at seovaultai.com/privacy.

Uninstall and data retention

SEOvault AI gives you control over what happens to your data when you uninstall (delete) the plugin. Configure this at General Settings > Tools > Data & Uninstall.

Default behavior (Erase all data: off)

When you delete the plugin with the “Erase all data on uninstall” checkbox unchecked:

Always removed:

Site API keys (main, read-only, write-scoped)
Connection state and verified status
Health webhook URL
Rate-limit and auth transients
Scheduled cron events
Site Health Monitor must-use helper file

Preserved in your database:

All SEO settings and plugin options
Per-post SEO metadata (titles, descriptions, keywords, etc.)
Redirect rules
404 monitor logs
Local SEO location data
Schema templates
Sitemap cache files
Term meta

This means you can reinstall the plugin later and your SEO data will still be there.

Full erase (Erase all data: on)

When you enable “Erase all data on uninstall” and then delete the plugin:

Everything is permanently removed:

All plugin options (settings, credentials, configuration)
All post and term meta with _seovault_ prefix
Custom database tables (404 logs, redirects, audit log)
Local SEO custom post type content and taxonomy terms
Schema template custom post type content
Sitemap cache directory under uploads
IndexNow verification key file
All plugin transients
Plugin user meta (review notices, etc.)
Rewrite rules are flushed

This cannot be undone. Enable this option only if you want a complete removal.

What uninstall never deletes

User-created pages referenced by 404 fallback or recovery settings
Your SEOvault AI web app account, subscription, or workspace data (uninstall only affects your WordPress site)
WordPress core files, themes, or other plugins