Privacy, retention, and account deletion

Saved configurations can contain customer-entered values. Store owners should describe this purpose and retention behavior in their privacy notice and avoid requesting sensitive information in Product Add-On fields unless it is necessary for the purchase.

Account saving, account screens, and share-link workflows are available only while Allow customers to save configurations to their accounts is enabled. Product presets do not create customer account records. Privacy export and erasure support remains active for existing records after the permission is disabled.

Account records

Signed-in configurations remain in the customer's account until the customer deletes them, the account is erased, or a store operator applies another documented retention process. Renaming or duplicating a record does not change its privacy classification.

POM Tweaks registers saved configurations with WordPress personal-data export and erasure tools on every site in the network once configuration storage exists. This registration does not enable the storefront feature on those sites. The exporter paginates through every matching site record, and erasure removes configurations and their share links in atomic bounded batches. A privacy-tool storage failure is reported as retained data instead of being treated as a successful erasure. Deleting a WordPress user also deletes that user's saved configurations and their share links across the network, including deletion initiated from Network Admin when the records belong to another subsite. A failed account-deletion batch is queued for another attempt through WP-Cron. WooCommerce order records are separate purchase records and are not removed by deleting a saved configuration.

Guest records

POM Tweaks does not store guest configurations in browser local storage and does not create implicit WordPress or WooCommerce accounts. A guest can open a permitted share link; the link is checked again and its permitted values are held only in the bounded WooCommerce session needed to apply it.

Share records

The customer chooses an expiry of up to 365 days or no expiry. Expired links stop working immediately when checked. Revoked links stop working immediately and their inactive audit record is eligible for deletion after 30 days. A daily bounded cleanup removes expired and old revoked link records.

The random share URL is a bearer credential. Only a protected digest is retained by the site, so the original URL cannot be recovered from storage or the account screen. Store analytics, messages, proxies, and browser history may still retain a URL after it is shared; revoke the link if its audience is no longer appropriate.

File policy

Uploads are never copied into account or share configuration storage. Only the fact that a file must be selected again may be retained in an owner configuration. Existing Product Add-Ons upload and order retention rules continue to apply independently when a customer completes a purchase.

Operational verification

1. Export personal data for a customer with a saved configuration and confirm that its name, type, dates, and selections appear.
2. Run personal-data erasure and confirm that the account items and their share links disappear.
3. Delete a test user and confirm that no saved configuration remains for that user.
4. Open a share link while signed out and confirm that no local guest record or implicit account is created.
5. Confirm that expired and revoked share links cannot be opened before waiting for physical cleanup.