Understand data sent for AI processing

POM AI performs its AI work on the POM account service, not on your server. Anything a tool needs in order to produce a result therefore leaves the site. This page explains what that is, so the decision about what to put in a prompt can be an informed one.

What always accompanies a request

Every request to the account service carries the information needed to identify who is asking and to bill the right account:

• the stored POM AI license key;
• the current site host;
• replay-protection values that make each request single-use.

Nothing about the visitor to your public site is involved. These are server-to-server requests made by WordPress while an administrator or editor is working.

What license validation sends

When a license is saved, revalidated or unlinked, the account server receives a technical description of the installation:

• the site host and site URL;
• the network URL and a random network identifier, on multisite;
• whether the installation is multisite;
• an environment hint — production, staging, local or development;
• the WordPress version and the PHP version.

None of this is site content. It exists so the account can apply the plan's domain rules and show you which installations are authorized.

What the tools send

This is the part worth reading carefully. It varies by tool.

Three things follow from that table.

First, translating a page sends the page's full content. If a page contains personal data, translating it transmits that personal data.

Second, POM AI selects profile sections by tool, but a selected section can accompany many generation requests. Keep unpublished strategy, pricing negotiations and customer names out of every profile field.

Third, dictation sends a recording of whatever your microphone captured — which can include a colleague's voice or a nearby conversation. Speaking is more casual than typing, so it is easier to mention something confidential aloud. See Audio privacy.

What is stored on your site

POM AI keeps very little locally:

• the license key, encrypted with a value derived from your WordPress security salts, in the shared POM product-license registry;
• the last validation result — status, plan, expiry, authorized domain — for display and grace handling;
• the last known credit balance, so the dashboard can show a number without a network call;
• your saved prompt templates;
• the business short description and structured profile fields, alongside your other POM Framework settings.

The license key is never displayed in full after it is saved; the settings screen shows a masked version. Because the encryption is derived from the site salts, rotating those salts makes the stored key unreadable and the panel asks you to paste it again. That is a deliberate property, not a fault.

Generated content is stored exactly where WordPress stores content already: posts, terms and the media library. POM AI adds no separate content store.

What the account records

The account keeps a usage log so you can audit spending. Each entry records the domain, the action, the tool, the endpoint and the credits used, with a timestamp. You can read it in My Account → POM AI Management on account.pom.es, alongside the credit balance and the authorized domains.

Practical rules

• Treat a prompt as something that leaves your infrastructure, because it does.
• Do not paste credentials, API keys, tokens, bank details or identity-document numbers into any prompt field. They are never needed for the task and there is no way to recall them.
• Before bulk-translating, check whether the content set contains personal data, and whether you have a lawful basis for processing it that way.
• Prefer describing a customer situation generically over pasting the customer's actual record.
• When reporting a problem to support, send the site URL, the time, the tool name, the shape of the input and the exact error text. Never send the license key, an MCP API key or an OAuth token.

Your own obligations

POM AI is a processor of whatever you choose to send it. Deciding what may lawfully be sent, informing the people whose data it concerns, and keeping records of that decision remain your responsibility as the site operator. The plugin cannot make that judgement for you, and it does not try to.