Last updated: 6 August 2026
The short version
The free plugin never sends us anything. No telemetry, no version pings, no usage reports. It talks only to Anthropic or OpenAI, directly, using your own key.
The Pro add-on sends us three things: your licence key, your site address and the add-on version — enough to tell whether your licence is valid and whether an update is waiting.
If you use the included actions, your requests pass through our server so we can attach our own Anthropic key. We do not keep their contents. All that stays with us is: which licence, which month, an action identifier, how many calls it made, and how many tokens — numbers, with no piece of your text. You can check this rather than take our word for it: it is the shape of the table, not a promise.
Who the controller is
For licence, payment and included-action data, we are the controller:
REMO MEDIA SOLUTION S.R.L.
Aleea Rotundă 1, bl. Y1B, sc. B2, fl. 9, ap. 82, room 2, Sector 3, Bucharest, Romania
Company number: 42990213 · Trade Register: J40/10840/2020
plugins@remomedia.ro
For the site content you send to the AI model, you are the controller. We supply the software; the AI provider acts as your processor (or, for included actions, as our sub-processor).
We have not appointed a Data Protection Officer — we do not fall into the cases where the law requires one. Questions go to the address above.
A. The free plugin (Karttal AI, from WordPress.org)
What leaves your site, and when
Data leaves only at two moments, both started by a click of yours:
- when you write a request in the chat and submit it;
- when you press “Test the connection” on the settings screen.
Nothing is sent in the background, on page load, or on a schedule.
| Category | Contents |
|---|---|
| Your request | the text you wrote in the chat |
| A snapshot of your site | name, tagline, language, active theme, number of pages and products, menu names, global colours and fonts |
| Tool definitions | the list of available operations and the shape of their data |
| The relevant slice of content | only what your request concerns — the text of the page being edited, the fields of the products being changed |
Never sent: passwords, database credentials, your customers’ personal data, orders, addresses, or any content you have not asked the plugin to work on.
Where it goes
To the provider you chose, straight from your own server:
The request passes through no server of ours, and we see neither the key nor the traffic. Retention is governed by the provider’s own policy; read it before sending sensitive content.
Usage statistics
We collect none. The free plugin contacts no service of ours — not for telemetry, not for version checks, not for anything.
B. The Pro add-on (Karttal AI Pro, downloaded from us)
B.1 Licence checks and updates
The add-on contacts us periodically to check the licence and look for a new version. It sends:
| What | Why |
|---|---|
| the licence key | to tell whether it is valid and which plan it carries |
the site address (home_url) | to count sites against the plan’s limit |
| the add-on version | to tell whether an update is waiting |
It sends no content, no users, no orders and no usage statistics.
The answer is cached locally for 12 hours so we are not asked on every page load. If our server is unreachable, the licence stays valid for a further 14 days — an outage of ours should not stop your work.
B.2 Included actions (only if you have not added your own key)
If you use the actions included in your subscription, your request goes first to our server, which attaches our Anthropic key and forwards it.
What passes through is the same content described in section A: your request, the site snapshot, the tool definitions and the relevant slice of content.
What stays with us, in the metering table:
| Field | What it is |
|---|---|
licence_id | which licence made the request |
period | the month, as 2026-08 |
action_id | a random identifier for the action, generated on your site |
calls | how many calls the action made |
input_tokens, output_tokens | how many units of text |
created_at | date and time |
That is all. We do not keep the prompt, the answer, or the contents of your pages and products. There is nowhere to put them: the table has no column for them.
From there the request goes to Anthropic (Privacy), which processes it in the United States under Standard Contractual Clauses.
If you add your own key in Settings, our server steps out of the way entirely — your requests go straight to Anthropic, as in the free version, and your included actions are not spent.
B.3 Connecting Google services (optional)
Only if you connect a Google service account in the plugin, for the monthly SEO report:
- Search Console — we read impressions, clicks, positions and queries, for the property you name;
- Google Analytics 4 — we read sessions and traffic sources, for the property you name.
Both are read-only. The service account key is stored encrypted on your own site and never reaches us. The connection runs directly between your site and Google.
B.4 The AI crawler log
The add-on records, on your own site, when an AI assistant’s crawler (ChatGPT, Claude, Perplexity and others) visits your pages. It stores the day, the crawler’s name, the page path and a count — no IP addresses, and nothing about human visitors. It is kept for 400 days — a little over a year, so you can compare a month against the same month last year. The data stays in your database and is never sent to us.
C. Payment
Payments are processed by Stripe Payments Europe, Ltd. (Privacy). They collect card and billing details.
We never see or store card data. From Stripe we receive only your email address, the subscription identifier, which plan you bought and the payment status — what we need to issue your key and keep it valid.
D. Emails we send you
- your licence key, after payment;
- notices about important changes to these terms or to the price;
- replies to your support messages.
We send no newsletter, and we do not sell, rent or pass your address to anyone.
E. What is stored on your own site
| What | Where | How long |
|---|---|---|
| API key | the kai_settings option, encrypted AES-256 with a key derived from your WordPress secrets | until you delete it |
| Settings (provider, model, effort) | the same option, in the clear | until you change them |
| Restore points | the {prefix}kai_restore_points table | 30 days, at most 200 |
| Licence key | the kaip_licence_key option | until you delete it |
| Google service account key | encrypted, like the API key | until you delete it |
| AI crawler log | the {prefix}kaip_ai_hits table | 400 days |
| Usage counter | numbers only, no content | the current month |
| Pending plans | transients, 15 minutes | cleared on approval or expiry |
On uninstall, the plugins delete every option above, their own tables and their caches. The content you changed stays, of course, as you left it.
F. How long we keep data
| What | How long |
|---|---|
| Licence key, email, connected sites | while the subscription is active, plus 30 days after cancellation, so you can change your mind without losing the key |
| Monthly action counter | 24 months, then deleted |
| Accounting records (invoices) | 10 years, as Romanian law requires |
| Support messages | 24 months from the last exchange |
G. Where the data sits
Our server is hosted by Gazduire.net, in Romania, and therefore in the European Union.
The only transfer outside the EU is to Anthropic (United States), for AI requests, under the Standard Contractual Clauses approved by the European Commission. If you use your own key, the transfer runs directly between you and the provider, and we are not a party to it.
H. Legal basis (GDPR)
| Processing | Basis |
|---|---|
| Issuing and checking the licence, delivering updates | performance of a contract (Art. 6(1)(b)) |
| Processing payment, issuing the invoice | contract and legal obligation (Art. 6(1)(b) and (c)) |
| Metering included actions | performance of a contract (Art. 6(1)(b)) |
| Keeping accounting records | legal obligation (Art. 6(1)(c)) |
| Preventing abuse of the AI service | legitimate interest (Art. 6(1)(f)) |
For the site content you send to the model, the basis and the duty to inform rest with you, as the controller of your site.
We make no automated decisions with legal effect on you, and we do not profile.
I. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Write to plugins@remomedia.ro — we answer within 30 days at the latest.
If our answer does not satisfy you, you may complain to the Romanian supervisory authority, ANSPDCP, dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest. If you live elsewhere in the EU, you may complain to your own national authority instead.
A practical suggestion
Do not ask the plugin to work on pages or products that contain your customers’ personal data. For product descriptions, marketing copy and SEO — the ordinary case — no personal data is involved at all, and that keeps things simplest for everyone.
Contact
REMO MEDIA SOLUTION S.R.L. · Company number 42990213 · J40/10840/2020
Aleea Rotundă 1, bl. Y1B, sc. B2, fl. 9, ap. 82, room 2, Sector 3, Bucharest, Romania
plugins@remomedia.ro