Skip to content

Privacy & Data Transparency

WPfaker is built on a simple principle: your personal data stays on your WordPress site. Every feature that communicates with an external service is either optional or transmits only the minimum data necessary for it to function. This page documents every external data flow in WPfaker — what is sent, where it goes, and whether you can disable it.

This page also serves as WPfaker's privacy policy in accordance with the EU General Data Protection Regulation (DSGVO/GDPR).

Data Controller

Michael Großklos E-Mail: privacy@wpfaker.com Website: https://wpfaker.com

If you have questions about data processing or wish to exercise your rights under the GDPR, contact the data controller at the address above.

Overview

FeatureDestinationData SentRequired?Legal Basis
License validationapi.wpfaker.comLicense key, site URL, site fingerprint, versionsYesContract performance (Art. 6(1)(b) GDPR)
AI field detectionGoogle / Anthropic / OpenAIField metadata (names, labels, types)NoConsent (Art. 6(1)(a) GDPR)
WPfaker Hive & Syncapi.wpfaker.comField definitions, faker mappings, taxonomy terms, title templates, number ranges, value listsNoConsent (Art. 6(1)(a) GDPR)
Telemetryapi.wpfaker.comAnonymous usage snapshot (24 fields)Opt-outLegitimate interest (Art. 6(1)(f) GDPR)
Image providersUnsplash / LoremFlickr / Picsum / Placehold.coSearch category, orientation, dimensionsNoConsent (Art. 6(1)(a) GDPR)
Logo downloadsHetzner Object StorageLogo file numberNoConsent (Art. 6(1)(a) GDPR)
File generation (PDF)w3.org / africau.eduNone (downloads sample file)NoConsent (Art. 6(1)(a) GDPR)
Plugin updateswpfaker.comPlugin slugAutomaticLegitimate interest (Art. 6(1)(f) GDPR)
News & videosapi.wpfaker.comNone (fetches content)AutomaticLegitimate interest (Art. 6(1)(f) GDPR)
Google Fontsfonts.googleapis.comBrowser IP addressAutomaticLegitimate interest (Art. 6(1)(f) GDPR)

License Validation

Status: Required Legal basis: Contract performance (Art. 6(1)(b) GDPR) — license validation is necessary to fulfill the software license agreement.

License validation ensures your WPfaker license is active and matches the site it is installed on. Without a valid license, the plugin cannot function.

What triggers it

  • Plugin activation
  • Background check every 2 hours (when the cached transient expires)
  • Manual license re-validation from the settings page

Data transmitted

FieldDescription
License keyYour WPfaker license key
Site URLYour WordPress home URL (home_url())
Site fingerprintOne-way SHA256 hash (see below)
Plugin versionCurrent WPfaker version string
WordPress versionYour WordPress version (sent during update data requests)
PHP versionYour PHP version (sent during update data requests)

The site fingerprint is a SHA256 hash computed from six values concatenated together: your database table prefix, two WordPress auth keys (AUTH_KEY and SECURE_AUTH_KEY), home URL, ABSPATH, and database name. The result is a one-way hash that uniquely identifies your installation without revealing any of the individual raw values. The raw secrets never leave your server — only the irreversible hash is transmitted.

Site URL is transmitted

Your site URL (the value of home_url()) is sent to the license server as a plain-text field alongside the fingerprint hash. This is necessary for the license server to associate activations with specific sites. If this is a concern for your use case, be aware that the license server stores the site URL for the duration of the active license.

What is NOT sent

  • wp-config.php secrets (only used locally in the hash computation)
  • Database contents or credentials
  • WordPress admin credentials
  • Any generated content

Destination

https://api.wpfaker.com/api/v1/license/activate (activation) https://api.wpfaker.com/api/v1/license/check (validation) https://api.wpfaker.com/api/v1/license/deactivate (deactivation)

All requests are HMAC-SHA256 signed and sent over HTTPS.

Caching

Validation results are cached locally for 2 hours using a WordPress transient. During that window, no additional validation requests are made.

How to disable

License validation cannot be disabled. It is required for the plugin to operate.


AI Field Detection

Status: Optional — off by default Legal basis: Consent (Art. 6(1)(a) GDPR) — you explicitly enable this feature in settings.

AI field detection sends field metadata to a third-party AI provider so it can suggest the correct faker method for custom fields that WPfaker's built-in pattern matcher cannot recognize.

What triggers it

  • Generating content for a post type with unrecognized custom fields
  • Only fires when AI detection is explicitly enabled in settings

Data transmitted

FieldDescription
Field nameThe field's registered name (e.g., emergency_contact)
Field labelHuman-readable label if available (e.g., "Primary Residence")
Field typeDeclared type (text, number, select, etc.)
Parent pathFor nested fields (repeaters/groups), the hierarchical path (e.g., ["recipe", "ingredients"])
Post type slugThe custom post type slug the field belongs to
Post type labelHuman-readable CPT label (e.g., "Movies")
LocaleThe active WPfaker locale setting

What is NOT sent

  • Site URL or domain name
  • Generated content or field values
  • Database contents
  • User personal information
  • WordPress credentials or configuration
  • API keys of other services
  • Other plugin or theme information

Destination

Depends on your chosen provider:

  • Google Gemini: https://generativelanguage.googleapis.com/
  • Anthropic Claude: https://api.anthropic.com/
  • OpenAI GPT: https://api.openai.com/

International data transfers

All three AI providers are US-based companies. Data transfers to the US are covered by the EU-US Data Privacy Framework (for certified providers) and/or Standard Contractual Clauses (SCCs). When you enable AI detection and choose a provider, you accept that field metadata will be processed by that provider under their respective terms:

These providers act as independent data controllers for the data they receive through their APIs.

Caching

AI detection results are cached locally for 1 hour per individual field. The cache is keyed by a hash of the field name, field label, and locale, so it auto-invalidates when you rename fields or change the locale. Within the cache window, no additional AI calls are made for that field.

Title template suggestions are cached separately for 24 hours per post type.

How to disable

Navigate to WPfaker > Settings, scroll to AI-Powered Field Detection, and toggle Enable AI Detection off. Click Save AI Settings. See AI Settings for details.


WPfaker Hive & Sync

Status: Optional — off by default Legal basis: Consent (Art. 6(1)(a) GDPR) — you explicitly enable the Hive in settings.

The WPfaker Hive is a community knowledge base where participating installations share anonymous detection data — including field configurations, taxonomy terms, title templates, number ranges, and value lists. When enabled, your installation both contributes and benefits from the collective dataset.

The Hive uses a Sync mechanism: telemetry data and Hive field data are combined into a single request and sent together via the SyncService. This sync is triggered "piggyback-style" on WPfaker REST API calls (not via a separate cron job). The server controls the sync interval, which defaults to approximately 7 days.

What triggers it

  • Hive queries: When generating content with unrecognized fields, the Hive is queried before falling back to AI
  • Hive submissions: After a successful AI detection run, confirmed mappings (confidence >= 0.7) are submitted to the Hive
  • Sync: On any WPfaker REST API call, the SyncService checks if a sync is due and, if so, combines telemetry + field data into one request

Data transmitted (Hive queries)

The Hive supports several query types. Each query sends only structural metadata — never field values or site-identifying information.

Field config queries:

FieldDescription
Post type slugThe custom post type (e.g., movie)
Field nameThe custom field name (e.g., emergency_contact)
Field labelHuman-readable label if available
Field plugin typeThe field's declared type (e.g., text)
LocaleThe active WPfaker locale

Taxonomy term queries:

FieldDescription
Post type slugThe custom post type
Taxonomy patternRegex pattern for the taxonomy (e.g., genre)
LocaleThe active WPfaker locale

Title template queries:

FieldDescription
Post type slugThe custom post type
LocaleThe active WPfaker locale

Number range queries:

FieldDescription
PrefixField prefix (e.g., $, )
SuffixField suffix (e.g., kg, %)
Field nameThe field name for context
Post type slugThe custom post type

Value list queries:

FieldDescription
Field nameThe field name (e.g., ingredient)
ContextParent path for context (e.g., ["recipe", "ingredients"])
LocaleThe active WPfaker locale

Data transmitted (Hive submissions)

Submissions mirror the query types above. Each type contributes back to the community knowledge base:

Field config submissions:

FieldDescription
Post type slugThe custom post type
Post type labelHuman-readable CPT label
Field nameThe custom field name
Faker methodThe matched faker method (e.g., address)
Faker paramsParameters for the faker method
Confidence scoreAI detection confidence (0.0-1.0)
LocaleThe active WPfaker locale

Taxonomy term submissions:

FieldDescription
Post type slugThe custom post type
Post type labelHuman-readable CPT label
Taxonomy patternThe taxonomy pattern
TermsArray of term values
Confidence scoreAI detection confidence
LocaleThe active WPfaker locale

Title template submissions:

FieldDescription
Post type slugThe custom post type
Post type labelHuman-readable CPT label
TemplateTitle template string with placeholders
Placeholder dataData for template placeholders
Confidence scoreAI detection confidence
LocaleThe active WPfaker locale

Number range submissions:

FieldDescription
PrefixField prefix
SuffixField suffix
Field nameThe field name
Post type slugThe custom post type
Min / Max / DecimalsThe learned number range

Value list submissions:

FieldDescription
Field nameThe field name
ContextParent path for context
ValuesArray of generated values
LocaleThe active WPfaker locale

Data transmitted (Sync — field definitions)

When Hive is enabled, the SyncService additionally collects and sends field definitions from all active field adapters:

FieldDescription
Field keyUnique field identifier
Field nameThe registered field name
Field labelHuman-readable label
Field typeDeclared type
PluginWhich adapter detected the field (e.g., acf)
Post typeThe CPT the field belongs to
Post type labelHuman-readable CPT label
Faker methodCurrently assigned faker method (if any)
Faker paramsMethod parameters (if any)

What is NOT sent

  • Field values or generated content
  • Site URL or domain name
  • User personal information
  • WordPress configuration details
  • API keys
  • Plugin or theme information (beyond which field adapter detected a field)

Destination

https://api.wpfaker.com/api/v1/graphql (Hive queries and submissions) https://api.wpfaker.com/api/v1/sync (combined Sync requests)

Caching

Hive lookups are cached locally alongside AI detection results.

How to disable

The Hive is reciprocal: disabling it means your installation neither sends field data nor receives community mappings. Toggle it off in WPfaker > Settings under the AI-Powered Field Detection section. See AI Settings for details.


Telemetry

Status: Optional — on by default Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — understanding aggregate usage patterns is necessary to prioritize development and ensure compatibility. No personal data is collected; only anonymous, aggregated metrics are transmitted. You can opt out at any time.

Telemetry sends an anonymous usage snapshot to help the WPfaker team understand how the plugin is used across different environments.

How it works

Telemetry data is collected locally in the WordPress options table as events happen — every time you generate content, use AI detection, or interact with the history page, the corresponding counter is incremented in the database. The data is sent to api.wpfaker.com via two mechanisms: a daily WordPress cron job (direct to /telemetry) and the SyncService (combined with Hive data to /sync, firing approximately weekly). Event counters are cleared after a successful send; cumulative counts persist.

Dual send mechanism

Telemetry data can be sent via two mechanisms: (1) a daily WordPress cron job that sends the snapshot directly to the /telemetry endpoint, and (2) the SyncService, which piggybacks on WPfaker REST API calls and combines telemetry with Hive field data in a single request to the /sync endpoint. Both mechanisms respect the telemetry opt-out setting. The SyncService fires when the server-assigned interval has elapsed (default: ~7 days) and the user interacts with the WPfaker admin UI.

What triggers a data send

  • Cron: A daily WordPress cron job sends the telemetry snapshot directly to api.wpfaker.com/api/v1/telemetry
  • Sync: Piggyback on WPfaker REST API requests when the server-assigned sync interval has elapsed (combined with Hive data to api.wpfaker.com/api/v1/sync)

Data transmitted

System & version information:

FieldDescription
instance_idAnonymous UUID4 identifier, generated once per installation
plugin_versionCurrent WPfaker version (e.g., 0.9.0)
wp_versionWordPress version (e.g., 6.7.1)
php_versionPHP version in major.minor format (e.g., 8.2)
localeActive WPfaker locale setting (e.g., de_DE)

Feature flags:

FieldDescription
ai_enabledWhether AI field detection is enabled (boolean)
ai_providerAI provider name if enabled (e.g., openai, anthropic, google)
hive_enabledWhether the Hive is enabled (boolean)

Cumulative content counts:

FieldDescription
template_countNumber of local templates created
generated_postsTotal posts ever generated
generated_termsTotal taxonomy terms ever generated
generated_usersTotal users ever generated
generated_commentsTotal comments ever generated

Event counters (from a rolling buffer, cleared after each successful send):

FieldDescription
ai_detectionsNumber of AI field detections performed
hive_submissionsNumber of Hive submissions made
template_generationsNumber of template-based generations
history_viewsNumber of history page views
history_deletesNumber of history record deletions

Time savings:

FieldDescription
time_saved_secondsCumulative seconds of manual work saved
hourly_rateConfigured hourly rate in USD (default: 75.0)
hourly_rate_customWhether the user customized the hourly rate (boolean)

That is the complete payload — 24 fields total.

What is NOT sent

  • Site URL or domain name
  • WordPress admin credentials
  • User personal information
  • Database contents or field values
  • Generated content
  • IP address (not logged server-side)
  • Plugin or theme list

Destination

  • https://api.wpfaker.com/api/v1/telemetry (cron-based direct send)
  • https://api.wpfaker.com/api/v1/sync (combined with Hive data via SyncService)

Caching

Between sends, all telemetry data lives exclusively in your local WordPress database (wp_options table). Nothing is buffered in external services or third-party storage.

How to disable

Navigate to WPfaker > Settings and toggle Send Anonymous Usage Data off.


Image Providers

Status: Optional — per provider Legal basis: Consent (Art. 6(1)(a) GDPR) — you choose which provider to use in your template settings.

When generating posts with featured images, WPfaker can download images from external providers. Each provider is configured individually and only contacted when selected.

What triggers it

  • Generating posts with featured image generation enabled
  • Only contacts the provider you have selected in settings

Data transmitted

ProviderData SentDestination
UnsplashSearch category, orientation, image dimensionshttps://api.wpfaker.com/api/v1/images/unsplash (proxied through WPfaker API)
LoremFlickrSearch category, image dimensions (encoded in URL)https://loremflickr.com/
Lorem PicsumImage dimensions (encoded in URL)https://picsum.photos/
Placehold.coImage dimensions, color (encoded in URL)https://placehold.co/

Unsplash is proxied

Unsplash requests are routed through the WPfaker API (api.wpfaker.com) as a proxy, which holds the Unsplash API key. Your site sends the search category, orientation (landscape/portrait/squarish), and dimensions to api.wpfaker.com, which forwards the request to Unsplash and returns the image URL. Your site then downloads the image directly from Unsplash's CDN.

What is NOT sent

  • Site URL or domain name
  • User personal information
  • Post content or field values
  • WordPress configuration

Caching

Downloaded images are stored permanently in the WordPress media library. The same image is not re-downloaded.

How to disable

Disable featured image generation entirely in your template settings, or understand that all four available providers make external HTTP requests. See Images for details.


Logo Downloads

Status: Optional — only triggered when generating content that uses logos Legal basis: Consent (Art. 6(1)(a) GDPR) — logo generation is an optional feature you configure per template.

When generating fake company data, WPfaker can download pre-made logo images from a pool stored on Hetzner Object Storage.

Data transmitted

Only the logo file URL is requested (e.g., logo-042.svg). No site information, search queries, or identifiers are sent.

Destination

https://wpfaker-company-logos.fsn1.your-objectstorage.com/ (Hetzner Object Storage, Frankfurt, Germany)

Fallback

If the download fails, WPfaker uses bundled SVG logos from the plugin directory. No external request is made in this case.

How to disable

Do not configure logo fields in your templates. Logo downloads only occur when a template explicitly uses a logo faker method.


File Generation

Status: Optional — only triggered when generating file attachment fields Legal basis: Consent (Art. 6(1)(a) GDPR) — file generation is an optional feature.

When generating fake file attachments (PDF type), WPfaker attempts to download sample PDF files from public sources. If the download fails, it generates a simple PDF locally using native PHP.

Data transmitted

No identifying data is sent — the plugin simply performs an HTTP GET request to download a publicly available sample file.

Destination

  • https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf
  • https://www.africau.edu/images/default/sample.pdf

Other file types (DOCX, XLSX, CSV, TXT) are generated locally without any external requests.

How to disable

Do not configure file attachment fields in your templates.


Plugin Updates

Status: Automatic Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — checking for security and stability updates is necessary for the safe operation of the software.

WPfaker checks for new versions using the Plugin Update Checker library, which queries a JSON endpoint for version metadata.

What triggers it

  • WordPress's built-in update check cycle (typically twice daily)

Data transmitted

The update checker makes a standard HTTP GET request to a JSON endpoint. The request contains only the standard HTTP headers sent by WordPress (User-Agent with WordPress version).

FieldDescription
Plugin slugwpfaker (part of the URL)

What is NOT sent

  • License key (update checks are unauthenticated)
  • Site fingerprint
  • WordPress configuration
  • Any other plugin or site information

Destination

https://wpfaker.com/api/update-check.json

Not api.wpfaker.com

Plugin update checks go to wpfaker.com (the marketing website), not to api.wpfaker.com (the license API). The website endpoint returns a static JSON file with version metadata and download URL.

Caching

WordPress caches update check results according to its own transient schedule (typically 12 hours).

How to disable

Plugin update checks follow standard WordPress behavior. You can disable them using WordPress's built-in update management or a third-party plugin. This is not recommended, as you would miss security and stability updates.


News & Videos

Status: Automatic Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — displaying in-plugin news and tutorial videos enhances the user experience.

WPfaker fetches news content and tutorial video metadata from the WPfaker API to display in the admin dashboard.

Data transmitted

No identifying data is sent — the plugin makes unauthenticated HTTP GET requests.

Destination

  • https://api.wpfaker.com/api/v1/settings/news (news content, cached for 1 hour)
  • https://api.wpfaker.com/api/v1/videos (tutorial video list)

Caching

News content is cached locally for 1 hour using a WordPress transient. Video data is fetched on each relevant page load.

How to disable

These requests cannot be individually disabled. They occur automatically when you visit the WPfaker admin pages.


Google Fonts

Status: Automatic Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — loading the JetBrains Mono font ensures consistent rendering of the plugin's admin interface.

WPfaker loads the JetBrains Mono font from Google Fonts for use in the admin UI (code editor, monospace displays).

Data transmitted

When the WPfaker admin page loads, your browser makes a request to Google's font servers. This transmits the visitor's IP address to Google as part of the standard HTTP connection. Google's privacy policy governs how this data is handled.

Destination

https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500&display=swap

The CSS file references font files hosted on https://fonts.gstatic.com/.

Privacy implications

Google may use the IP address for analytics and service optimization. For details, see the Google Fonts Privacy FAQ. Google Fonts is covered by the EU-US Data Privacy Framework.

GDPR consideration

Some European data protection authorities (notably the LG Munich, ruling of January 20, 2022, Az. 3 O 17493/20) have ruled that loading Google Fonts from Google's CDN without user consent can violate the GDPR. Consider self-hosting the font if this is a concern for your deployment.

How to disable

Google Fonts loading cannot be disabled through plugin settings. To avoid this external request, you would need to dequeue the wpfaker-fonts stylesheet via a custom WordPress plugin or code snippet and self-host the font file.


What WPfaker Never Sends

Regardless of which features are enabled, the following data never leaves your WordPress installation:

  • Generated content or field values — All fake data stays in your database
  • WordPress admin credentials — Usernames and passwords are never sent anywhere
  • Database contents — No table data, post content, or user records are transmitted
  • User personal information — No names, emails, or IP addresses of your site's users or visitors
  • wp-config.php secrets — Auth keys and salts are only used locally in the SHA256 fingerprint computation; raw values never leave the server
  • Other plugin or theme information — Your site's software stack is not disclosed (except the WordPress and PHP version in license validation)

About the site URL

Your site URL (home_url()) is transmitted to the WPfaker license server during license activation, validation, and deactivation. It is not sent to any other service (AI providers, image providers, telemetry, Hive, or update checks).

Data Retention

DataStorage LocationRetention
License validation records (incl. site URL)api.wpfaker.comDuration of active license; deleted upon license expiration or on request
Hive field mappingsapi.wpfaker.comIndefinite (anonymous, no attribution to specific sites)
Telemetry snapshotsapi.wpfaker.com12 months, then aggregated and anonymized
AI detection dataThird-party AI providerSubject to provider's retention policy (Google, Anthropic, OpenAI)
Google Fonts access logsGoogle serversSubject to Google's data retention policies

No data stored on api.wpfaker.com is sold, shared with third parties, or used for advertising.

Third-Party Recipients

RecipientData ReceivedPurposeLocation
Michael Großklos (api.wpfaker.com)License data, telemetry, Hive field dataLicense management, usage analytics, field intelligenceGermany (Hetzner Cloud)
Michael Großklos (wpfaker.com)HTTP request for update metadataPlugin updatesGermany (Netlify EU)
Google (Gemini API)Field metadata (if selected as AI provider)AI field detectionUSA
Anthropic (Claude API)Field metadata (if selected as AI provider)AI field detectionUSA
OpenAI (GPT API)Field metadata (if selected as AI provider)AI field detectionUSA
Google (Fonts)Browser IP addressFont deliveryUSA / Global CDN
Unsplash (via proxy)Search category, orientation, dimensionsImage downloadsUSA
LoremFlickrCategory, dimensions (in URL)Image downloadsNetherlands
Lorem PicsumDimensions (in URL)Image downloadsUnknown
Placehold.coDimensions, color (in URL)Placeholder image generationUnknown
Hetzner (Object Storage)Logo file requestLogo image downloadsGermany (Frankfurt)
W3C / africau.eduHTTP GET requestSample PDF downloadUSA / South Africa

International Data Transfers

When you use AI field detection with Google Gemini, Anthropic Claude, or OpenAI GPT, field metadata is transferred to the United States. These transfers are safeguarded by:

  • The EU-US Data Privacy Framework (for certified providers)
  • Standard Contractual Clauses (SCCs) as incorporated in the providers' data processing agreements

Google Fonts also involves data transfer to the US (browser IP address), covered by the EU-US Data Privacy Framework.

All other external requests go to servers within the EU (Hetzner in Germany) or to services that do not process personal data.

Your Rights Under GDPR

As a data subject, you have the following rights under the General Data Protection Regulation:

  • Right of access (Art. 15 GDPR) — You can request information about what data we hold about your installation.
  • Right to rectification (Art. 16 GDPR) — You can request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR) — You can request deletion of your data (license records, telemetry, Hive contributions linked to your instance ID).
  • Right to restriction of processing (Art. 18 GDPR) — You can request that we restrict processing of your data.
  • Right to data portability (Art. 20 GDPR) — You can request your data in a machine-readable format.
  • Right to object (Art. 21 GDPR) — You can object to processing based on legitimate interest (telemetry, updates, news). For telemetry, use the opt-out toggle in settings. For other objections, contact us.
  • Right to withdraw consent (Art. 7(3) GDPR) — You can withdraw consent at any time by disabling the respective feature (AI detection, Hive, image providers). Withdrawal does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, contact privacy@wpfaker.com.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent supervisory authority is determined by your place of residence, your place of work, or the place of the alleged infringement. You can find a list of all European supervisory authorities at edpb.europa.eu.

Automated Decision-Making

WPfaker does not engage in automated decision-making or profiling within the meaning of Art. 22 GDPR. The AI field detection feature uses artificial intelligence to suggest faker methods for data fields, but this process:

  • Only concerns the structure of custom fields (metadata), not personal data
  • Does not produce legal effects or similarly significantly affect any natural person
  • Is used solely for generating fake/test data in a development context

Contact

To request deletion of any data associated with your license or installation, to exercise your GDPR rights, or to ask privacy-related questions, contact us at privacy@wpfaker.com.

Released under the GPL2 License. wpfaker.com