CanaryWP explains how information is collected, processed, stored, and protected when you use CanaryWP and its WordPress testing, management, automation, backup, and AI-assisted services.
Last updated: September 22, 2026
1. Scope
This Privacy Policy applies to information processed through CanaryWP’s website, application, WordPress integrations, testing environments, APIs, support channels, and related services.
It covers activities involving:
- CanaryWP accounts and workspaces
- WordPress instances
- imported WordPress sites
- connected WordPress sites
- Site Testing
- maintenance and update workflows
- Canary Wizard
- CanaryWing
- backups and restores
- usage and billing information
- product feedback and support
This Privacy Policy does not govern third-party services that you independently use.
2. Information We Process
Account Information
We may process information such as:
- name
- email address
- profile information
- account identifier
- authentication information
- account status
- account preferences
We use this information to authenticate users and provide access to CanaryWP.
Workspace and Team Information
When you create or join a workspace, CanaryWP may process:
- workspace name
- workspace identifier
- workspace members
- member roles
- permissions
- invitations
- plan information
- feature access
- workspace settings
- tags
- activity
- notifications
This information helps CanaryWP determine which resources and actions each user may access.
3. WordPress Site Information
When you create, import, connect, test, or manage a WordPress site, CanaryWP may process information including:
- site name
- domain or URL
- WordPress version
- PHP version
- database information
- installed plugins
- plugin versions and status
- installed themes
- theme versions and status
- WordPress users and roles where applicable
- scheduled tasks
- WordPress options
- redirects
- environment configuration
- Site Health information
- uptime information
- operational metrics
- logs
- maintenance history
- backup information
This information is used to provide the WordPress management and testing functionality requested by you.
4. Imported WordPress Data
When you upload or import a WordPress website, CanaryWP may process the contents of that website as necessary to create and operate the requested environment.
Imported WordPress data may contain:
- pages
- posts
- media
- user accounts
- comments
- customer information
- WooCommerce information
- orders
- form submissions
- plugin data
- theme data
- email-related data
- logs
- configuration information
- API credentials
- other information stored by your WordPress website
You are responsible for ensuring that you are authorized to upload and process this information through CanaryWP.
CanaryWP may apply supported sanitization processes to testing copies to reduce unnecessary sensitive information.
Automated sanitization cannot guarantee that every sensitive value will be identified or removed.
5. Connected WordPress Sites
When a WordPress site is connected to CanaryWP, we may process:
- site URL
- WordPress environment information
- plugin and theme inventory
- source-site information
- connection identifiers
- temporary authorization information
- workflow status
- compatibility information
- simulation results
- update targets
- uploaded site assets
Certain connection workflows may use short-lived or single-use authorization credentials.
6. Site Testing
When you use Site Testing, CanaryWP may process:
- selected tests
- test steps
- test results
- screenshots
- visual comparisons
- browser output
- error information
- test evidence
- review decisions
- testing history
Testing history may be stored so that current and previous results can be reviewed and compared.
7. Maintenance and Update Information
When CanaryWP evaluates or performs WordPress maintenance, we may process:
- current software versions
- available updates
- selected update targets
- update plans
- compatibility information
- confidence information
- warnings
- test results
- maintenance outcomes
- maintenance history
Previous testing and maintenance outcomes may be used to improve future compatibility analysis.
8. Canary Wizard
When you use Canary Wizard, CanaryWP may process information necessary to coordinate and record the selected workflow, including:
- selected WordPress instances
- requested actions
- test results
- update plans
- workflow progress
- reports
- workflow outcomes
9. CanaryWing and AI Features
CanaryWing provides AI-assisted functionality within CanaryWP.
When you use CanaryWing, CanaryWP may process:
- your messages
- previous messages in a conversation
- workspace context
- current application context
- selected WordPress instance
- WordPress configuration relevant to your request
- plugin and theme information
- testing information
- maintenance information
- relevant logs or diagnostics
- tool activity
- generated responses
Relevant information may be transmitted to an AI service provider, including OpenAI, when necessary to generate a response.
CanaryWP may store CanaryWing conversations so that users can return to previous discussions.
You should not submit passwords, private keys, payment credentials, or unrelated sensitive personal information through CanaryWing.
AI-generated information may contain errors and should be reviewed before important actions are taken.
10. Backups and Restore Information
CanaryWP may process:
- backup files
- database backups
- WordPress files
- backup dates
- backup identifiers
- backup status
- restore history
- runtime information associated with a backup
Some supported backup methods may use encryption.
You are responsible for determining whether the backup configuration you use is appropriate for the sensitivity of your information.
11. Product Feedback and Support
If you submit a support request, bug report, feature request, or other product feedback, we may process:
- your name
- email address
- description
- comments
- application context
- screenshots
- screen recordings
- related diagnostic information
Do not include passwords, private API keys, payment credentials, or other unnecessary sensitive information in support submissions.
12. Usage, Plans, and Billing Information
CanaryWP may process:
- workspace plan
- feature access
- usage allowances
- credit balance
- credit usage
- runtime usage
- storage usage
- Site Testing usage
- CanaryWing usage
- Canary Wizard usage
- connected-site workflow usage
- billing adjustments
- top-up records
- plan-change requests
If CanaryWP introduces automated payment processing, payment information may be processed directly by the applicable payment provider.
13. Technical and Security Information
To operate and secure the service, CanaryWP may process:
- IP address
- request date and time
- authentication events
- security events
- request failures
- rate-limit events
- operational logs
- browser or device information
- session information
We use this information to protect accounts, investigate failures, prevent abuse, and maintain service reliability.
14. How We Use Information
CanaryWP may use information to:
- create and authenticate accounts
- manage workspaces
- enforce permissions
- create and manage WordPress environments
- import WordPress websites
- connect WordPress websites
- manage WordPress, PHP, plugins, and themes
- run Site Testing
- perform maintenance
- execute scheduled workflows
- create and restore backups
- provide CanaryWing
- provide Canary Wizard
- generate reports
- send notifications
- track usage
- manage plans and credits
- provide support
- investigate errors
- prevent fraud or abuse
- improve CanaryWP
- comply with applicable legal requirements
15. Cookies and Browser Storage
CanaryWP may use cookies or browser storage necessary to:
- keep you signed in
- maintain your session
- protect authenticated actions
- remember application preferences
- preserve workflow state
- maintain onboarding progress
If CanaryWP introduces optional analytics, advertising, or other non-essential tracking technologies, appropriate disclosures and controls will be provided where required.
16. Service Providers
Supabase
CanaryWP may use Supabase for authentication, application data, workspace information, operational records, chat history, product reports, and file storage.
Fly.io
CanaryWP may use Fly.io to operate infrastructure associated with managed WordPress environments.
Cloudflare
CanaryWP may use Cloudflare services for storage and delivery of certain WordPress imports, backups, uploaded archives, and operational artifacts.
OpenAI
CanaryWP may use OpenAI to provide CanaryWing functionality. Information relevant to a CanaryWing request may be transmitted to OpenAI when necessary to generate a response.
Email and Communications Providers
CanaryWP may use communications providers to deliver account notifications, reports, workflow results, and support messages.
Payment Providers
If automated payment processing is introduced, a payment provider may process payment and billing information.
CanaryWP may change service providers as the service evolves.
17. How We Share Information
CanaryWP may share information with service providers where necessary to operate the service.
Information may also be visible to authorized workspace owners, administrators, or members according to their roles and permissions.
If you configure integrations, callbacks, connected WordPress sites, or automated workflows, information necessary to perform those actions may be transmitted to the systems you configure.
CanaryWP may disclose information where reasonably necessary to:
- comply with applicable law
- respond to lawful legal requests
- investigate fraud or abuse
- address security incidents
- protect CanaryWP or its users
- enforce applicable agreements
Information may also be transferred as part of a merger, acquisition, restructuring, financing, or sale of business assets.
CanaryWP does not operate as a data broker and does not sell personal information for third-party advertising.
18. Data Retention
CanaryWP retains information only for as long as reasonably necessary to provide the service, maintain accounts and workspace history, support operations, protect the service, resolve disputes, and comply with legal obligations.
Retention periods may differ depending on the type of information.
Temporary import files may be removed after processing.
Testing environments and associated resources may be removed after an instance is deleted.
Backups may remain until they are deleted by the user, removed according to an applicable retention policy, or associated resources are terminated.
Certain security, support, usage, billing, or audit records may be retained for longer periods where reasonably necessary.
Deletion from active systems may not immediately remove information from backup systems.
19. Security
CanaryWP uses technical and organizational safeguards designed to protect information, including measures such as:
- authenticated access
- workspace and role-based permissions
- authorization controls
- protected application requests
- scoped credentials
- short-lived authorization tokens
- rate limiting
- callback validation
- server-side protection of privileged credentials
- supported encrypted backup methods
- security logging
- monitoring
No online service can guarantee absolute security.
You are responsible for protecting your credentials and limiting access to authorized users.
20. Your Rights and Choices
Depending on applicable law, you may have rights to:
- access your personal information
- correct inaccurate information
- request deletion
- request a copy of your information
- object to certain processing
- restrict certain processing
- withdraw consent where consent is the legal basis for processing
- submit a complaint to an applicable privacy authority
Requests may be submitted to:
[PRIVACY EMAIL]
If a request concerns information stored inside a customer’s WordPress website, the owner or operator of that website may be the appropriate party to contact first.
21. International Data Processing
CanaryWP uses cloud infrastructure and service providers that may operate in multiple countries.
Information may therefore be processed outside your country of residence.
Where required by applicable law, appropriate mechanisms will be used for international transfers of personal information.
22. Sensitive Information
WordPress websites and backups can contain sensitive information.
You should only upload or process sensitive information when:
- you are authorized to process it
- processing is necessary
- appropriate safeguards are in place
CanaryWP’s testing and sanitization functionality should not be treated as a substitute for your own privacy and security controls.
23. Children’s Privacy
CanaryWP is intended for professional and business use and is not directed to children.
Users must be legally capable of entering into an agreement to use CanaryWP.
24. Third-Party WordPress Software
WordPress websites may contain third-party plugins, themes, APIs, payment systems, analytics tools, and integrations.
These third parties may have their own privacy practices.
CanaryWP is not responsible for the independent privacy practices of third-party software solely because that software is installed on a WordPress website processed through CanaryWP.
25. Changes to This Privacy Policy
We may update this Privacy Policy as CanaryWP changes, legal requirements evolve, or new categories of processing or service providers are introduced.
Material changes may be communicated through the service or another reasonable method.
The latest revision date appears at the beginning of this Policy.
26. Contact
CanaryWP
[LEGAL ENTITY NAME]
[BUSINESS ADDRESS]
[PRIVACY EMAIL]
[SUPPORT EMAIL]