Legal

Privacy Policy

Last updated: 2026-10-27

At a glance

We don’t ask for personal information unless we truly need it. We don’t share your personal information except to comply with the law, to provide our Services, and to protect our rights. We don’t sell your personal information. This Privacy Policy explains what we collect, why we collect it, who we share it with, and what choices you have.

This policy applies to automatorplugin.com, the Uncanny Automator WordPress plugin, Uncanny Agent, the Uncanny Automator MCP Server, and the related Services described in our Terms & Conditions. When you created a free Uncanny Automator account or purchased Uncanny Automator, you agreed to this policy.

Capitalized terms not defined here have the meanings given in the Terms.

When you use the Services to process personal data of your end users (for example, in an Automator recipe that handles your customers’ data, in an Uncanny Agent conversation that reads data from your site, or when an AI app you connected through the Uncanny Automator MCP Server runs an action on your site), you act as the controller (or business) and we act as the processor (or service provider). In that role, our Data Processing Addendum governs how we handle that data on your behalf.

Who we are

Uncanny Owl Inc. is a Canadian corporation, with our main office in Markham, Ontario. For privacy questions, data-subject rights requests, and DPA requests, contact us at:

privacy@uncannyowl.com

1. What we collect and why

1.1 Website visitors

When you visit automatorplugin.com, we (and our analytics providers) automatically collect:

• Browser type, language preference, operating system
  
• Referring URL and pages viewed
  
• IP address and approximate geolocation derived from it
  
• Request timestamps
  
• Interactions with pages, forms, and on-screen content (via session replay: see Section 3 below)
  

Why: to operate and secure the Site, prevent fraud and abuse, understand how the Site is used, and improve it. Legal basis (where GDPR applies): legitimate interests (operating and improving the Site) and, for analytics and session replay, your consent through our cookie banner.

1.2 Account, billing, and license data

When you create an account or purchase a Subscription, we collect:

• Name, email address, billing address
  
• Payment information (processed by Stripe or PayPal: we do not store full card numbers)
  
• License Key and entitlements
  
• Tax information where required
  

Why: to provide the Services, process payments, deliver License Keys, send transactional emails, comply with tax and accounting obligations. Legal basis: contract (to provide what you bought) and legal obligation (tax, accounting, fraud prevention).

1.3 Support communications

When you contact us for support, we receive whatever you choose to share: typically your email, account details, and the question itself, along with any logs, screenshots, or attachments you send. Support tickets are stored in Help Scout.

Why: to respond to and resolve your request, train our team, and improve the Services. Legal basis: contract and legitimate interests.

1.4 Newsletter and marketing

If you sign up for our newsletter or you’re an existing customer, we may send you product updates, promotions, and educational content. We process your name and email through Lindris.

Why: to keep you informed about updates and offers relevant to you. Legal basis: consent (where required) or legitimate interests, with the right to opt out at any time.

1.5 Plugin usage telemetry

The Plugin can transmit limited usage data back to us, including:

• Active plugins and themes on your WordPress site
  
• Plugin settings (excluding sensitive values such as API keys, tokens, and passwords)
  
• Recipe statistics (counts, types and triggers/actions)
  
• Onboarding and walkthrough completion
  

Why: Product improvement, usage analysis, and marketing personalization: for example, using milestones like your first recipe creation to segment your account in our CRM so we can send you more relevant onboarding and product communications rather than generic messaging.

Opt-out: Free users with a connected account or paid users can opt out by contacting support. Free users without an account can enable telemetry under Automator > Settings > Improve Automator.

1.6 Uncanny Agent conversations

When you use Uncanny Agent, we process the Inputs you provide via the chat interface and the Outputs the Agent generates, together with the data the Agent reads from your WordPress site or connected services to complete your requests. Uncanny Agent does not access data outside the scope of what is needed for your request. The full data terms for Uncanny Agent are in Section 6 of this policy and Section 9 of the Terms. Uncanny Agent is also available as a hosted app at mcp.automatorplugin.com; conversations, memory, and files you use there are stored on our servers as described in Section 6.7.

1.7 Affiliate program data

If you join the affiliate program, we collect your name, email, PayPal account, referral activity, and commission balances. Why: to operate the affiliate program. Legal basis: contract.

1.8 Uncanny Automator MCP Server connection data

When you use the Uncanny Automator MCP Server to connect AI apps such as ChatGPT, Claude, or Gemini to your WordPress sites, we process the account, site, connection, request, and activity data described in Section 7 of this policy. Legal basis: contract and legitimate interests.

2. How we use the data we collect

We use the data we collect to:

• Provide, secure, and improve the Services
  
• Process transactions, deliver License Keys, and provide support
  
• Send transactional, service, and (with your consent or where permitted) marketing communications
  
• Monitor and analyze use of the Site and Services
  
• Detect, prevent, and respond to fraud, abuse, and security incidents
  
• Comply with legal obligations and enforce our Terms
  
• For Uncanny Agent specifically, to fulfill your requests (see Section 6)
  
• For the Uncanny Automator MCP Server, to authenticate the AI apps you approve, route their requests to your sites, enforce usage allowances, and keep the activity records described in Section 7
  

We do not sell personal information, and we do not use your Uncanny Agent Inputs or Outputs, or MCP Server requests, results, or activity records, to train, fine-tune, or otherwise develop machine-learning models.

3. Cookies, analytics, and session replay

We use cookies and similar technologies to operate the Site, remember your preferences, understand how the Site is used, and (where you consent) measure marketing performance.

3.1 Categories of cookies and technologies

Category	Purpose	Examples
Strictly necessary	Authentication, cart/checkout, security	Login session, CSRF tokens, Cloudflare security cookies
Functional	Remember preferences and settings	Language, theme, dismissed banners
Analytics	Measure usage and improve the Site	Google Analytics 4, Microsoft Clarity
Marketing / advertising	Measure and target marketing	Meta (Facebook) Pixel, Google DoubleClick / Google Ads remarketing

You can manage your cookie preferences through our cookie banner or your browser settings. Disabling cookies may affect Site functionality.

3.2 Affiliate cookies

If you click an affiliate link, an affiliate cookie may be set so that we can credit a referring affiliate for any subsequent purchase. Affiliate cookies do not collect personal information beyond what is necessary to attribute the referral.

3.3 Do Not Track

Some browsers send a “Do Not Track” signal. There’s no industry standard for honoring DNT, so we don’t respond to it. We do honor opt-out preferences expressed through our cookie banner and through opt-out signals required by applicable law (including the Global Privacy Control / GPC, where required by California law).

4. Who we share data with

We share data only with subprocessors who help us provide the Services, with the limited categories of recipients described below, and where required by law.

4.1 Subprocessors

The current list of subprocessors that process personal data on our behalf is published at our subprocessors page.

4.2 Other recipients

We may share personal data:

• With our professional advisors (legal, accounting, insurance) under duties of confidentiality.
  
• In connection with a corporate transaction (merger, acquisition, financing, sale of assets), in which case the recipient will be bound by terms substantially similar to this policy.
  
• To comply with law (subpoena, court order, lawful government request, or to investigate fraud or security incidents).
  
• To protect our rights, property, or safety, or those of our users or others.
  

4.3 What we do not do

• We do not sell your personal information for money.
  
• We do not use Uncanny Agent Inputs or Outputs to train, fine-tune, or otherwise develop machine-learning models.
  
• We do not share Uncanny Agent Inputs or Outputs with our subprocessors except as necessary to provide the Service.
  
• We do not use Uncanny Automator MCP Server requests, results, or activity records to train, fine-tune, or otherwise develop machine-learning models, and we do not share them with our AI model providers, except the text of a search as described in Section 7.2.
  

5. Plugin and recipe integrations

Uncanny Automator lets you connect third-party services (“apps”) to your WordPress site and pass data between them through your recipes.

• Data flow: Data passes between your WordPress site, our API server (where required for the integration), and the connected third-party service. Our role is to relay or transform the data as configured by your recipes.
  
• What we log: We log a minimal record of API requests for billing, abuse-prevention, and troubleshooting purposes. We do not log the contents of personal data passing through recipes except where required to diagnose a specific issue you report.
  
• Third-party services: Data passed to a third-party service is governed by that service’s terms and privacy policy, not this policy.
  
• Webhook integration: When you configure a Google Sheets webhook, modified rows are sent to the URL you specify.
  

5.1 Google API services

Where you connect Google APIs (Drive, Sheets, Calendar, Contacts, YouTube, Workspace), Uncanny Automator’s use and transfer of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google API data is used solely to perform the automation you have configured.
  
• Google API data is not used to develop, improve, or train AI/ML models.
  
• You can revoke our access to your Google account at any time through your Google security settings.
  

5.2 BYOK AI integrations

Uncanny Automator includes “AI Actions” that let you connect AI services (OpenAI, Anthropic, DeepSeek, and others) using your own API key. These integrations are separate from Uncanny Agent.

• Only data you explicitly configure in a recipe is sent to the AI service.
  
• The AI service processes that data under your account and your contractual relationship with that provider, not ours.
  
• Use of these integrations is optional.
  

5.3 Facebook / Meta integrations

We do not share Facebook Restricted Platform Data with any third party.

6. Uncanny Agent

This section applies specifically to Uncanny Agent. The full terms governing Uncanny Agent are in Section 9 of the Terms.

6.1 What we process

Uncanny Agent processes:

• Your Inputs: the messages and instructions you provide via the chat interface or the hosted app
  
• Your Outputs: the responses Uncanny Agent generates
  
• Data Uncanny Agent reads from your WordPress site, the sites you have connected in the hosted app, or connected services to complete your requests
  
• Metadata about the conversation (timestamps, model used, token counts, billing meters)
  

Uncanny Agent does not access data outside the scope of what is needed for your request.

6.2 How we use Inputs and Outputs

We may review and sample Inputs and Outputs to operate, secure, troubleshoot, and improve Uncanny Agent: including for internal evaluation, quality assurance, prompt iteration, and red-teaming. We do not use Inputs or Outputs to train, fine-tune, or otherwise develop machine-learning models, and we do not use them to build retrieval indexes or training datasets.

6.3 Third-party AI providers

To provide Uncanny Agent’s functionality, your Inputs and related data may be transmitted to:

• Anthropic, PBC (Claude)
  
• Google LLC (Cloud Vertex AI)
  
• Amazon Web Services, Inc. (Bedrock)
  
• DeepInfra, Inc.
  
• OpenAI, LLC (Responses API)
  

Each of these providers operates under their commercial enterprise terms with us. Under those terms, none of these providers uses your Inputs or Outputs to train their foundation models, and data is retained only for the limited periods needed to operate the service and meet abuse-monitoring or legal-compliance obligations. The hosted app (Section 6.7) may also send files you attach to a conversation to one of these providers to read the file’s contents, even when a different provider supplies the conversation’s model.

6.4 Retention

You may delete your Uncanny Agent conversation history at any time from within the product, or by emailing privacy@uncannyowl.com; deletion requests are processed within 30 days. We may retain a minimal record of the fact that a conversation occurred (without its contents) for legal, tax, accounting, fraud-prevention, or audit purposes. Conversations and files in the hosted app (Section 6.7) are kept until you delete them; we do not currently apply an automatic expiry. Files you attach but never send are deleted after 24 hours. Deleting a conversation also deletes its attached files and any text we extracted from them.

6.5 Accuracy and high-risk uses

Uncanny Agent may produce inaccurate or incomplete Output. You should not rely on Output as a sole source of truth or as a substitute for professional advice, and you may not use Uncanny Agent or its Output as the sole or material basis for decisions with legal or similarly significant effect on a person (credit, employment, education, housing, insurance, immigration, public benefits, legal rights, medical diagnosis or treatment). See Section 9.3 of the Terms.

6.6 Children

Uncanny Agent is not intended for, and may not be used by, anyone under 13. Users between 13 and 18 may use it only with parental or guardian involvement and consent. See Section 9 of the Terms.

6.7 Hosted app

Uncanny Agent is also available as a hosted app at mcp.automatorplugin.com. When you use it there, your conversations, messages, uploaded files, and personal memory are stored on our servers and belong to your hosted account. A conversation can use several connected WordPress sites; connecting a site gives the Agent access to that site and does not change who owns the conversation. When you open a conversation that started inside WordPress, the hosted app creates a private copy for your account the first time you send a message; the original stays in WordPress. Disconnecting a site keeps your completed conversations and files but ends the Agent’s access to that site.

Files you attach to a hosted conversation are stored with that conversation. To read a file, we send it to the AI providers listed in Section 6.3, which may include a different provider from the one supplying the conversation’s model. A file you attach but never send is deleted after 24 hours. Deleting a conversation also deletes the files attached to it and any text we extracted from them. Conversations and files in the hosted app are kept until you delete them; we do not currently apply an automatic expiry. See Section 6.4.

7. Uncanny Automator MCP Server

The Uncanny Automator MCP Server lets you connect AI apps you already use, such as ChatGPT, Claude, and Gemini, or any other app that supports remote MCP (Model Context Protocol) servers, to your WordPress sites. The connection runs through our hosted service at mcp.automatorplugin.com: you sign in with your automatorplugin.com account, connect one or more WordPress sites, and approve each AI app. The AI app can then take actions on the sites you selected, within the permissions you grant. The terms governing it are in Section 8 of the Terms.

7.1 Information we process

To operate the connection we process:

• Your automatorplugin.com account and the license you choose at sign-in, which determines your plan and usage allowance
  
• Details of the WordPress sites you connect, including the site address, the Uncanny Automator version, and the WordPress user whose permissions each connection uses
  
• Connection tokens for your sites and for the AI apps you approve. These are stored encrypted. Site approval happens in WordPress, so we never receive your WordPress password.
  
• The identity of each AI app you approve and the sites and access level you granted it
  
• The requests the AI app sends and the results your site returns. Depending on the action requested, this can include website content, uploaded files, user or customer records, and automation settings.
  
• Files an AI app uploads to your site pass through our service to your site, where they are stored as ordinary media files under your control. We do not keep a separate copy of them beyond the activity record described in Section 7.2.
  

Why: to maintain your connections, authenticate AI apps, route each request to the right site, carry out the requested actions, and enforce usage allowances. Legal basis: contract (providing the Service you signed up for) and legitimate interests (securing and operating it).

7.2 Activity and diagnostic records

We keep a record of each tool call for 90 days: which account, AI app, and site were involved, the tool, the time and duration, the outcome, and a copy of the request and result with credentials removed and large payloads truncated. We also keep usage counts, error reports, and the details you include in support requests.

Usage counts contain no request content and are kept for as long as your account exists. Error reports are kept for one year.

When your AI searches for an available trigger, action, or condition, the search text is sent to our search service together with your plan and the list of integrations active on your site, so the results match what you have installed. No site content is sent. We use a Google Cloud AI service to match the search text against our catalog; neither we nor Google use it to train AI models, and we keep it only in short-term service logs.

We do not use MCP requests, results, or activity records to train, fine-tune, or otherwise develop machine-learning models. Apart from the search text described above, requests from your AI app are not sent to the AI providers listed in Section 6.3 and do not use Uncanny Agent; your AI app’s provider supplies the model.

7.3 Who receives it

Information passes between our hosted service, your chosen AI app, your WordPress site, and any third-party services your Automator integrations connect to. Our hosted service runs on infrastructure providers listed on our subprocessors page. Your chosen AI app and connected third-party services process information under their own privacy policies, not this one: including any personal data about your users that your site returns to the AI app.

7.4 Your controls

From the hosted app you can see which AI apps are connected and which sites each one may use, change what an app is allowed to do, disconnect a site, or revoke an app’s access. Revoking access takes effect immediately for future requests. You can also see your usage for the current period and your activity history for the last 90 days.

Revoking access does not automatically erase previously processed information, remove content created on your site, or disable automations already created. Those automations may continue running until you disable them in Uncanny Automator. When you disconnect a site, we delete the stored credentials for that site within about an hour. We keep a basic record of the connection (site address, WordPress username, and status) and the related activity records for the 90-day period in Section 7.2. The approval record on your WordPress site may remain visible for up to 90 days but no longer grants access. To request deletion of your activity records or account, email privacy@uncannyowl.com.

7.5 Your role

When a connected AI app processes personal data of your end users through your site, you are the controller (or business) and we act as processor (or service provider) for the part of that processing that runs through our hosted service. Our Data Processing Addendum covers that processing. You are responsible for having permission to share personal information belonging to others with the AI app you choose, and for any notices or consents your users require. The AI app’s provider processes data on your instructions under your agreement with it, not ours.

The retention (Section 8) and privacy-rights (Section 9) provisions elsewhere in this policy also apply to these connections.

8. Retention

We keep personal data only as long as we need it for the purpose we collected it, to comply with legal obligations, to resolve disputes, and to enforce our agreements.

9. Your rights

Your privacy rights depend on where you live. In all cases, you can exercise them by emailing privacy@uncannyowl.com. We’ll respond within the timeframes required by applicable law: generally within 30 days.

10. Affiliate disclosure

Some pages on our Site contain affiliate links. If you click one and make a purchase, we may earn a commission.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top tells you when the current version took effect. Uncanny Owl encourages visitors to frequently check this page for any changes to this privacy policy. If you keep using the Services after a change takes effect, that counts as accepting the updated policy.

This Privacy Policy supersedes the version dated 2026-04-28.