Legal
Privacy Policy
How Cao-Tech handles personal information on our website, in our WordPress plugins, in the CaoDesk app and in Ahena.
Last updated: October 8, 2026
This policy explains what personal information Cao-Tech LLC (“Cao-Tech”, “we”, “us”) collects, why, and what choices you have. It covers:
- Our website, cao-tech.com, including the contact and project forms, the shop, the chat assistant and the client support portal;
- Our WordPress plugins: GhostPilot: AEO & SEO, Smart Reorder Emailer Pro, Square WooCommerce Sync Pro, Lumina AI Security, OmniSuggest AI, CaoDesk and SRE License Manager;
- The CaoDesk app for iPhone, iPad and Mac;
- Ahena (ahena.io), our developer platform (see section 5).
Summary: we collect what we need to answer you, deliver what you bought and support it. We do not sell personal information and do not use it for advertising profiles. Our plugins run on your WordPress site, and the data they manage stays in your site’s database unless a feature you turn on needs to send it somewhere. Those cases are listed below.
1. Information we collect on our website
Contact, project and support requests
When you use a form or open a support ticket we collect what you enter: your name, e-mail address, phone number, company, website, your message, and any files you attach. Support tickets, replies and attachments are stored in our WordPress site, and attachments are encrypted at rest. If you open a ticket without an account, we e-mail you a secure link to follow it. The link works for 14 days, and the browser you use it in can keep access for up to 30 days. We do not store your IP address with tickets. Browser details are recorded with a ticket only if we switch that option on to troubleshoot.
Client accounts
If you create an account in the support portal we store your name, e-mail address, website, company (optional) and password. WordPress stores the password only in hashed form. You can sign out at any time and ask us to delete the account.
Purchases, licenses and subscriptions
When you buy a plugin, subscription or service we collect your name, e-mail address, billing details and order history, and we issue a license key. Payments are processed by Stripe. We never see or store your full card number. Stripe’s privacy policy applies to the payment itself.
Chat assistant
Messages you type into the chat assistant on our site are sent to an AI provider (see section 5) to generate a reply. We may keep the conversation, and any name or e-mail address you share in it, so we can follow up. Please don’t enter passwords, payment details or other sensitive information in the chat.
Newsletter and updates
If you subscribe, we keep your e-mail address (and name, if given) to send you updates. Every e-mail has an unsubscribe option, or you can contact us.
Analytics, security and logs
We use Google Analytics to understand which pages are used. Google processes your IP address and sets cookies to do this. Our forms are protected by Cloudflare Turnstile, which receives your IP address to tell people from bots. We count form submissions per visitor to stop abuse, and store those counters only as one-way hashes, not raw IP addresses. Our host, WP Engine, keeps standard server logs (including IP addresses) for security and operations.
2. Cookies
- Necessary: WordPress sign-in cookies, WooCommerce cart and checkout cookies, and the support portal cookie (
wordpress_cts_portal_…) that lets your browser reopen your tickets for up to 30 days. - Analytics: Google Analytics cookies.
You can block or delete cookies in your browser settings. If you block necessary cookies, signing in, checkout and the support portal won’t work.
3. Our WordPress plugins
Our plugins are installed on your own WordPress site. Your customers, orders, content, leads and support tickets stay in your site’s database under your control. For that data you are the one responsible for it (the “controller”), and you should describe it in your own site’s privacy policy. CaoDesk adds suggested wording for this under Settings → Privacy in WordPress. We receive data from a plugin only in these cases:
- License checks and updates (all plugins). Your license key, your site’s address, the product, and the plugin, WordPress and PHP versions go to cao-tech.com to activate the license, check it (usually once a day) and deliver updates.
- CaoDesk agent seats. CaoDesk is licensed per staff member. For each person who connects the CaoDesk app, the plugin sends a one-way hash of their e-mail address and their display name, so seats can be counted and labelled. The e-mail address itself is never sent. Removing a person’s last device frees their seat.
- Bug reports. Only when you send one: your description, your e-mail address, your site’s address, version numbers, and the error details and recent plugin logs attached to the report.
- AI features. When you turn on an AI feature, the content that feature needs is sent to the AI provider selected in the plugin’s settings. Examples: page text for SEO suggestions, product details for recommendations, chat messages, or form submissions being checked for spam. The providers are OpenAI, Anthropic, Google (Gemini), Perplexity or OpenRouter. On plans where Cao-Tech supplies the AI access, requests go through OpenRouter under our account. We use the account’s usage and cost totals for billing, and we do not use your content for anything else.
- E-mail sending through Cao-Tech. If you use our built-in e-mail sending (for example reorder reminders or outreach campaigns), the recipient addresses and message content pass through our server to SendGrid for delivery. We count messages sent to apply your plan’s limits. We do not use the recipients for anything else.
- Services you connect. Integrations such as Square, Twilio, Google Search Console, Google Analytics, Google Ads and your own AI or e-mail accounts exchange data directly between your site and that service, using your credentials and under that service’s terms.
When we process your customers’ data for you (e-mail sending, AI access we supply, license and seat records), we do it only to provide the service to you, and we don’t use it for anything else.
4. The CaoDesk app (iPhone, iPad and Mac)
- The app connects only to the WordPress sites you add to it. Your tickets, customers and messages travel directly between the app and your site over HTTPS. Cao-Tech does not receive them, except the short push notifications described below.
- No analytics, advertising or tracking is built into the app, and it does not collect data for Cao-Tech.
- On your device the app stores a separate, revocable sign-in credential for each site in the Apple Keychain, a copy of recent tickets so you can work offline, and your settings. Removing a site from the app disconnects the device from that site and deletes its cached data.
- Camera: used only when you choose to scan a pairing QR code. Images are not saved or sent anywhere.
- Notifications. The app shows notifications when it syncs. With instant push notifications on (Settings → Instant push notifications), your device’s push token is stored on the sites you connect. When a ticket arrives, your site sends a short notification to our push service (hosted on Cloudflare), which forwards it to Apple. It contains the notification title (for example “Customer Replied”), the ticket number and subject, and the site name. The push service delivers it and does not store it, or your device token. You can turn instant push off in the app at any time.
- Licensing for the app is handled by the CaoDesk plugin on your site (see section 3). The app itself does not contact Cao-Tech, apart from the push notifications described above.
5. Ahena
Ahena (ahena.io) is a developer platform operated by Cao-Tech LLC. The Ahena Privacy Policy describes Ahena in detail and applies to your use of Ahena; if it differs from this policy, it controls for Ahena. In short:
- Account information: name, e-mail address, organization and settings. If you sign in with Google, GitHub or another provider, we receive what you authorize them to share. We never receive your password for those accounts.
- Integration details you provide, such as API keys, tokens, project identifiers and configuration values. They are used only to set up and manage the connections you ask for, and are stored protected.
- Operational data about Ahena itself: IP address, device and browser details, sign-ins, dashboard and API activity, errors and security events. Ahena manages your stack, not your traffic: requests between your application and your providers go directly to them, and Ahena does not routinely receive or inspect them.
- Billing: paid plans are billed through Stripe under Cao-Tech LLC. We receive subscription status, invoices and billing contact details, but not full card numbers.
For Ahena privacy questions, e-mail privacy@ahena.io.
6. Who we share information with
We don’t sell or rent personal information, and we don’t share it for cross-context advertising. We share it only with service providers that help us run our business, under their own privacy and security terms:
- WP Engine (website hosting);
- Google (Workspace e-mail and Google Analytics);
- Stripe (payments for our website, software and Ahena);
- Cloudflare (Turnstile bot protection and the CaoDesk push notification service);
- SendGrid (e-mail delivery for plugin e-mail sending);
- OpenAI, Anthropic, Google, Perplexity and OpenRouter (AI features, when used);
- Apple (App Store distribution and push notifications);
- for Ahena, the sign-in and integration providers you choose to connect, as described in the Ahena Privacy Policy.
We may also disclose information if the law requires it, to protect our rights or users’ safety, or as part of a business transfer. In a business transfer, this policy would continue to apply.
7. How long we keep information
- Inquiries and support tickets are kept while we work with you and afterwards for reference, unless you ask us to delete them.
- Order, license and billing records are kept for the life of the license and as long as tax and accounting rules require.
- Guest ticket links expire after 14 days.
- Plugin logs and bug reports are kept only as long as needed to fix the problem.
- Server and analytics data follow the retention settings of WP Engine and Google Analytics.
8. Security
We use HTTPS everywhere, encrypt support attachments at rest, store only hashes of passwords, app credentials and pairing codes, limit access to administration, and rate-limit sign-in and license endpoints. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.
9. Your choices and rights
You can ask us to:
- tell you what personal information we hold about you;
- correct it or delete it;
- send you a copy.
You can also unsubscribe from e-mails or close your account at any time. Depending on where you live (for example the EU/UK under the GDPR, or California under the CCPA/CPRA), you may have further rights, such as objecting to certain processing. We will not treat you differently for using your rights. To make a request, contact us as described below. We may need to confirm your identity first. If your data is stored on a website that uses our plugins, please contact that website’s owner. They control it, and we will help them respond.
10. Children
Our website, plugins, app and Ahena are business tools that are not directed to children under 13, and we do not knowingly collect their personal information.
11. International transfers
We are based in the United States, and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for these transfers.
12. Changes to this policy
We will post any changes on this page and update the date at the top. If we make significant changes, we will give more notice, for example by e-mail or in the product.
13. Contact us
For questions or requests about privacy, e-mail support@cao-tech.com or open a ticket in the client support portal.
Cao-Tech LLC, New Hampshire, USA