Privacy & Data Management
The plugin is designed for organisations that operate in regulated environments. It is self-hosted, the Free plugin makes no external network requests, and it integrates with the WordPress personal data export and erasure tools to help you meet privacy obligations such as GDPR.
What personal data the plugin stores
| Data type | What is stored | Default retention |
|---|---|---|
| Acknowledgement records | User account, document, version, date and time, expiry date, the user’s role, a fingerprint of the content acknowledged, and the IP address (on by default — can be switched off). Where used: comprehension quiz questions, answers and score; reading time and reading reach; for an acknowledgement recorded on someone’s behalf, the administrator who recorded it and their reason | 7 years |
| Edit suggestions | User account, suggested content, note, review status | 2 years |
| FAQ and document feedback | User account (when logged in), helpful/not-helpful rating, optional written feedback. No IP address is stored by default | 1 year |
| Document view history | Viewer’s role, document, date and time. The user account is recorded only if Track View User Identity is on (off by default) | 90 days |
| Search queries | Query text, number of results, searcher’s role. Not linked to the user’s account | 90 days |
| PDF downloads | User account, role, document, date and time — recorded while Track PDF Downloads is on | 90 days |
| Governance event log | Governance actions such as version approvals and acknowledgement-setting changes, with the user who performed them | 30 days |
| Document version history | For each saved version: the content at that version and the users who authored and approved it | Kept indefinitely |
| Owner review sign-offs | The reviewer, an optional note, and the date | Kept as part of the document’s history |
| User preferences | Each user’s bookmarks, saved searches, and acknowledgement-reminder opt-out | Until the user removes them or their data is erased |
Search log and view log retention can be changed in Settings → System Configuration → Analytics & Data Retention; set either to 0 to keep that log indefinitely. The other retention periods are fixed defaults that cannot be changed from the Settings screen — ask your developer if you need a different period.
Pro add-on stores some additional data on your site:
| Data type | What is stored | Default retention |
|---|---|---|
| AI activity log | For each AI request: the user who made it, the AI provider and model, the feature, the document, and cost/usage details | Kept indefinitely unless automatic retention pruning has been switched on |
| AI job queue | Queued AI work, including the user who requested it | Removed shortly after each job completes |
| Approval chain state | Approvers, their decisions and dates, and approval link expiry times | Kept as part of the document’s history |
| Reading progress | Reading time and reach per document, so progress carries across sessions (when read-time capture is on) | Until the document is acknowledged or the data is erased |
| Acknowledgement waivers | The person excused from a policy and the reason given. Treat waiver reasons as sensitive — they may describe health, performance or personal circumstances | Kept until deleted |
When the AI activity log grows large and retention pruning is still off, Pro shows administrators a reminder to decide how long to keep it.
No external data transmission (Free)
The Free plugin makes no external network requests during normal operation. Your documents, acknowledgements, and staff data remain on your server. (If you embed third-party media, such as a YouTube video, in an FAQ answer, the visitor’s browser loads it from that provider as usual.)
The Pro add-on can optionally connect to:
- OpenAI or Anthropic — for AI features (off by default, uses your own API key). Document content is sent to the provider for the feature you use, and search text is sent if you turn on AI-assisted search. Documents marked Confidential are never sent to an AI provider.
- An HTTPS webhook URL you choose — for acknowledgement notifications (off by default). Email addresses are not included unless you opt in.
- The vendor’s licensing server — to activate your licence and deliver Pro updates.
AI and webhooks are explicitly opt-in and require administrator configuration. An erasure request cannot recall data that has already been sent to an AI provider or webhook recipient — that data is held under the third party’s own terms.
WordPress Privacy API integration
The plugin registers with the WordPress personal data tools, found under Tools → Export Personal Data and Tools → Erase Personal Data. It appears in those tools as Dantian Policy Management.
Personal data export
When a staff member requests a copy of their personal data (for example under GDPR Article 15):
- Go to Tools → Export Personal Data.
- Enter the user’s username or email address and click Send Request.
- Once the request is confirmed, download the export (or email it to the user) from the request list.
- WordPress collects data from all registered plugins, including this one.
The export includes the user’s:
- Acknowledgements (with IP address, role, quiz results, reading time and on-behalf details where recorded)
- Edit suggestions
- FAQ and document feedback
- PDF download history
- Document view history (only views recorded while Track View User Identity was on)
- Search history (only searches linked to their account)
- Bookmarks, saved searches, reminder opt-out, owner review sign-offs, and the user lists they belong to
- Governance event log entries
- Document versions they authored or approved
With Pro active, the export also includes the user’s AI activity, approval-chain reviewer state, acknowledgement waivers, and in-progress reading sessions.
Personal data erasure
When a staff member requests deletion of their personal data (GDPR right to erasure):
- Go to Tools → Erase Personal Data.
- Enter the user’s username or email address and click Send Request.
- Once the request is confirmed, click Erase personal data on the request.
What the plugin does on erasure:
Acknowledgement records are anonymised rather than deleted. The user’s account link, IP address and any on-behalf reason are removed, but the record itself (document, version, date) is kept. This preserves the compliance audit trail while removing the personal identifier.
The following are also anonymised (the person’s identity is removed, the record stays):
- Owner review sign-offs, document version history entries, and governance event log entries
- Searches linked to the user (the query text stays for analytics, without the user link)
- Their name on edit suggestions they reviewed, and on acknowledgements they recorded for other people
The following are deleted:
- Edit suggestions they submitted
- FAQ and document feedback they submitted while logged in
- Their PDF download and document view history
- Bookmarks, saved searches, and other plugin preferences
With Pro active, the user’s AI activity, waiver records and in-progress reading sessions are deleted, and their approval-chain reviewer state is cleared or anonymised.
This behaviour is intentional — deleting acknowledgement records entirely would leave gaps in your audit trail that an auditor might question. The anonymised record still shows “someone acknowledged this document at this time” without identifying who. If you need different behaviour (for example, deleting acknowledgement records entirely), your developer can change it.
Feedback submitted by logged-out visitors is not linked to any account, so an individual erasure request cannot target it. It is removed by the 1-year retention clean-up instead.
Privacy policy content
The plugin provides suggested privacy policy text. To add it to your site’s privacy policy:
- Go to Settings → Privacy and click the Policy Guide link (or open the privacy policy guide from the block editor).
- Find the Dantian Policy Management section.
- Click Copy suggested policy text to clipboard.
- Paste it into your site’s privacy policy page and adjust it to match your settings.
When you adjust the text, check it against this page:
- The suggested text describes acknowledgement, edit-suggestion, feedback and PDF download retention as configurable. Only search log and view log retention can be changed from the Settings screen; state the fixed periods listed above unless your developer has changed them.
- It refers to settings by older screen names. The IP address and reading-time switches are on Settings → Acknowledgements & Notifications.
🔒 Pro feature — requires the Pro plugin.
With Pro active, a separate Dantian Policy Management Pro section describes what Pro stores and what it can send to AI providers and your webhook address. It doesn’t mention that Pro contacts the vendor’s licensing server to activate your licence and deliver updates — add a sentence about that if your policy lists every external service your site uses.
Cookies and client-side storage
Cookies:
dpma_faq_throttle— Set for logged-out visitors only when the plugin cannot determine their IP address. It limits repeat FAQ feedback submissions and FAQ view counting. Expires after 24 hours. Contains only a random token and no personal data. HttpOnly, SameSite=Lax, and Secure when your site uses HTTPS.
Browser storage:
- Recent search queries are cached in the browser for up to 5 minutes to avoid duplicate network requests. This cache never leaves the user’s device.
IP address logging
By default, the IP address of the device used to acknowledge a document is stored with each acknowledgement record. Some auditors want this as additional evidence; others consider it unnecessary personal data.
To stop recording IP addresses, go to Settings → Acknowledgements & Notifications and switch off Record IP Address with Acknowledgements. Existing records keep their IP address; only acknowledgements made after the change are stored without one. To remove a specific person’s stored IP addresses, use Tools → Erase Personal Data.
If you keep IP logging on, disclose it in your privacy policy.
FAQ and document feedback does not store IP addresses by default.
Configuring retention periods
Go to Settings → System Configuration → Analytics & Data Retention to set Search Log Retention and View Log Retention in days. Setting either to 0 turns off automatic clean-up for that log (records are kept indefinitely).
Background tasks permanently delete records older than each retention window:
- Weekly (scheduled for Sundays): search logs, view logs, acknowledgement records (7 years), edit suggestions (2 years), FAQ and document feedback (1 year) and PDF download logs (90 days). Because this runs weekly, a record can be up to a week past its window before it is removed.
- Daily: the governance event log (30 days).
The windows for acknowledgements, edit suggestions, feedback, PDF downloads and the event log are fixed defaults. Document version history is never automatically deleted. These tasks run through WP-Cron, so they depend on site visits or a server cron job.
Acknowledgement records older than 7 years are deleted automatically. If your regulator requires a longer retention period, export your attestation records before they reach that age, or ask your developer to lengthen the period.
To delete analytics data immediately, use Maintenance → Data Management at the bottom of the System Configuration tab.
On uninstall — data preservation by default
When you delete the plugin from WordPress, the default behaviour is to preserve all your data. Plugin code is removed; documents, acknowledgements, database tables, settings, and the Policy Auditor role are kept, and are picked up again automatically if you reinstall.
This protects you from accidentally losing years of acknowledgement history by mistakenly deleting the plugin.
If you want a full wipe, go to Settings → System Configuration → Uninstall Behaviour, tick the options you need, click Save, and then delete the plugin:
- Remove content & data on uninstall — Permanently deletes all Documents and FAQs, version history, acknowledgement records, search, view and download logs, the event log, plugin taxonomy terms (document types, categories, tags, FAQ categories, regulatory frameworks), the plugin’s database tables, and users’ bookmarks, saved searches and plugin preferences. Media attachments are kept.
- Remove configuration & capabilities on uninstall — Deletes all plugin settings, brand colours and scheduled tasks, removes the plugin’s capabilities from every role, and deletes the Policy Auditor role.
Pro add-on: A third option, Remove Pro data on uninstall, appears in the same section. It removes Pro-only data (such as AI summaries, approval-chain state, waiver records, framework material and the AI tables) when Pro is deleted. Pro always deletes its stored API keys when it is uninstalled, whatever you choose.
On a multisite network, uninstalling cleans up the current site only.
Warning: These operations are permanent and cannot be undone. Export your attestation records first, and enable these options only when you are certain you no longer need the data.
Regulatory compliance notes
The plugin provides the technical foundations that compliance frameworks typically require:
- Controlled publication — Version control and owner approval workflow
- Role-based access — Enforced when documents are fetched, not just by hiding links
- Acknowledgement evidence — Records tied to specific versions with content fingerprints
- Audit trail — Acknowledgement history, version history, and a governance event log
- Data residency — Fully self-hosted; the Free plugin sends no data off your server
Meeting a specific regulatory standard is always the organisation’s responsibility and depends on your policy content, processes, staff training, and the rest of your environment. The plugin provides the infrastructure; your organisation provides the governance.
For GDPR, HIPAA, and similar privacy laws: make sure you have a lawful basis for processing staff acknowledgement data (for example, legitimate interest in compliance, or an employment contract requirement), and include appropriate disclosures in your staff privacy notice.