Data and key security
How WooMate protects keys, limits access and handles customer data.
WooMate connects to your store and to external services. This article explains how it protects that access and your customers' data.
Keys and connections
- AI keys are encrypted. You can't see their full value after saving.
- OAuth connection tokens are encrypted in the database (AES-256-GCM).
- Payments are handled by Stripe. WooMate doesn't store card details.
- You remove an AI key in Settings → AI and costs.
- You disconnect Google and Meta accounts in Settings → Google and Meta accounts.
- You can narrow WooCommerce access by choosing Read only.
Store protection
- Changes from the chat and Studio require approval of the specific operation. The exceptions are actions you start directly with a button, such as adding a graphic to a product or running an import.
- Approval expires after 15 or 30 minutes.
- WooMate checks the data before saving and doesn't overwrite newer changes.
- WooMate doesn't retry an uncertain write on its own.
- The AI is instructed to treat store content and comments as data, not as instructions.
Data sent to AI
Parts of your store data, your messages and attachments go to the AI provider you chose, through your key. The provider's own terms govern how they're processed. In Studio, you can check them with Show the data sent to AI.
Customer data in AI chat
By default, WooMate AI doesn't get your customers' contact details. Before order, customer and comment data reaches the model, WooMate replaces it with “•••”:
| Data | What the AI sees |
|---|---|
first letter and domain, e.g. r•••@gmail.com | |
| Last name | initial, e.g. B••• |
| Phone, street, postal code | ••• |
| Username, IP address, browser | ••• |
| First name, company, city, country, amounts, products | unchanged |
Searching for an order by last name or email still works: type it in your message, and the chat will use it in the search. A masked value can't be saved to your store. Such a proposal is rejected with the message “Customer data is hidden from the AI (•••), so it can't be saved”.
You turn on full data in the store settings:
- Open the store settings, Advanced section.
- Under Customer data in AI chat, check Show full customer data to AI.
Only turn this on when the chat needs to work with addresses, phone numbers or emails. The data will then go to the model provider you use (Anthropic or OpenAI). The setting applies to data read from your store. A file or text you paste into the conversation yourself goes to the AI unchanged.
Your control
- Use a separate key for WooMate, so you can revoke it without affecting other services.
- Set a limit in the AI budget section.
- Read the warnings before you approve.
- When you stop using WooMate, delete the WooCommerce key in your WordPress dashboard.
Limitations
Deleting a store from WooMate erases its conversation history and settings, but doesn't remove the keys created in WooCommerce. Do that in WordPress.
Related articles
Can't find the answer? Write to hello@getwoomate.com or request free onboarding help.