Security and privacy
How PressLore protects your website, your visitors and your data: signed requests, no API keys on your site, data minimisation, privacy tools and Google's paid Gemini API.
PressLore is built for clinics, property firms and shops that cannot afford a chatbot that leaks data or makes things up.
No AI keys on your website
The Google Gemini key lives only on PressLore Cloud. Your site holds a per-site secret, and every request is signed (HMAC-SHA256 over time, a one-time nonce, the path and the body). Old or repeated requests are refused, so a copied request cannot be replayed.
Only public website content goes to the AI
The assistant sends the visitor question and the relevant parts of your public pages. Email addresses, phone numbers and postcodes are removed first. Names and contact details visitors leave for a call back stay on your website and in your inbox only.
Paid Gemini API, not the free tier
PressLore Cloud uses Google’s paid Gemini API. Under Google’s Gemini API terms, on the free tier Google may use prompts and answers to improve its products and people may review them; on the paid service Google says it does not use them to improve its products and keeps them for a limited time only to detect abuse and meet legal duties. This is Google’s commitment, not something PressLore can check, so we also remove emails, phone numbers and postcodes before anything is sent.
Built-in protection
- Chat accepts requests from your own domain only; bots and scripts are refused.
- Limits per visitor, per chat and per minute; three off-topic attempts pause a chat.
- Prompt injection guard: text on pages and in messages is treated as information, never instructions.
- Answers are shown as text, never HTML; links only to your site, WhatsApp, maps and known booking providers.
- Booking forms open in a sandboxed frame.
- Honeypot and consent checkbox on the contact form.
Privacy and data rights in every region
Chats are kept for 90 days by default (you choose 7 to 730). IP addresses are stored only as a salted hash. Visitors’ chats appear in WordPress Tools > Export and Erase Personal Data, and the plugin adds a ready paragraph to your privacy policy. These tools help you meet GDPR, UK GDPR, the UAE data protection law and similar rules. Deleting the plugin removes everything it stored.