This site uses cookies for analytics and to improve your experience. By clicking Accept, you consent to our use of cookies. Learn more in our privacy policy.

Let’s Talk

Privacy Policy — Specflux Marketing Analytics Chat

Specflux Solutions
SSM Registration: 201603047703 (IP0447581-D)
Website: www.specflux.com
Email: [email protected]

Last updated: 18 August 2026

This policy covers the Specflux Marketing Analytics Chat WordPress plugin (“the plugin”) and the Specflux Google sign-in service at api.specflux.com (“the sign-in service”) that the plugin can use to connect Google Analytics 4 and Google Search Console. It explains what data is involved, where it goes, and how you stay in control. Our general privacy policy covers the specflux.com website and our other services.

1. The short version

  • The plugin runs on your WordPress site. Your analytics data is fetched from Google and Microsoft by your site and stays on your site. It is never sent to Specflux.
  • The sign-in service only helps your site obtain Google access tokens. It holds tokens for at most five minutes during sign-in, sees your refresh token only when your site asks it to renew an access token, and never receives any analytics data.
  • Access to Google data is read-only. You can revoke it at any time from the plugin or from your Google Account.
  • Your data is shared with a third party only when you choose to: with the AI provider you configure in WordPress when you ask the chat a question, or with an MCP client you connect to your site.
  • We do not sell data, use it for advertising, or use it to train AI models.

2. Google user data the plugin accesses

When you connect a Google account, the plugin asks for the following OAuth permissions. Both are read-only; the plugin never creates, edits or deletes anything in your Google account.

OAuth scopeData accessedPurpose
https://www.googleapis.com/auth/analytics.readonlyGoogle Analytics 4 report data (for example sessions, users, page views, traffic sources, conversions) and the list of GA4 accounts and properties you can accessTo answer the questions you ask in the plugin’s chat, to fill the plugin’s dashboard widget, and to respond to requests from an MCP client you have connected. The property list is used only so you can pick which property to connect.
https://www.googleapis.com/auth/webmasters.readonlyGoogle Search Console performance data (clicks, impressions, average position, queries, pages, devices, countries) and the list of Search Console sites you can accessThe same purposes. The site list is used only so you can pick which site to connect.

Beyond the tokens needed to make these requests, the plugin does not read your Google profile, email address, contacts or any other Google data.

3. What the sign-in service does with your Google account

The sign-in service exists so that you do not have to create your own Google Cloud project to connect the plugin. It is operated by Specflux Solutions on servers under our control. Step by step:

  1. Your WordPress site asks the sign-in service for a Google consent link. The request contains the address of your site’s Connections screen and a random, single-use code generated by your site. No personal data is included.
  2. You approve access on Google’s consent screen. Google then sends a one-time authorisation code to the sign-in service.
  3. The sign-in service exchanges that code with Google for an access token and a refresh token, stores them in a database row for at most five minutes, and redirects you back to your site with a single-use hand-off reference. Tokens are never placed in a browser URL.
  4. Your site presents the hand-off reference and its single-use code; the sign-in service returns the tokens once over HTTPS and deletes them. Your site then stores them, encrypted, in your own WordPress database.
  5. Google access tokens expire after about an hour. While a connection is in use, your site sends its refresh token to the sign-in service, which obtains a new access token from Google and returns it. The sign-in service does not keep the refresh token after answering.

The sign-in service never requests, receives, proxies or stores any Google Analytics or Search Console data. Its only job is to broker tokens. Like any web server it keeps standard access logs (IP address, time, requested path, user agent) for a limited period for security and troubleshooting; these logs do not contain refresh tokens or analytics data.

If you configure your own Google OAuth client under Settings → Google API → Advanced, the plugin talks to Google directly and the sign-in service is not involved at all.

4. Where your analytics data lives

  • Credentials (Google tokens, Microsoft Clarity API token) are stored in your WordPress database, encrypted at rest with libsodium authenticated encryption using a random key generated on and stored only by your site. Specflux has no access to your site or its database.
  • Analytics results are fetched from Google or Microsoft on demand and cached temporarily on your site (30 minutes for Google Analytics, 24 hours for Search Console, 1 hour for Clarity) to reduce API calls. They are not stored permanently and are not sent to Specflux.
  • Chat history is stored on your site, private to each WordPress user, and conversations can be deleted from the chat panel.
  • The plugin does not track visitors to your website, sets no cookies for visitors, and sends no usage statistics or telemetry to Specflux.

5. When data is shared with third parties

Google user data is disclosed outside your site only in the following cases, each of which happens because you set it up:

  • Your AI provider. When you ask a question in the plugin’s chat, your message and the analytics results needed to answer it are sent by the WordPress AI Client (part of WordPress 7.0) to the AI provider you configured under Settings → Connectors — for example Anthropic (Claude), OpenAI or Google (Gemini). That provider’s own terms and privacy policy govern the transfer. The plugin stores no AI provider credentials; WordPress does.
  • MCP clients you connect. If you enable the WordPress MCP adapter and connect an AI assistant (such as Claude Desktop or Cursor) using a WordPress application password, that assistant can call the plugin’s read-only analytics tools and receives the results. You control which clients have access and can revoke an application password at any time.
  • Google and Microsoft themselves, as the source of the data, when your site makes API requests to them.

Specflux does not sell, rent or trade any data obtained through the plugin or the sign-in service, does not use it for advertising or profiling, and does not use it to build or train machine-learning models. We may disclose sign-in service log data if required by law.

6. Google API Services User Data Policy

The plugin’s and the sign-in service’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide the analytics features you see in the plugin, is not transferred to others except as described in section 5 (with your direction, to comply with law, or as part of a merger or acquisition with prior notice), is not used for advertising, and is not read by humans at Specflux.

7. Retention and deletion

  • On your site: tokens and cached results are kept until you disconnect the account, and everything the plugin stored is removed when you delete the plugin through WordPress.
  • Sign-in service: parked tokens are deleted as soon as your site collects them and in any case within five minutes; refresh requests are answered and not stored; access logs are rotated on a fixed schedule.

8. Revoking access

  • In WordPress, go to Marketing Analytics → Connections and click Disconnect. The plugin revokes the token with Google and deletes it from your site.
  • Or remove “Specflux Marketing Analytics Chat” from your Google Account → Third-party apps & services page. The stored token then stops working immediately.

9. Security

All traffic between your site, the sign-in service and Google uses HTTPS. The sign-in service binds each sign-in to a signed, time-limited state value and to a single-use code held by your site, so a sign-in cannot be replayed or hijacked. Credentials on your site are encrypted at rest. Only WordPress administrators can connect or disconnect accounts or change plugin settings.

10. Children

The plugin and the sign-in service are business tools for website owners and are not directed at children under 13. We do not knowingly collect information from children.

11. Changes to this policy

We will post any changes on this page and update the date at the top. Material changes to how Google user data is handled will also be noted in the plugin’s changelog on WordPress.org.

12. Contact

Questions about this policy or your data: [email protected]. Specflux Solutions, Malaysia. Plugin support is also available on the WordPress.org support forum.