This notice describes what the Mass Custom Fields plugin and its Pro build do with data. It supplements the website privacy policy. The controller for the data described under licensing and support is [COMPANY_LEGAL_NAME], trading as WPMass, [COMPANY_ADDRESS]. Privacy contact: [PRIVACY_EMAIL]. Use this notice to describe the plugin correctly in your own privacy policy.
What stays on your server
The plugin has no WPMass server that receives your content. Field values, field group definitions, Global Data, data tables, generated pages, AI results and settings are stored in your own WordPress database. WPMass does not receive, read or process them.
Values you store in fields can be personal data, for example a user profile field. Field values saved on user accounts and on comments take part in the WordPress personal data export and erasure tools, under the name "Custom field values". The plugin also adds a suggested paragraph for your own policy under Settings › Privacy. Field values on posts, pages and terms are content, so you handle them under your own process.
Licensing and optional usage data
The plugin includes the Freemius SDK.
- After activation you are asked whether to share basic usage data. Nothing is sent unless you opt in. If you opt in, your server sends the site URL, the WordPress, PHP and plugin versions, the site language, the admin's name and email address, and activation, deactivation and uninstall events to Freemius.
- Starting a trial, buying or managing a license, and license checks of the Pro plugin go through Freemius. The license key and site URL are sent.
- Freemius is the merchant of record. It collects the data needed for the order and acts as a controller under its own privacy policy. WPMass receives the order and license information Freemius shares with us, for example customer name, email, plan, license status and the sites the license is used on. WPMass never sees card numbers.
Roles and sub-processors are listed in data processing and sub-processors.
Optional outside services
These services are contacted only when you use the matching feature. WPMass is not a party to them.
Feature | Who receives data | What is sent | Sent by |
|---|---|---|---|
Map field (default) | OpenStreetMap tile server; Nominatim for address search | Map tile coordinates of the viewed area, the page address as referrer, the browser's IP address and user agent; the searched address text | The visitor's or editor's browser |
Map field with Google selected (needs your API key) | Google Maps Platform | The viewed area, the search text, your API key, the browser's IP address and user agent | The browser |
oEmbed field | The provider of the embedded URL, for example YouTube or Vimeo | The URL the editor entered | Your server |
AI content (Pro, your own key) | The provider you choose: OpenAI, Anthropic or Google Gemini | The task brief and field notes you wrote, the page title and URL, the data row of each page and the field definitions; your API key authenticates the request | Your server |
Google Sheets feeds (Pro) | The link you entered is requested to download the sheet as CSV | Your server |
You choose the providers, create the accounts and keys, and agree to their terms. The plugin's readme on WordPress.org lists each provider's terms and privacy policy.
AI providers
AI content is bring-your-own-key: your server talks directly to the provider. WPMass has no server in between, sees none of your data and receives no usage statistics from AI. Visitors never trigger an AI request. Requests are sent only when you start a run, test a connection or use the editor actions.
Password columns of a data source are never sent. Everything else in a page's data row is sent, so do not point an AI-enabled task at a source that holds private data such as personal data or internal notes. Use a separate data table with only the public columns. Prompts and answers are not logged by the plugin. The provider bills your account, not WPMass, and its own terms govern what it does with the request, including retention and training. If you process personal data you may need a data processing agreement with the provider.
What the plugin stores
AI provider keys are stored encrypted in your database, or you can define them in wp-config.php. Password fields are never printed or exported. Deleting the plugin removes its data only if you enabled that in the plugin settings.
Cookies in the plugin
[PLUGIN_COOKIES_AND_STORAGE] Front-end forms (Pro) use a signed token and a rate limit against spam instead of a CAPTCHA service.
International transfers
Freemius and some providers you connect may process data outside your country. Where WPMass is responsible, we rely on [TRANSFER_MECHANISM].
Your rights
Depending on your location you may request access, correction, deletion, restriction or portability, object to processing, and withdraw consent. Write to [PRIVACY_EMAIL] about data WPMass holds. For data held by a site owner who uses the plugin, contact that site owner. You may complain to your local data protection authority.
Changes
We may update this notice. The version and date are shown on this page, and material changes will be announced [NOTICE_METHOD].
Contact
[COMPANY_LEGAL_NAME], [COMPANY_ADDRESS] · [PRIVACY_EMAIL]