This section covers INITE Agents, the service that publishes a business's confirmed facts for AI agents (see our Terms of Service). It describes what the service and its connectors send, and what we keep.
Our role
For the facts you confirm, the articles you approve, and for the pages of your site we read for them, you decide what is processed and INITE processes it on your instructions: you are the controller and INITE is the processor (Article 28 GDPR). For the records of how the service is used, described below, INITE is the controller. INITE Agents is not built for health information: do not put protected health information (HIPAA) or other special categories of data into your facts, which are public.
What we keep
• Facts: the working copy you edit, and every version you confirmed, with its time and the account that confirmed it.
• Site keys: a key is shown once, when it is made. We keep its SHA-256 hash, its first twelve characters so the cabinet can tell keys apart, and when it was last used.
• Domain proof: we read your homepage for the meta tag, or look up your domain's DNS TXT records. If your site refuses our reader, the homepage is read through Apify.
• Connector reports (about once a day; in the WordPress plugin, while "Daily report" is on): the platform and version of the connector, up to 20 paths it serves, and, for each of the last seven days, how many times each known AI agent (such as GPTBot, ClaudeBot or PerplexityBot) read those paths. The WordPress plugin and the Next.js package count a request only when its user agent names a known AI agent. They keep and send no IP address, no full user agent, no cookie and nothing about human visitors.
• Visits from AI assistants (in the WordPress plugin, only while "Daily report" is on): for each of the last seven days, how many page views came from an AI assistant (chatgpt.com, perplexity.ai, gemini.google.com, copilot.microsoft.com, claude.ai and a few more), per page and assistant, up to 60 rows a report. A view is counted when the browser's referrer or the link's utm_source names one of them. On your site the plugin keeps only the day, the page's path without its query, the assistant and a number, for 30 days. It keeps and sends no IP address, no cookie, no user agent and nothing that tells one visitor from another. We keep the counts with the record.
• "How did you hear about us" (in the WordPress plugin, only while you turn it on): one optional question at the WooCommerce checkout, in Contact Form 7 or WPForms forms, or where you place the [inite_how_heard] shortcode, with fixed answers (Google or Yandex search, ChatGPT, Perplexity, Gemini, Claude, Grok, Alice, GigaChat, another AI assistant, social networks, friends, other). On your site the plugin keeps only a number per day and answer, for 30 days: no name, no address, no order, no cookie. With "Daily report" on, it sends the counts of the last seven days with the report, and we keep them with the record. In the block checkout WooCommerce also stores the answer with the order, as it stores every checkout field; that copy stays in your shop and is not sent to us.
• The plugin's dashboard: at most every few hours, the WordPress plugin asks inite.ai, with your site key, for a summary we compute from what we already hold about the site: the latest analysis, the counts above, and the suggestions and articles waiting for you. It sends nothing else.
• Calls to your MCP server: the tool called, whether it answered, how long it took, the product name at the start of the caller's user agent, and a twelve-character key derived one way from a hash of the caller's IP address, so that distinct callers can be counted. Neither the IP address nor what the agent asked is stored.
• Webhooks: the address you add, its signing secret, and each delivery. Every delivery is a POST signed with HMAC-SHA256 under your secret, sent only to a public https address, without following redirects. facts.confirmed carries your domain, your slug, the version, the time of confirmation and the addresses to fetch the facts from, not the facts themselves; content.approved carries the approved article. The log of delivery attempts is kept for 30 days.
• Ghost: if you connect a Ghost site, its Admin API URL and the Admin API key of the custom integration you made for us. The key is stored encrypted (AES-256-GCM), is never shown again and is sent nowhere else: only our server uses it, to post the articles you approve to your Ghost site, published or as drafts as you chose, with the internal tag #inite-agents. Requests go only to a public https address, without following redirects. We keep the result of the last connection test, when the last article was sent and the last error.
• Articles: the queries measured for your site with their numbers, each draft, the results of our checks, your edits and decisions, the approved text, and the address where a connector reported it published.
• What assistants say about you: about once a month, and once right after your first confirmation, we ask an AI model the questions a customer would ask about your business: what it does, when it opens on weekdays and on Sunday, what up to three of your services cost, its address and phone. The questions carry your business name, your website, your city and the confirmed facts being checked; nothing about a person. Every answer is compared with your confirmed facts in our code and kept with the record: matches, differs or doesn't know, and the wording of an assistant's answer. The model we ask for every site is Jev by TypeSafe, which answers from its own knowledge; with INITE Agents Premium the same questions also go to ChatGPT, Claude, Perplexity and Gemini. Each of those four is asked every question three times in a pass, and we keep the share of answers that match; Jev is asked once, and we keep how likely it says its answer is.
• Local questions (INITE Agents Premium only): once a month, for up to five of your places that have coordinates in your facts, we ask Google questions a customer nearby asks without your name: up to four per place, each three times, built from your confirmed facts (your kind of business, a service, late or early hours, Sunday, a diet your menu serves, your street). They go to Google's Gemini API with Grounding with Google Maps, with a point about five minutes' walk from the place. Separately, Google's Places search is asked for your kind of business and one service from 33 points within a 15-minute walk, and once for your business name and address, to find your place on Google Maps. What is sent to Google: your business name and address (that one search only), coordinates around your place, the generated questions and search words. Nothing about a person. We keep, with the record, whether each answer named you, your place among the places named, the words it named you for, your Google place id and your place in each search. The names of other places Google Maps named are kept for 90 days, as Google's terms allow, and are not in the download. No answer text is kept. Without Premium nothing is sent.
• Your monthly report: once a month, the people who can act on the site receive a letter with the agents' reads, these differences and what to do next. It stops when you unpublish.
• Download my facts: in the "For agents" tab, the company's owner, an admin or a member can download everything kept for the site as one JSON file: the draft, every confirmed version, connectors, webhook addresses, articles and the assistant checks. It contains no site key, key hash, webhook secret or other credential.
The WebMCP script and the public facts
If you placed the script on your site yourself, your visitors' browsers load the WebMCP script from inite.ai. The WordPress plugin carries the script inside it, so with its "Page head" on the script comes from your own site. Either way, the browser reads your public facts from inite.ai only when an AI agent on the page calls one of the script's tools. These requests, like any request to another site, carry the visitor's IP address and browser user agent to inite.ai. INITE reads and sets no cookie on them and keeps no record of them, with one exception. If you use the snippet (the one tag the "For agents" tab gives for sites such as Tilda, Wix or Squarespace), its loads mark in your cabinet the time the snippet was last loaded, at most once every five minutes; nothing about the visitor is kept. To show whether the snippet is on your site, we read your homepage about once a day and when you press "Check my homepage now", and keep what we found: whether the tag is there and which version of the static block.
The WordPress plugin's update check
The copy of the plugin downloaded from inite.ai asks inite.ai for a small file describing the newest version when WordPress checks for updates, at most once every twelve hours. It sends no site key and nothing beyond what any HTTP request carries. The copy from WordPress.org has no such check.
IndexNow in the WordPress plugin
Off until you turn it on, and it stands down when another plugin already sends IndexNow for your site. When a public page, post or product is published, changed or removed, the plugin itself sends its address, your site's host and a key it made on your site to api.indexnow.org, which shares them with Bing, Yandex and the other search engines that use IndexNow. The key is served at /<key>.txt so the engines can check it. Up to 100 addresses a request, a request at most every five minutes and 500 addresses a day. INITE does not receive these requests, and nothing about visitors is sent.
Reading your site
From the day you add a site in the “For agents” tab, our server reads it: once when you add it, prove it or connect it, then once a day while the domain is proved or a connector is live, and when you press “Read my site now”. A read opens robots.txt, the sitemap and at most 8 public pages (the homepage and pages about prices, services, contact, hours, questions or a menu), with the user agent INITE-Atlas, and obeys robots.txt. We read the schema.org markup, the meta tags, phone and email links and the visible text. What differs from your facts is kept as a suggestion with the page it was read on, until you accept or ignore it. If a confirmed value has differed from your site for 7 days and nobody acted, the people who manage the site get one letter about it; if nothing was confirmed for 90 days, one letter asks you to read your facts again. With “Keep in step with my site” on, each version published from your site's schema.org markup is written to our audit log with the fields it changed and announced by letter. With "Site basics" switched on in the WordPress plugin, it also sends your site's title, tagline, language and address, and with WooCommerce the number of published products; no user and no email address.
Can robots open your site
Once a week, when we read your site, we also check whether the robots assistants search with can open it. We read robots.txt for the search, assistant and training robots, and open up to 5 public pages (the homepage, prices, contact or sign-up, and the two pages visitors from assistants open most, when we know them): once with an ordinary browser's user agent, then once with the user agent of each of bingbot, OAI-SearchBot, ChatGPT-User, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User and YandexBot, unless robots.txt keeps that robot out of the page. Every request is signed as INITE's crawler (Web Bot Auth), so your server can tell it is us. We keep with the record, per robot and page, the status code and what came back (a page with text, a refusal, a captcha, an empty template, a page that needs JavaScript), never the pages themselves, and show it only to your company: in the cabinet, the plugin's overview and the monthly report. A refusal of our request does not prove the real robot is refused, because protections also check where a request comes from; that is why we call it "probably blocked" and ask you to confirm it in Bing Webmaster Tools or your server's logs. The free analyzer runs the same check on the homepage of the site it analyzes.
What your site sends
Each kind is sent only while you switch it on in the connector (in the WordPress plugin, under "What this site sends to INITE"), and only content your site already shows to anyone:
• Pages and posts: published, without a password and not marked noindex: the title, address, excerpt or first 300 characters, type, language and the time of the last change. Up to 2,000.
• Products (WooCommerce): name, address, price, regular and sale price, currency, stock status, SKU, short description, categories and image address. Up to 2,000.
• Events (The Events Calendar): upcoming events with their title, address, excerpt, start, end and venue. Up to 200.
• Services from Bookly or Amelia, and the addresses, phones and opening hours of WP Store Locator, Yoast Local SEO or Rank Math Local SEO: shown to you as suggestions, like what we read on your site.
Nothing about users, customers, orders or visitors is read or sent. Pages, articles and events are listed in your llms.txt and llms-full.txt. Products are published only after the company's owner or an admin turns on "Publish my catalogue". We keep each item as the connector last sent it, replace it when it changes and delete it when it goes from your site; switching a kind off in the connector deletes all of it.
Directories
• Yandex Business price list: when a confirmed version has services with a single price in RUB, KZT or BYN, the confirm writes them as a price list in YML format, published at https://inite.ai/api/site/v1/public/<slug>/prices.yml. Like the rest of your confirmed facts it is public, it stops being served the moment you unpublish, and Yandex reads it only if you paste the address into Yandex Business yourself.
• Google Business Profile: if you connect it, Google gives us an OAuth refresh token with the scope business.manage. We store it encrypted with AES-256-GCM, never show it, and use it only to read the location you chose and write the fields you ticked. What is sent to Google: your confirmed opening hours and special days, your one-line description, your website address, your main phone, and your services with a price where it is paid once, and nothing before you approve the first change. Your other phone numbers and the services you picked from Google's own list stay as Google has them. Nothing Google holds is copied into your facts: where it differs, the cabinet shows it to you. Each write is logged with its time, the version, the fields sent and Google's answer. Google handles what it receives under its own terms. "Disconnect Google" deletes the token and asks Google to revoke it; the token, the last read of your location and the log of writes also go with the record.
• Google Business Profile, the extended fields: what you tick among them is written the same way, after you approve the preview. These are the qualities your facts claim (only those Google lists for the location's category), your confirmed menus as Google food menus, the primary category you picked from Google's list, and links for appointments, reservations or orders that point at your booking address or at your request page https://<slug>.inite.ai/request. To show you the preview we read the location's attributes, menus and links, and the categories that match your kind of business. Each write is logged like the others.
Requests from agents
If you turn requests on, an AI agent can send your business a request from a person through your MCP server or the WebMCP script: their name, an email address or a phone number, a message and, for a booking, the service, preferred dates and the number of people. For this data you are the controller and INITE is your processor. We store it, show it in your cabinet and deliver it only where you chose: by email to the people or the address you set, to the WordPress plugin, to your webhook. To cap and count requests we also keep the channel it came by, the product name at the start of the agent’s user agent and a one-way key derived from the caller’s IP address, never the address itself. The agent must ask the person before sending. INITE does not write to the person, except one copy of the request to the email they gave, and only if you turned “Send the person a copy” on. Each request is deleted 180 days after it arrived, or earlier with the record. We use none of it for anything else.
With requests on, https://<slug>.inite.ai/request is also a page where a person can send you the same request directly, for example from a booking or order link on your Google Business Profile. It asks for the same fields, is capped the same way, and is kept, delivered and deleted like a request from an agent.
What your reviews prove
We use only Google reviews already read for your company: by "What customers say" in the cabinet, or, with INITE Agents Premium, by "Read this branch's reviews" for a branch with a Google Maps address. A reading takes the 30 newest reviews of the place, with their stars, text and date, without the reviewers' names or photos, and we keep them with the reading. The text of each review, cut to 900 characters, is sent to the Jev model of TypeSafe through OpenRouter, which only answers yes or no to fixed statements about the place, such as "it is quiet" or "there is parking"; at most 200 reviews a month for a company. From the answers our code counts how many reviews confirm each quality and keeps up to three short quotes per quality, copied word for word from the reviews. We compare the counts with your confirmed facts and with the searches measured for your site, and show the result only to your company in the cabinet. A quality customers confirm that your facts do not claim is shown as a suggestion: nothing reaches your facts until you accept it and confirm. For this processing you are the controller and INITE is your processor; the reviews are texts their authors published on Google.
Find my business on Google Maps
Only with INITE Agents Premium. When you press "Find my business on Google Maps", or "Refresh from Google" (at most once a week), the business name and the town you typed are sent to Google's Places API or, when we do not use it, to DataForSEO, which searches Google Maps. We keep the places found (name, category, address, coordinates, phone, website, opening hours, price level and the amenities Google lists) and which one you picked. What the place you picked says that your facts do not is shown as suggestions marked "Google Maps": nothing is published until you accept and confirm. Without Premium no such search is made: your draft comes from your analysis, your site and what you type.
Agencies
If a business lets an agency manage it, the agency's people see what the business's own members see in the "For agents" tab: the facts, the checks, the requests from agents with the contact details people left in them, and the figures of the monthly report. For that contact data the agency acts on the business's instructions. We keep the link between the agency and the business: who invited whom and at which email address, who accepted, allowed confirming, ended the access or sent a report, and when. The business and the agency both see this list. An invitation link is valid for 14 days, and we keep only a SHA-256 hash of its token. The agency's name and logo (PNG or JPEG, up to 200 KB) are kept with the agency and shown on its reports; the logo is served from inite.ai to whoever opens a report. A letter asking the business to confirm goes to the business's own people at most once every 3 days, and the agency's report at most once a month. Ending the access stops all of it at once; the link and its list are deleted with either company's account.
Subprocessors
• Domain proof and the snippet check: if your site refuses our reader, your homepage is read through Apify.
• Demand: queries built from your confirmed facts (your services, kind of business and city) are sent to DataForSEO or Ahrefs for search volume and results. No AI model is used at this step.
• Reading your site: when a page's schema.org markup does not give your prices, hours, description or main phone, up to 40 lines of text from your pages that look like them, and your domain, are sent to the Jev model of TypeSafe through OpenRouter, which answers only whether each line is what we look for. The value is always taken from the line itself, and a number not on the page is dropped.
• Drafts: your confirmed facts and the text of up to four pages of your site, read with the user agent INITE-SiteWriter, are sent to Anthropic (Claude models). If Anthropic is unavailable, the same request goes through OpenRouter to the same Anthropic model.
• What assistants say about you: the questions described above go to Jev by TypeSafe, through OpenRouter; with INITE Agents Premium also to ChatGPT (OpenAI), Claude (Anthropic), Perplexity and Gemini (Google), through OpenRouter.
• What your reviews prove: reviews are read through Apify (the compass/crawler-google-places actor); their text goes to Jev by TypeSafe through OpenRouter, as described above.
• Find my business on Google Maps: the name and town you typed go to Google (Places API) or to DataForSEO.
• Local questions: the questions, coordinates and search words described above go to Google (Gemini API and Places API), only with INITE Agents Premium.
These providers work under the safeguards described in "Sharing and subprocessors".
How long we keep it, and how to remove it
Facts and their versions, the suggestions read from your site, site keys and the agent counts reported with them, webhooks, the Ghost connection, topics, articles and the pages, products and events your site sent belong to one record. They are kept while the record exists and are deleted with it: by "Delete everything" in the "For agents" tab (the company's owner or an admin, after typing the domain), or together with your company account. "Unpublish" in the same tab stops all serving at once and keeps the data. Each unpublish, publish again and delete is written to our audit log with the account that did it, the domain and the version. Records of MCP calls are kept with the rest of our analytics, as this policy describes. Your rights are listed under "Your rights"; requests, including deletion of anything these controls do not cover, go to
[email protected].
The review evidence and the Google Maps lookups belong to the same record and go with it. A review reading belongs to the account that asked for it and goes with that account.