> ## Documentation Index
> Fetch the complete documentation index at: https://docs.woopilot.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# GDPR Compliance & Zero-PII Policy

> How WooPilot AI protects customer personally identifiable information with dynamic SQL masking

# GDPR Compliance & Zero-PII Policy 🛡️

Privacy is not an afterthought in WooPilot AI — it is a foundational architectural constraint. We operate with a strict **Zero-PII Storage Policy**: Customer Personally Identifiable Information (names, emails, physical addresses, phone numbers) is **never persistently stored on WooPilot cloud databases**.

***

## 🔒 Dynamic In-Memory PII Masking

The WordPress connector plugin includes a native **PII Anonymization Filter** active by default:

```text theme={null}
                  [ Direct SQL Query Execution ]
                                │
            ┌───────────────────┴───────────────────┐
            ▼                                       ▼
   [ Masking ENABLED ]                     [ Masking DISABLED ]
   (Default Mode)                          (Merchant Admin Opt-Out)
            │                                       │
            ▼                                       ▼
billing_email ➔ m***k@gmail.com        billing_email ➔ mark@gmail.com
billing_phone ➔ +380*****12            billing_phone ➔ +380971234567
```

### Anonymization Algorithm:

* **Emails:** Preserves only the first and last character of the username plus the domain: `m***k@gmail.com`.
* **Phone Numbers:** Masks middle digits while preserving country and carrier prefixes: `+1 (555) ***-**89`.
* **Addresses:** Truncates precise street addresses while keeping city, region, and postal codes for analytical aggregation.

***

## 🇪🇺 GDPR Data Protection Standards

* **No Cross-Tenant Data Contamination:** Every tenant operates with cryptographically isolated credentials and tenant-specific database partitioning.
* **Right to be Forgotten:** Because customer data is not retained on cloud servers, WooCommerce merchant data deletions and WordPress privacy export tools work without friction.
* **Encrypted Cloud Vault:** Store metadata and HMAC secrets are encrypted at rest using industry-standard **AES-256-GCM** encryption.


## Related topics

- [Introduction](/introduction.md)
- [Frequently Asked Questions](/faq.md)
- [Hardware Safeguards & Blocklists](/security/hardware-safeguards.md)
- [Quickstart Guide](/quickstart.md)
- [Telegram Mini App (TMA) Suite](/tma/overview.md)