Privacy Policy

Summary (the short version)

FrothIQ Defense is a security plugin. To protect your site, it processes metadata about incoming HTTP requests (IP, path, User-Agent, response code) and sends threat-related signals to our intelligence service. It does not read user-submitted content, form data, or credentials. Your visitors’ personal information stays on your site.

1. Scope

This policy covers the FrothIQ Defense plugin, the FrothIQ hosted intelligence service, and the FrothIQ operator dashboard. “You” means the site operator who installs the plugin. “End users” means the visitors to your protected sites.

2. Data FrothIQ processes

From your protected sites

FrothIQ’s plugin inspects the following for every inbound request:

• Source IP address
• Request method, path, and query string (without body content)
• HTTP headers (User-Agent, Referer, Accept, etc.)
• Timing and rate signals
• Response status assigned by FrothIQ (allowed / blocked) and the rule that fired

It does not inspect or collect:

• Form submission content (login passwords, POST bodies, checkout data)
• Cookies beyond what’s needed for rate-limiting
• User account information from your WordPress database

From you (the operator)

When you register as a FrothIQ operator we store your email address, the sites you’ve registered, and audit logs of actions you take in the dashboard.

3. What leaves your server

FrothIQ’s plugin sends only threat-relevant signals to the hosted intelligence service:

• Threat scores and the reason each score was assigned
• Masked or hashed IP components for reputation lookups
• Summary counts (requests / blocks / allows) used for dashboard metrics

Full IP addresses are never transmitted for the purpose of user-level tracking. They remain on your server (written to your own error log) where you control retention.

4. IP address handling

IP addresses are treated as sensitive:

• In the plugin’s activity log UI, IPs are partially masked (network portion visible; host portion replaced with …)
• Full IPs are written only to your server’s error log, which you control
• Reputation lookups use hashed or truncated representations, not full IPs
• Blocked IPs are shared across sites on the same tenant (your account) but not between tenants

5. Retention

• Plugin activity log: retained on your server indefinitely until you rotate it. You control retention.
• Operator audit log: 12 months, then deleted.
• Threat signals: aggregated into reputation data with no personally identifiable trail; underlying events age out within 90 days.

6. Third parties

FrothIQ does not sell or share end-user data with third parties. The infrastructure powering the intelligence service runs on standard cloud hosting providers bound by their own data-processing agreements.

7. Your rights

As a FrothIQ operator, you can:

• Request a copy of data we hold about your operator account
• Delete your operator account (this removes audit logs associated with you)
• Uninstall the plugin at any time (this stops any further data collection from your sites)

Requests: email [email protected].

8. Children

FrothIQ is not directed at children and does not knowingly collect information from anyone under 16.

9. Changes to this policy

We update this policy as the product evolves. Material changes will be announced via email to registered operators and posted with a new “Last updated” date above.

10. Contact

Privacy questions: [email protected].