Pivra AI Chatbot

Pivra AI Chatbot connects your published Pivra assistant to a WordPress site.

• One-time setup code (expires in 30 minutes, single use, stored hashed by Pivra)
• No theme file edits — the plugin loads the official Pivra popup script
• Remote disable from the Pivra dashboard (hourly health check)
• Strict allowlists for API and embed hosts (*.pivra.ai over HTTPS only)
• Capability checks, nonces, sanitised storage, and connect rate limiting

External services and data sent This plugin is a connector for Pivra's hosted software service. It communicates only after a WordPress administrator chooses to connect a Pivra chatbot with a one-time setup code. The plugin sends requests to https://api.pivra.ai in these circumstances:

• Connect: exchanges the administrator-provided one-time setup code and the site's public URL/domain for a site-scoped credential and public widget configuration.
• Health check: approximately hourly, and whenever an administrator selects Check connection now, sends the site-scoped identifier and credential, site URL/domain, and plugin version so Pivra can confirm that the installation remains enabled and record connection health.
• Disconnect: sends the site-scoped identifier and credential plus the site URL/domain so Pivra can disable the installation.

Every API request also identifies the plugin version, WordPress version, PHP version, and site URL in its HTTP User-Agent header. Pivra uses these fields for credential/domain validation, compatibility support, security investigation, connection health, remote disable, and installation diagnostics. They are not used by the plugin for advertising or unrelated tracking. The public visitor browser loads the chatbot service script from the allowlisted HTTPS embed host returned by Pivra, normally https://embed.pivra.ai. It receives the public chatbot identifier and, when configured, a public widget key. Visitor conversations are handled by Pivra rather than stored in WordPress. The raw setup code is never retained by Pivra after exchange; Pivra stores a one-way hash and minimal audit metadata. WordPress stores the site-scoped credential until disconnect or uninstall. Pivra retains the installation record, domain, version and heartbeat history while the customer account is active and may retain a disabled record after disconnect for security and operational history. Account deletion or a verified deletion request removes data subject to legal, fraud-prevention, backup and dispute obligations described in the Pivra Privacy Policy. Contact support@pivra.ai for deletion or retention questions. Use of the service is governed by:

• Terms
• Privacy

No WordPress admin passwords or private API keys are stored by this plugin. A site-scoped token is stored in WordPress options (autoload disabled) for health checks and disconnect.

1.0.1

• Remove the legacy manual translation loader; WordPress loads directory translations automatically.
• Prefix multisite uninstall variables to satisfy WordPress coding standards.

1.0.0

• Production-ready modular plugin
• Strict UUID / token / embed-host validation
• wp_enqueue_script + deferred popup loading
• Connect attempt lockout after repeated failures
• Clear enabled vs remotely-disabled admin status
• Manual health check action
• Complete uninstall cleanup (including multisite)

0.2.0

• Initial connect code + heartbeat flow