Legal

Privacy policy

Last updated: September 28, 2026

WP Image Fixer is a service by YLabs (“we”, “us”), operating the wpimagefixer.com website and the WP Image Fixer MCP service at mcp.wpimagefixer.com. This policy explains what we collect, why, how long we keep it, and what we never do with it. The short version: your images stay on your WordPress site, and we keep only what we need to run fixes, show your savings and let you undo.

Your images

  • We do not store copies of your images on our servers. When you ask for a fix, our server downloads that image from your site, processes it in memory, and writes the result straight back to your site. Nothing is kept afterwards.
  • Originals stay on your own WordPress site. Without the optional YLabs Image Fixer Connector plugin, the original media item is never deleted and a new, smaller one is added. With the plugin, the original is first copied to wp-content/uploads/wp-image-fixer-originals/ on your site. You can restore any fix, or download your originals, from your own site at any time.
  • When you download your originals as a zip, the zip is built on request by fetching the files from your site; it is written to a temporary file that is deleted as soon as the download ends.
  • Alt text is written by your own AI assistant; WP Image Fixer saves what it writes to your site.
  • We do not use your images or site content to train AI models.

What we collect and why

Account information

Your WP Image Fixer sign-in uses the same account system as our other products, WPWriter and WP Agent. When you sign in (email and password, or Google, GitHub or Facebook), we keep your email address and, where provided by your sign-in method, your name. Passwords are stored only as a secure hash. We use this to sign you in, show your account page and send the emails described below.

Site connection

For each site you connect we store its address and name, the WordPress username that approved the connection, and the WordPress Application Password it created — stored encrypted at rest and used solely to perform the actions you request through your assistant (and for the weekly check of new uploads, unless you switch upload reports off for that site). We never receive or store your WordPress login password.

Per-image operation records

For each image we fix: its media ID, the original and new URLs, file sizes, formats and dimensions (before and after), the compression quality used, where the backup of the original lives on your site, how many posts were updated, which plan paid for the fix, and when it was done or undone. This is what shows your savings, counts your monthly free fixes, and makes undo and originals download work.

Jobs, upkeep and audit logs

  • Background jobs: the settings of each bulk run, its progress counts, saved bytes and any error message.
  • Upkeep state: for each site, when it was last checked, the newest upload already accounted for, when the last report email was sent and its numbers, and whether you opted out.
  • Audit log: for each tool call, which tool ran, on which site, whether it succeeded, how long it took, the assistant client name and version, user agent and IP address — for support, quota accounting and abuse prevention.
  • Sign-in and connection links: short-lived records that expire after 15 minutes (connection and sign-in links) or 2 hours (account page sign-in).

Payment information

Payments are processed by Lemon Squeezy, our Merchant of Record. Lemon Squeezy holds your payment details, billing address and invoices. We receive and store only order and subscription status: the Lemon Squeezy order, subscription, customer and plan IDs, status, and renewal or end dates. We never see your card details.

Support messages

If you email us, we keep your message and our reply to help you.

What we don’t do

  • We don’t sell or rent your personal data. Ever.
  • We don’t read or mine your site content beyond executing the actions you request.
  • We don’t share your data with advertisers.

How long we keep it

  • Image files: not stored by us at all (see above).
  • Account, site connections, operation records, jobs, upkeep state and plan records: for as long as your account exists, because undo and originals download depend on them. When your account is deleted, they are deleted with it.
  • Encrypted Application Password: until your account is deleted or you ask us to remove the site. Revoking it in wp-admin → Users → Profile makes it useless immediately, even before we delete it.
  • Audit logs (which tool ran, on which site, when, and the IP address and browser or app used): kept for 90 days, then deleted automatically. They are deleted straight away when your account is deleted.
  • Sign-in and connection links: expire after 15 minutes or 2 hours and can no longer be used.
  • Support emails: kept in our support mailbox as long as needed to resolve your request and for our records. You can ask us to delete them.
  • Billing records: held by Lemon Squeezy under its own policy; we keep records we must keep for tax or legal compliance.

Service providers

We rely on a small number of processors to run the service. Each receives only what is needed for its function:

  • Hosting infrastructure for our servers and database.
  • Cloudflare for DNS, security and delivery of our websites and service; traffic to wpimagefixer.com and mcp.wpimagefixer.com passes through it.
  • Lemon Squeezy (payments, taxes and invoices, as Merchant of Record).
  • Mailgun (transactional email, US region): your email address and the content of the emails we send you.
  • Unsplash, for stock-photo search: our server sends it only the search words and, when you add one of its photos, a download notice, as Unsplash requires. We send it nothing that identifies you (no name, email, account or IP address), so avoid putting personal details in a photo search.
  • Google, GitHub or Facebook, only if you choose to sign in with them.

ChatGPT, Claude and other AI assistants are not our processors: they are your own tools. What you type there, and the results WP Image Fixer returns to the assistant, are handled by that provider under its own privacy policy.

Email

We send transactional email (sign-in and password reset, and receipts via Lemon Squeezy) and upkeep report emails about your sites. On Keep It Fixed, we email you when new uploads were fixed automatically; on the other plans, we may email you (at most once every two weeks) when new uploads are slowing a site. Every report email has a one-click unsubscribe, and you can also switch reports off per site on your account page.

Cookies & analytics

This website uses no tracking scripts, no analytics and no advertising cookies. The account page keeps a short-lived sign-in token in your browser tab’s session storage, which is cleared when you sign out or close the tab.

Your rights & deleting your data

Depending on where you live (including under GDPR), you may have rights to access, correct, export, or erase your personal data, and to object to its processing. Write to [email protected] and we will honor them.

To delete your account and associated data, email [email protected] from your account address — we complete deletion requests within 30 days, except records we must keep for tax or legal compliance. Because the account is shared with WPWriter and WP Agent, tell us if you use those products too. Your images and originals are on your own site, so deleting your account never touches them.

Security

Data is encrypted in transit (HTTPS/TLS), Application Passwords are encrypted at rest, and access to our systems is restricted. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

International transfers

Your information may be transferred to and maintained on servers located outside your state, province or country, where data protection laws may differ.

When one of our service providers processes personal data outside the European Economic Area or the United Kingdom (for example Mailgun, our email provider, in the United States), the transfer is covered by the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, which are part of that provider's data processing agreement.

Children

WP Image Fixer is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us.

Changes

If we make material changes to this policy, we’ll note it here by updating the date above and, for significant changes, notify you by email.

Contact

YLabs · [email protected] · Contact page