Effective date: 2026-09-08 Service operator: itdatex, Rainer Neuenhausen Contact: rainerneuenhausen@gmail.com Endpoint covered: https://api.itdatex.support/api/chat Applies to: the hosted LLM service used by the WordPress plugin “itdatex Blog-Bot” when the site owner sets the LLM provider to “itdatex Cloud”.
This policy only covers the hosted AI endpoint. The plugin itself, its RSS fetcher, its local Ollama mode and any custom-URL mode are unaffected — they do not talk to any itdatex-operated server.
1. Who we are
itdatex operates the AI endpoint api.itdatex.support on servers located in Germany. We are the controller for the personal data described below.
2. What we receive
Every time the plugin generates a draft using the itdatex Cloud provider, we receive one HTTPS POST containing:
- The site’s API key in the
Authorization: Bearer …header. - The rewrite prompt (a fixed text embedded in the plugin, not user data).
- The title of the RSS item being rewritten.
- The URL of the RSS item.
- Up to ~3,500 characters of the RSS item’s content.
- Standard HTTP metadata your server transmits with any request: source IP address, TLS version,
User-Agent.
We do not receive any content from your WordPress site outside of the RSS payload the plugin is rewriting — no user data, no post drafts, no comments, no login info.
3. What we do with it
- We forward the prompt + item payload to the language model to produce the rewritten draft.
- We return the rewritten JSON to your server.
- We keep short-lived request logs (timestamp, API key ID, IP, response status, tokens processed) for up to 30 days for abuse prevention, rate-limit enforcement, and billing/quota accounting. Payloads are not retained in logs.
- We do not train models on your content.
- We do not sell, rent, or share your data with third parties for advertising or profiling.
4. Sub-processors
The AI inference itself may run on infrastructure provided by:
- Hetzner Online GmbH (Germany) — server hosting.
- The model vendor(s) whose weights we run locally on our own servers. No payload is transmitted to a model vendor’s own API in the default configuration.
If we ever route inference to a third-party API (e.g. OpenAI, Anthropic), we will update this policy and the affected API keys will receive an email notice 30 days in advance.
5. Legal basis (GDPR)
- Contract performance (Art. 6 (1) (b) GDPR) — providing the API you signed up for.
- Legitimate interest (Art. 6 (1) (f) GDPR) — short-lived abuse-prevention logs.
6. Your rights
You may at any time:
- Request a copy of the personal data we hold about you (access).
- Ask for correction of inaccurate data.
- Ask for deletion of your account and API keys, which purges the associated logs from the next log-rotation cycle at the latest.
- Withdraw consent by disabling the itdatex Cloud provider in the plugin and/or deleting the API key at
https://wp.itdatex.support/blog-bot-api-key/. - Complain to a supervisory authority (in Germany, the state data-protection authority responsible for your Bundesland).
To exercise any of these rights, email rainerneuenhausen@gmail.com from the address on your API-key account.
7. Data transfers outside the EU/EEA
None in the default configuration. All infrastructure listed under §4 is in Germany.
8. Security
- TLS 1.3 required end-to-end.
- API keys are hashed at rest and are per-site — a leaked key affects only that key’s rate limit and can be rotated by you at any time.
- Payloads are held in memory during inference and are not persisted after the response is returned.
9. Changes to this policy
Material changes are announced at least 30 days in advance via email to the address on your API-key account. Non-material changes (typos, formatting) can be applied immediately; the “Effective date” at the top of this document always reflects the latest version.