ProxyAI Chat Assistant

ProxyAI answers visitor questions from your published content, hands conversations

to a human, and provides support tickets. WooCommerce stores can also offer cart,

checkout and order-status assistance.

Connect from the ProxyAI screen in wp-admin. Your site must be publicly reachable

over HTTPS; WooCommerce is optional. Manage setup, inbox, tickets, usage and

settings from the plugin dashboard.

External services

This plugin is a client for ProxyAI, a hosted service. It cannot function

without it, and it contacts ProxyAI in the ways described below. The service is

app.

• Terms of Service: https://www.proxyai.app/terms

• Privacy Policy: https://www.proxyai.app/privacy

• Service Agreement: https://www.proxyai.app/service-agreement

When you press “Connect to ProxyAI”, the plugin sends this site’s address,

its name, the administration email address, its WordPress version, its

WooCommerce version if installed, whether pretty permalinks are enabled, and

the plugin version. This creates an account for this domain. Nothing is sent

before you press that button.

Every six hours while connected, the plugin reports the same site name,

WordPress version, WooCommerce version, permalink setting and plugin version.

This is how the service knows the install is alive and which features it can

offer.

While you use the ProxyAI screen in wp-admin, the dashboard there — setup,

add-ons, inbox, tickets, usage, rates, settings — reads and writes through

this site’s own REST API. Your server forwards each request to ProxyAI signed

with the site’s secret; your browser talks only to your own site and holds no

ProxyAI credential. Nothing from the service is embedded inside wp-admin.

When you pay by card, your browser loads Stripe’s payment form from

com — a PCI-compliant payment provider — and your card

details go to Stripe alone; they never touch this site or ProxyAI’s servers.

Stripe receives the amount, the currency, and the email address of the

WordPress user paying. :

com/legal/consumer, Privacy Policy

com/privacy. Nothing from Stripe loads until you press

“Pay by card”.

When you connect WhatsApp with Meta’s one-click signup, your browser

net and opens

Meta’s own signup window, where you sign in to Facebook and choose the

WhatsApp Business account to connect. Meta receives what you enter there;

this plugin and ProxyAI receive only the resulting connection. Nothing from

Meta loads until you open WhatsApp’s connect window in the Channels screen. Meta is operated by

com/legal/terms, Privacy

com/privacy/policy.

When you pick a Google Sheets or Drive file for an Agent Tasks agent, your

com and shows

the files of the Google account you already connected to Agent Tasks; the

file you choose is passed to ProxyAI so the agent can use it. Nothing from

Google loads until you press the button to choose a file. Google is operated

com/terms, Privacy

com/privacy.

When you pay with PayPal, PayPal’s own checkout page opens in a new tab

with the amount and currency; the plugin loads no PayPal script and sees no

PayPal login. :

com/legalhub/useragreement-full,

com/legalhub/privacy-full.

When you upload files in wp-admin — knowledge documents for the Knowledge

add-on, a chat-widget icon, or a support-ticket attachment — the file goes from

your server to a storage address that ProxyAI issues for that upload; your

browser talks only to your own site. These files are stored by ProxyAI under

its Privacy Policy above.

app (an optional link — the

wp-admin screen covers day-to-day work), the plugin asks the service for a

one-time sign-in code over the same signed server-to-server channel, and your

browser redeems it in a new tab. The code works once and expires after a

minute.

When the Knowledge add-on is active, the plugin sends the URL, title and

plain-text content of your published posts, pages and products, so the

assistant can answer from them. Drafts, private posts, password-protected posts

and trashed posts are never sent. Without that add-on, no content is sent. You

can filter or exclude individual documents with the proxyai_sync_document

hook, or switch automatic sync off entirely under Store actions in the

ProxyAI screen.

On every front-end page view, visitors’ browsers load the chat widget from

js, and on WooCommerce stores also

js. On a page carrying the support-ticket form, they additionally

js from the same host. Chat messages your visitors type go

to ProxyAI to be answered. These scripts are served by the service itself and

are not bundled, because the widget and the service it talks to are versioned

together. js are minified for

visitors’ page speed; their readable sources are served alongside them at

js,

js and

js, and kept with the plugin source at

com/Proxyai-team/wordpress/tree/main/widget.

When a logged-in user views a page with the assistant or the ticket form,

the plugin places a signed token on the page carrying that user’s WordPress

user ID, email address and display name, which their browser passes to ProxyAI.

This is what lets the service recognise a returning customer and tie a ticket to

their account’s own email rather than one typed into a chat box. The token is

signed with a secret held by this site, so a visitor cannot forge one, and it is

issued only while the Helpdesk add-on is active. Logged-out visitors get no

token and stay anonymous.

When a visitor asks about an order, ProxyAI calls this site back with an

order number and a billing email address. The plugin answers only if the two

match an order here, and returns only that order’s number, status, date, total,

currency, line items and tracking details. Requests must be signed with this

site’s secret, and repeated failures from one address are rate limited.

Source code

css,

is built from source and shipped unminified and unmangled, so it reads as the

code it was built from. It includes its own copy of React 19, used on the

ProxyAI screen only. The source is the ProxyAI web dashboard’s own components together with

the plugin build in proxyai-admin/, published with its build instructions at

com/Proxyai-team/wordpress — read, fork, rebuild, or diff the

output against the plugin zip there.

css` and every PHP file are plain,

hand-written files with no build step.

js’s loader,

js, mammoth, SheetJS, JSZip and others), all under GPL-compatible licences;

txt lists every one with its version and

licence, generated at build time from what the bundle actually contains. js

mjs. The only scripts the

dashboard loads from elsewhere are Stripe’s (when the payment dialog opens),

Meta’s (when you open WhatsApp’s connect window) and Google’s file picker

(when you choose a file for an agent), each described under External services.