alda, 3 months ago (edited 3 months ago)

Your WooCommerce customers are user records. Their personally identifiable information is stored in the wp_user_meta table.

All of this is uploaded to Automattic's infrastructure (which is largely located in the US) as "shadow site" data if you use #Jetpack and the #GDPR implications of that are worrying to me.

alda, 3 months ago (edited 3 months ago)

Recent leaks from within #Automattic indicate that this data will not be forwarded over to OpenAI.

But Automattic's official communications about that have been clear as mud and it is pathetic that I as someone familiar with the WPCOM infrastructure and the Jetpack sync process needs to hear about it via anonymous leaks from within the company.

kraft, 3 months ago

@alda confirming that Jetpack data isn't part of the sharing agreement.

alda, 3 months ago

@kraft thank you! 🙇‍♀️ Can I expect something on official channels soon?

kraft, 3 months ago

@alda let me check. Last I saw was a mention of adding a line to the WP.com post being more specific that Jetpack isn't included.

kraft, 3 months ago

@alda I'm asking if we can add a line to clarify Jetpack specifically, but https://automattic.com/2024/02/27/protecting-user-choice/ has "We will share only public content that’s hosted on WordPress.com and Tumblr from sites that haven’t opted out."

alda, 3 months ago

@kraft That's honestly not explicit enough and has caused a lot of confusion on the community side of things and especially those of us who's job it is care about those things.

But I see there's a Twitter post out by now at least, which I can refer to.

kraft, 3 months ago

@alda I agree with you that it needs to mention Jetpack (and WooCommerce) specifically. I put in the request to the communications team to augment it.

I suppose it is better than not saying even that much. 😩

alda, 3 months ago

@kraft Thanks for reaching out about this and following up. I very much appreciate it. I really do.

Sadly, those hours I've spent in the past days worrying about this weren't billable. 😑

alda, 3 months ago (edited 3 months ago)

I'm not sure about the current backup solution offered by Jetpack, but the legacy #VaultPress backups are also not encrypted, possibly based on the 20-year-old assumption that WordPress is for blogs and all the data is therefore in public anyway.

curtismchale, 3 months ago

@alda and VaultPress isn’t up to date for PHP 8.2 so throws errors all over the place. I've had to turn it off on customer sites and go with other solutions instead.

alda, 3 months ago

@curtismchale The whole thing about insisting on backwards compatibility with PHP 7.0 while also ignoring currently supported PHP versions is absolutely beyond any rational thinking.