An agent on your site has to earn that place.
The limits are code, not a policy page. What the token can reach, what needs your click, what is reversible, what we store, and what we do not claim.
One token, one site
The agent is bound to a single site by a token that lives in your plugin settings or an environment variable. The backend refuses the token from any other host, and a phrase served from your domain at /.well-known/reflexa proves the agent is where it says it is. Two sites of the same owner are as separate to the agent as two strangers.
Nothing applies without a click
The agent's plan is a list, not an action. Applying a switch, publishing a text or undoing one is a separate request from your browser, made when you press the button, and the backend checks the hand exists before it queues anything. The model never applies a change; it only proposes.
What it never touches
- Other plugins or themes, theme files, PHP.
- Users, passwords, roles, the site URL, DNS, hosting, caching.
- noindex or "discourage search engines": it proposes, you flip.
- Checkout, cart, account and legal pages, and any page you locked.
- Publishing, deleting or repricing content or product data.
- Your customers' email or your social accounts.
Every change is a revision
On WordPress each approved text is a post revision you can restore from the editor. On an edge site the rewrite is dropped on the next request. On a repository, undo is another commit. After every change the agent re-reads the live page and confirms it landed, and after every undo that it is gone.
What we store
- Your account: email, name, plan, billing status. Card details stay at Stripe.
- Per site: the public pages as read by the checks, the findings, the agent's memory of the site, the ledger of who did what and when, and the AI request counts (user agent, path, engine, verification result; no visitor identity).
- Google Search Console, if you connect it: read-only access with the refresh token encrypted at rest; clicks, impressions and positions for 28 days at a time.
- This website: a cookieless pageview count with no IP and no identifier, so no consent banner is needed. Privacy in full →
Sub-processors
Render (hosting and database), Vercel (this site and the dashboard), Stripe (payments), Anthropic (model passes for plans and page text), Resend (email), Google (Search Console, read-only), Cloudflare (Turnstile on the free check). Nothing is sold or shared for advertising.
Limits we state plainly
AI visit counts are observed from request metadata and verified against published IP ranges; they are counts, not guarantees. The agent never promises a ranking, a citation or traffic. We hold no security certification yet and do not claim one. If something goes wrong on our side, the owner of the site is told, in plain words, and the record of what happened is kept.
Questions people ask
What data does the agent read on my site?
The public pages, the same ones any visitor or crawler sees. From inside, it sees the requests AI fetchers make (user agent, path, time, and the IP for verification against the engines' published ranges), the list of published pages, and on WordPress the facts the plugin reports: version, plugins, theme, whether search engines are discouraged. It never reads your customers' data, orders, users or private content.
Where is my data stored?
In our backend on Render (EU region for the worker that reads sites), with payments at Stripe, email through Resend, this website on Vercel, and the model passes at Anthropic. Google Search Console access is read-only and the token is encrypted at rest.
Does the agent use my site to train a model?
No. Model passes are made with your site's facts as context to write a plan or a page text and are not used to train anything.
Do you hold a security certification?
Not yet. We do not claim SOC 2 or ISO 27001. What we can show is what is enforced in code: the token bound to one domain, the approval gate on every change, the undo on every edit, and the list of things the agent refuses.
How do I remove the agent and my data?
Deactivate the plugin, remove the file, or uninstall the GitHub App; the switches stop and nothing of the agent remains on the site. Write to support@reflexatechnologies.com to delete your account and everything stored with it.
Start with the free check. Then tell the agent what you need.
The free check runs the 23 checks on your public pages. Nothing is installed, nothing changes until you press it.
Free check from outside in minutes · the report by email · nothing installed yet