Privacy

What this plugin sends and to whom, what it stores, and what to put in a privacy policy.

What leaves your server

Your site's email, to your own Microsoft 365. Once a client secret is saved, every message WordPress sends goes to Microsoft Graph in the tenant you configured, instead of through PHP mail(). Until then the plugin leaves mail alone.

Microsoft then handles that mail like any other message in your tenant. With Save to Sent Items on (off by default), a copy stays in the sending mailbox.

Nothing is sent to A&J Computers except update checks.

Update checks

When WordPress checks for plugin updates, the plugin asks plugins.ajcomputers.com for its release manifest and that manifest's signature. It keeps the answer for six hours (30 minutes after a failure), and Check for updates asks straight away. The package itself is downloaded only when you install an update.

The requests go through WordPress's HTTP API, whose default user agent includes your site's address and WordPress version, so they appear with your server's IP address in that host's access logs. No settings, mail or usage data are sent. See privacy for our plugins.

Check for updates also runs WordPress's own update check, which contacts wordpress.org as WordPress always does.

What is stored, and where

Settings

One WordPress option, ajc_graph_mailer_settings, not autoloaded: tenant ID, client ID, client secret and its expiry date, sending mailbox, From address and name, the From and Sent Items switches, whether logging is on, the Microsoft cloud, and bookkeeping for the secret's encryption.

• The client secret is encrypted with AES-256-GCM. After an encryption upgrade the previous encrypted copy is also kept, so rolling back stays recoverable. Everything else in the option is plain text.
• The key comes from wp-config.php where possible. If the plugin had to generate one, it is stored in its own option, ajc_graph_mailer_fallback_key. See which key encrypts the secret.

Access token

Microsoft's access token is cached in the ajc_graph_mailer_token transient for just under its lifetime, usually about 55 minutes. It is cleared when the credentials change, when Microsoft rejects it, and when the plugin is deactivated. It is not encrypted. Until it expires it can do whatever the app registration may do, which is why the setup guide scopes the app to one mailbox.

Log

The last 50 events, newest first, in the ajc_graph_mailer_log option, while Log send failures is on (the default; turning it off stops all of the plugin's log entries). An entry can include:

• the subject of a message that failed to send, and why it failed;
• error text from Microsoft, which names the sending mailbox and can include whatever else Microsoft puts in its error;
• the server path of an attachment that couldn't be read;
• throttling delays, encryption-key migrations and update-check problems.

Message bodies and headers are never logged, and the plugin doesn't write recipient addresses to the log itself. Values stored under names like secret, token or password are redacted first. Clear log empties it.

Short-lived

• The update check's cached answer: six hours, or 30 minutes after a failure.
• Notices shown after an admin action: one per administrator, gone within a minute. They can include a test message's recipient, the mailbox's display name or the latest log message.

What it doesn't do

It adds nothing to the public site: no cookies, scripts or tracking. It keeps no data about your site's visitors, so it doesn't register with WordPress's personal data export and erase tools.

Uninstalling

Deleting the plugin removes its settings (including the encrypted secret and any generated key), the log and its transients, on every site of a multisite network. An AJC_GRAPH_MAILER_KEY line in wp-config.php stays until you remove it. The app registration and its secret stay in Microsoft Entra; see uninstalling.

Suggested privacy policy wording

Email sent by this website, such as form notifications and account messages, is delivered through our Microsoft 365 service. Microsoft processes the message, including the recipient's address and anything you entered in the form, to deliver it.