Contents
Privacy and data - Plugixa CRM
A CRM holds more personal data than almost anything else on a WordPress site, so this page is worth reading in full.
What is stored, and where
In your own database, in the plugin’s own tables. Records are not posts.
| Holds | Roughly |
|---|---|
| People | Contacts and leads, with their email addresses, phone numbers and addresses in their own tables |
| Companies | Accounts, and the links recording who does what at each |
| Sales | Opportunities, pipelines, and every stage move with what the deal was worth at the time |
| Activities | Tasks, calls, meetings and their attendees |
| Messages sent and received, including bodies | |
| Marketing | Campaigns, target lists, sends, and the open and click log |
| Support | Cases, their conversations, and knowledge base articles |
| Every record | Notes, files, tags, followers, the stream, and the audit log |
| Portal | The link between a WordPress account and the contact it speaks for |
Settings live in a WordPress option. Uploaded files live outside the media library.
What leaves your site
The plugin connects to no third-party service on its own, and it has no service of its own to connect to. Every connection is one you set up, to an address or an account you name. Nothing is ever sent to Plugixa.
| Connection | Edition | What goes, and where |
|---|---|---|
| IMAP | Free | Your mail credentials, to the server you entered. Messages come back |
| Webhooks | Free | What you configured, to the URL you entered |
| Google Calendar | Pro | Meeting details, to the Google account each person signs in with |
| Microsoft 365 | Pro | The same, plus reading a mailbox you name |
| Twilio | Pro | The message and the number, to Twilio |
| WooCommerce | Pro | Nothing leaves. It reads your own shop |
Configure none of them and the plugin makes no outbound request at all. The free download contains no third-party connector code, so it could not reach Twilio, Microsoft or Google even if you wanted it to.
Campaign open and click tracking is served from your own domain. No third party learns who opened what, because no third party is involved.
Credentials
Mail passwords and connector credentials are encrypted before being stored,
with a key derived from your site’s own security keys in wp-config.php.
That protects them if your database is exposed. It cannot protect them from somebody who can already read your site’s files, and nothing can.
Uploaded files
Not in the media library. Each file is stored under an unguessable 32-character
name with an inert .bin extension, in a directory carrying a server deny rule,
and a health check writes a canary and asks the web server for it over HTTP to
prove the rule is actually in force.
That check matters because nginx does not read .htaccess at all, so a site
behind nginx can have a perfectly correct deny file and a completely open
directory. See
Notes, Files, Tags and the Stream.
Answering a subject access request
GET /personal-data/{entity}/{id} returns everything held about one person:
the record, their contact points, their activities, their messages, their cases,
their notes and their audit trail.
Erasing somebody
Erasure removes the record and everything attached to it, including the audit log entries about them. A history of somebody is still data about them.
That is the deliberate tension in this feature, resolved in the person’s favour: an audit trail is valuable, and it is not more valuable than a right to be forgotten.
Where personal data lives is declared through a filter, so an add-on’s tables are erased too rather than being silently missed.
Deleting the plugin removes everything
Read this before you uninstall.
Deleting Plugixa CRM from the Plugins screen drops every one of its database tables. Every contact, company, deal, message, case and file reference goes with it.
There is no setting that keeps your data, and no confirmation beyond the one WordPress itself shows for deleting any plugin.
Deactivating is safe. It stops the scheduled jobs and leaves everything in place. It is deleting that removes the data.
Two situations to be careful in
Upgrading from free to Pro installs a second copy. For a while both are on your Plugins screen. Deleting the one you think is “the old one” drops the tables the other is running on. Deactivate the old copy rather than deleting it, and take a backup first.
Tables are dropped by prefix, so a table created by an add-on is removed too. That is deliberate - this plugin is the base every add-on stands on - but it means uninstalling the CRM uninstalls the whole CRM.
Take a database backup before deleting. There is no undo.
Troubleshooting
| Symptom | Usual cause |
|---|---|
| Deleting the plugin lost everything | That is what it does. There is no retention setting. |
| Deleting one copy during an upgrade broke the other | Both copies share the tables. Deactivate rather than delete. |
| Deactivating lost nothing | Correct. Deactivation is safe. |
| A file survived uninstall | Report it. Uninstall is meant to sweep the private directory too. |
| An erasure left audit entries | It should not. The audit log goes with the record. |
| The health check says the directory is served | Your web server ignores the deny rule. Very likely nginx. |
| A connector is still listed after being disabled | Disabled is not uninstalled. Its stored credentials remain until removed. |
What to do next
- Who can see what: Roles, Teams and Permissions.
- What each connector reaches: Integrations and Webhooks.
- Take your data out first: Import and Export.