Use this guide to review support data handling in Dragwyb Click to Chat, including AI conversation sessions, captured leads, support tickets, ticket messages, internal notes, assignments, notification records, and knowledge-base data. The records present on a site depend on the modules and workflows enabled. Review access and retention for each data type rather than treating all plugin data as one record.
Where to review support data
- Open Click to Chat → Tickets to review the Support Center workspace, tickets, conversations, and related records available to your account.
- Open Click to Chat → AI Assistant and review the Chat Sessions and AI Leads areas if those features are enabled.
- Review which staff roles can view all tickets, view assigned tickets, view customer data, add internal notes, manage assignments, and delete tickets.
- Review notification settings and any enabled external AI or messaging integrations that may process information outside WordPress.
Data categories to include in your review
- Support workspace: Tickets and messages, categories, tags, assignments, agent records, audit events, internal staff notes, and notification logs.
- AI assistant: Conversation sessions and messages, captured lead details, and diagnostic or provider error logs when logging is enabled.
- Knowledge base: Imported or entered knowledge-base content, document/chunk records, and generated embeddings. If an external vector database such as Pinecone is configured, review that provider separately.
- Configuration: Plugin options and provider API keys, which are managed separately from conversation and ticket records.
- WordPress user metadata: Some dashboard preferences and interface state may be stored in user metadata.
Review staff access
The plugin includes role-based support permissions. The available permissions distinguish capabilities such as viewing all tickets versus assigned tickets, accessing customer data, managing settings, assigning tickets, and deleting tickets. Administrators can review the active role-permission configuration in the Support Center settings. Do not assume every staff member has the same access: check the roles and any customized permission matrix on your site.
Review external processing separately
- AI prompts, conversation content, knowledge-base text, and supported attachments may be sent to the configured AI provider when the relevant feature is used.
- Contact-channel links may open external messaging, social, phone, SMS, or email applications. Review their destinations and any prefilled information separately.
- Notifications may be delivered using your WordPress site’s configured email infrastructure. Check the site’s mail setup and notification behavior if ticket or lead data is included in email messages.
See Review External AI Services and Review External Messaging Services for related checks.
Plan retention and deletion
Ongoing conversation and error-log retention settings are separate from the options that run when the plugin is uninstalled. Uninstall cleanup can be configured to delete selected categories, including AI sessions and leads, knowledge-base/vector data, support workspace tables, plugin options, error logs, and user metadata. The default configuration preserves critical records and deletes error logs and temporary transients; check your site’s saved choices before uninstalling.
Review Configure Data Retention before changing cleanup settings. Back up the site and test deletion on staging before selecting destructive options.
Recommended audit checklist
- List the plugin modules and data-producing features enabled on the site.
- Identify which roles can view, export where available, modify, or delete each record type.
- Review whether sensitive details appear in AI prompts, ticket messages, internal notes, leads, or notifications.
- Confirm the external providers and destinations used by enabled features.
- Set retention periods and uninstall cleanup choices deliberately, and verify the actual deletion behavior on a test site.
- Update the site’s privacy information and staff procedures to reflect the real configuration.
Important: Source-code review does not replace a live permission test. Test with representative user roles and sample records, and do not treat this guide as a legal compliance guarantee.