CodeWP

GDPR overview

The framework is Automattic's, not a mechanism built for this tool: it is Automattic's Privacy Policy that applies, and it carries a dedicated UK and EU GDPR section. It sets out rights of access, rectification, erasure, objection, restriction and portability, plus the right to complain to a supervisory authority, and states that transfers outside the EEA and the UK rely on standard contractual arrangements approved by the European Commission or the UK government. For European residents the controller is the Irish entity, Aut O'Mattic A8C Ireland Ltd. in Dublin. A data processing agreement is available on request under section 19 of the Terms. Rights requests go to privacypolicyupdates@automattic.com or the WordPress.com contact form. Two gaps are worth flagging: no Article 27 representative is named, and no subprocessor list is published. Minimum age is 13, and 16 in Europe.

Who owns the data?

There is no contract specific to this tool: use is governed by Automattic's Terms of Service and Privacy Policy. Your counterparty depends on where you live, Automattic Inc. for most of the world and Aut O'Mattic A8C Ireland Ltd. for the countries the Terms designate, which cover Europe, Australia, Canada, Japan, Mexico, New Zealand and Russia. You keep ownership of the content you post, but publishing it grants Automattic a broad worldwide, royalty-free, transferable and sub-licensable licence to use, adapt, display and promote it. Automattic claims no ownership over code generated by its AI features, while warning that your own ownership of that output is not guaranteed either.

Reuse rights

What the tool produces is yours to reuse without asking: the download is a standard WordPress block plugin or block theme, installable and redistributable like any other WordPress artefact, and since 16 September 2025 the archive also carries the source folders and the build scripts, so you can run npm install and keep developing it. Downloaded blocks and themes go on working on their own; it is the platform, not the files, that may change. The trade-offs sit on the sharing side. Projects are private by default and turn public the moment you press Share, at which point other people can see them, share them and build on them, and Automattic reserves the right to list a project in a global directory, feature it in the Project Showcase or use it in its own marketing. Your conversation with the assistant stays private even when the project does not. In exchange for that freedom, you carry responsibility for the output as if you were its sole author, which is the vendor's own framing, so review it before you ship it.

Data retention & training

Hosting summary

No hosting country is named, either in Automattic's Privacy Policy or in the Terms, and the tool publishes nothing of its own on the question. What is documented is jurisdiction rather than geography: the controller is Automattic Inc. in San Francisco, or Aut O'Mattic A8C Ireland Ltd. in Dublin for residents of the countries the Terms designate. For users in the EU and the UK, Automattic states that personal data may be accessed and stored outside the EEA and the UK under standard contractual clauses approved by the European Commission or the UK government. The domain resolves to 192.0.78.24, inside Automattic's own network and geolocated to San Francisco, but that is an anycast node: it says where traffic enters, not where anything is stored. One part of the product never leaves your machine, since the WordPress preview runs in the browser and its state is held locally in OPFS, isolated per project and compressed, rather than on a server. Inputs to the AI features go to Anthropic and OpenAI. No subprocessor list is published.