Privacy on WordPress
Voris is privacy-first, and the WordPress plugin inherits that. This page explains what the plugin sends, what it never sends, how privacy modes work on WordPress, and whether you need a cookie banner.
For the full cross-platform explanation, see Privacy modes explained. This page is the WordPress-specific view.
What the plugin sends
The plugin talks to Voris in three ways:
- The browser analytics tag. On every public page, the plugin loads Voris’s tracking script from
https://cdn.voris.ai/v1/vor.js(deferred, so it never blocks your page). It reports pageviews and Core Web Vitals. - Server-side commerce events. With WooCommerce active and your site connected, completing or refunding an order sends a
purchaseorrefundevent from your server tohttps://ingest.voris.ai/api/event. See WooCommerce revenue tracking for exactly which fields. - Connection and plan data. Connecting your site (one-click OAuth) and reading your plan usage happen against
https://app.voris.ai. Nothing is sent to Voris until you connect.
What the plugin never sends
Across all three paths, the plugin never sends:
- No visitor IP address. Voris derives approximate geography and device from the request on its own side and then discards the IP — it is never logged or stored.
- No names, email addresses, or postal addresses — not even from a WooCommerce order.
- No visitor, session, or user identifiers.
The commerce events carry only a site ID, an order (and refund) reference, an amount and currency, and an item count. Order references are validated before they leave your server: anything that could carry personal data — an @ sign, whitespace, or an over-long value — is refused rather than transmitted, because some stores template order numbers from customer details.
Privacy modes on WordPress
Voris has three privacy modes, chosen per site in Voris, not in the plugin. The plugin honours whatever mode your Voris site is set to.
- Mode A — Aggregated (the default). The tracker sets no cookies, uses no browser storage, and creates no visitor identifier. This is the default and the mode most WordPress sites want.
- Mode B — Balanced. Adds a privacy-preserving, rotating signal so returning visitors can be recognised for a limited window, still without cross-site tracking or persistent identifiers. See Privacy Mode B — privacy posture & DPIA guidance.
- Mode C — First-party. A stricter first-party arrangement, available on request.
To change modes, open the site in Voris and use Site settings → Privacy mode. Nothing in the WordPress plugin changes; the hosted tag adjusts its behaviour on Voris’s side.
Do I need a cookie banner?
Not for Mode A. Because Mode A sets no cookies, uses no browser storage, and never creates a visitor identifier, Voris in its default mode does not, by itself, require a consent banner. (Your own site may still need one for other tools — that is about everything on your site, not just Voris.)
For Mode B or C, consent is part of your own legal setup rather than something the plugin decides. The plugin loads the same hosted tag regardless; whether a banner is required, and how consent is captured, depends on your configuration and your obligations. Privacy Mode B guidance covers the cookie-banner position and privacy-policy wording in detail.
Consent plugins
If you use a WordPress consent plugin, the Voris tag is a first-party analytics tag loaded from cdn.voris.ai. In Mode A it stores nothing on the visitor’s device, so there is nothing to gate. In Mode B or C, gate it as you would any analytics tag according to your consent policy.
Where this is stated for your visitors
The Tools → Voris settings screen summarises, in plain language, exactly what is shared with Voris, and links to the Terms of Service and Privacy Policy . Voris is operated by Rocket Venture Labs B.V. (Amsterdam, the Netherlands); data is processed primarily in the EU, with some sub-processors elsewhere — the Privacy Policy has the specifics.