Kinedio Personal Shopper for WooCommerce

Preguntas frecuentes

Do I need an account or API key?

Yes. You need an Anthropic API key, which you can create at https://console.anthropic.com/. Calls to the Anthropic API are billed by Anthropic according to their pricing.

Is WooCommerce required?

Yes. WooCommerce 8.2.0 or later must be installed and active. The plugin declares WooCommerce as a required plugin and will not run without it.

Which attributes does the [kinedio_chat] shortcode accept?

All attributes are optional:

• title — heading shown above the chat (no heading is shown when empty).
• title_heading — heading level for the title, 1–6 (default 3).
• title_fullscreen — alternative title used in fullscreen mode (falls back to title).
• welcome_message — first message shown by the assistant.
• placeholder — placeholder text of the message input field.
• button_text — label of the send button (default “Send”).

Example: [kinedio_chat title="Ask our assistant" title_heading="2" welcome_message="Hi! How can I help you today?"]

Is any data sent to a third party?

Yes. Chat messages and the catalog/cart context needed to answer them are sent to the Anthropic API. See the External services section for details on what is sent and when.

Where is my API key stored?

The key is stored in your site’s database with autoloading disabled. When the PHP OpenSSL extension is available (virtually all hosts) it is encrypted at rest with AES-256-GCM, using a key derived from your WordPress salts. Note that rotating those salts (e.g. AUTH_KEY, SECURE_AUTH_KEY in wp-config.php) invalidates the encryption and you will need to re-enter the key. On the rare host without OpenSSL, the key is stored as sanitized plain text.

What does the plugin log, and is any personal data stored?

The plugin has two independent, separately toggled features on the Diagnostics tab:

1. Turn logging (kinedio_turn_logging): writes operational entries to the WooCommerce logs (WooCommerce → Status → Logs) and, only if WP_DEBUG_LOG is on, to wp-content/debug.log.
2. Diagnostics (kinedio_diagnostics_enabled): stores per-turn metrics in a dedicated database table for the in-admin dashboard.

In both cases the shopper’s chat message is never stored, free-text tool arguments/results are redacted (replaced by a length marker), and visitor IP addresses are not written to the logs. What is recorded is operational only: timings, token usage, iteration counts, tool names, outcome, product IDs (and, in turn logs, product titles/links of the cards shown and the WordPress user_id for logged-in users). To stop all logging, turn both toggles off. Note: the rate limiter uses the visitor’s IP in memory only (as a transient key for guests) to enforce request limits; it is never written to any log.

Can I use it on a catalog-only store that does not sell online?

Yes. Enable catalog-only mode in the settings. The cart tools (add to cart, modify, clear, checkout prompts) are disabled, and the assistant guides shoppers to the product page or to contact the store instead of trying to sell online.

Does it support multilingual sites?

Yes. The plugin is translation ready and exposes a kinedio_i18n_provider filter so WPML/Polylang integrations can supply translated strings.

What happens when I uninstall the plugin?

On uninstall, sensitive data is always removed: your Anthropic API key, rate-limit caches, taxonomy snapshot transients, and the diagnostics table.
Diagnostics settings (enable toggle, retention days, max rows, turn logging toggle) are also removed on uninstall to avoid stale diagnostic state after reinstall.
Your other settings (assistant voice, colors, floating widget options, etc.) are kept by default so you can reinstall without reconfiguring everything. To delete all plugin settings on uninstall, enable “Delete settings on uninstall” under Kinedio Chat → AI Configuration before removing the plugin.

Can developers customize the chat error message?

Yes. Developers can use the kinedio_chat_user_error_message filter to customize the shopper-facing error text. The filter must return plain text only (no HTML).

Is the plugin compatible with a strict Content Security Policy (CSP)?

Yes. The storefront chat does not rely on unsafe-eval, inline event handlers (onclick, etc.), or browser calls to external APIs: JavaScript is loaded from your site via WordPress enqueue, chat requests go to admin-ajax.php on the same origin, and Anthropic is contacted server-side only. If you use a strict CSP site-wide, you typically only need to allow scripts and styles from your own domain (often with CSP nonces, as WordPress core and security plugins do). You do not need to add https://api.anthropic.com to connect-src for this plugin. Example baseline for pages with the chat: script-src 'self' 'nonce-…'; style-src 'self' 'nonce-…'; connect-src 'self'; object-src 'none'.