01 / SCOPE CATALOG
Consent is granular and explicit
The site owner chooses a prefix and partner email during setup, reviews the scope details and explicitly grants each scope. cloud_connection and content_sync are required for pairing and snapshot publication respectively. partner_email is optional at the option level but required to send an invitation; the other scopes are optional.
| Scope | Purpose | Data fields | Recipient | Retention |
|---|---|---|---|---|
cloud_connectionCloud connectionRequired | Pair this site with PartnerOpen Cloud so the delegated Space can be managed remotely. | site URL; URL prefix; technical site identifier; connector version | The paired PartnerOpen Cloud client | Until consent is withdrawn or the site is disconnected. |
partner_emailPartner invitation emailOptional | Record the partner address used for the invitation and service notices for this Space. | partner email address; site URL; Space name | Stored on this site and shared with the paired client during pairing | Until consent is withdrawn. The Connector sends no email itself. |
content_syncContent syncRequired | Receive the published page snapshot that this site renders. | typed page blocks; SEO title and description; link metadata; allowed destination hosts; snapshot version | This site, received from the paired client | The latest snapshot stays on this site until it is replaced or deleted. No Cloud copy is kept in this milestone. |
agent_packAgent context filesOptional | Publish AGENTS.md, llms.txt, ai-context.json, manifest.json and sitemap.xml for the delegated Space. | public Space title and summary; public page URLs; allowed block types | Public visitors and AI agents | Served while the Space is published. |
aggregate_metricsAggregate click countersOptional | Record daily click totals per placement so the partner can measure placements. | date; placement identifier; click count | Stored on this site and readable by the paired client through the signed metrics route | 90 days on this site, then deleted. |
affiliate_serviceAffiliate service linksOptional | Allow links supplied by connected affiliate services to be published in this Space with disclosure. | approved public link identifier; placement identifier; disclosure text | Published on this site with disclosure; no service credentials are stored here | Until consent is withdrawn. |
agent_pack is enforced locally at publication time. When it is withdrawn, AGENTS.md, the lowercase agents.md alias, llms.txt, ai-context.json, manifest.json and sitemap.xml return 404 with no-store semantics. The Space page and same-origin resolver continue under their Global Pause and Space-status rules.
02 / NEVER COLLECTED
Aggregate measurement, not visitor dossiers
The Connector does not collect or send the following:
- cookies
- IP addresses
- user agents
- device fingerprints
- unique visitor identifiers
- visitor-level click events
Measurements are aggregate daily counts per placement. There is no per-visitor analytics, fingerprinting or hidden identifier in a resolver request. A destination service may process a visitor after a redirect under that service's own notice; the Connector does not add visitor identity to the redirect.
03 / LOCAL AND CLOUD DATA
Local-first by construction
Before cloud_connection consent, the Connector makes zero outbound HTTP requests, including no request to Cloud. Each payload is independently gated by its named scope.
Once paired, the Connector sends only the payload allowed by the granted scope and the signed API contract. The site secret is stored in a non-autoloaded WordPress option, returned exactly once during pairing and never included in REST status, snapshots or public agent files.
The latest published snapshot remains on this site until it is replaced or explicitly deleted. Aggregate click totals are retained locally for 90 days, then pruned by a daily job. Uninstall deletes the plugin options, snapshots, click totals and plugin transients.
Agent files are assembled from a positive public field allowlist, so link destinations, contact addresses, identifiers, service or payout data and unknown fields are dropped rather than filtered out. In M1, PartnerOpen Cloud keeps no snapshot, metrics or agent-file copy: the Connector is the store of record and there is no Cloud ingest endpoint.
04 / WITHDRAWAL AND DISCONNECT
Two independent owner controls
- Global Pause
- Withdraw consent & disconnect
Disconnect is consent withdrawal and unpairing, never partner removal. It revokes the site secret, stops outbound calls, marks the connection disconnected, and retains local snapshots until explicit deletion. No Cloud-side snapshot, metrics or agent-file copy is stored in this M1; future service data is governed by that service's notice. Reconnection requires fresh consent and a fresh pairing code.
Withdrawal of an optional scope is enforced at its own boundary. The owner can explicitly delete local snapshots separately. No Cloud-side snapshot, metrics or agent-file copy is stored in this M1; future service data is governed by that service's notice.
Global Pause temporarily overlays all public Space, resolver and agent routes with a no-store 404. It does not delete state or revoke consent; resuming restores the retained published snapshot when the Space is active.
05 / CLOUD BOUNDARY
A narrow host allowlist and a deferred editor
Cloud pairing accepts only these hosts: partneropen.com, www.partneropen.com. The Cloud site is stateless and has no tenant database, hosted editor, pairing store, publish store or metrics-ingest store in this milestone.
The tenant-backed partner editor is a deferred milestone. Passwordless login, tenant and Space isolation, hosted page editing, email delivery, Cloud-side metrics storage, billing and service/network adapters are not promises of this M1 site.
Every external destination must use HTTPS and an allowed host. Public HTML uses a same-origin resolver, shows “Disclosure: This is an affiliate link.” and uses rel="sponsored nofollow noopener". The rendered page never exposes a raw external href.
06 / OWNER RESPONSIBILITY
Review the boundary and your destinations
The site owner is responsible for choosing lawful destinations, maintaining an accurate disclosure, publishing any additional notice required for the site audience and reviewing the configured consent scopes.