01 / CONSENT AND DATA BOUNDARY
Owner controls and consent
The site owner installs the Connector, chooses a valid URL prefix, supplies a partner email when needed, reviews the six scopes and accepts the applicable privacy notice. partner_email is optional in the data structure but required to send an invitation. Consent is granular and every optional scope can be withdrawn independently.
Before cloud_connection consent, the Connector makes zero outbound HTTP requests, including no request to Cloud. Each payload is independently gated by its named scope.
| Scope | Purpose | Data fields | Recipient | Retention |
|---|---|---|---|---|
cloud_connectionRequired | Pair this site with PartnerOpen Cloud so the delegated Space can be managed remotely. | site URL; URL prefix; technical site identifier; connector version | The paired PartnerOpen Cloud client | Until consent is withdrawn or the site is disconnected. |
partner_emailOptional | Record the partner address used for the invitation and service notices for this Space. | partner email address; site URL; Space name | Stored on this site and shared with the paired client during pairing | Until consent is withdrawn. The Connector sends no email itself. |
content_syncRequired | Receive the published page snapshot that this site renders. | typed page blocks; SEO title and description; link metadata; allowed destination hosts; snapshot version | This site, received from the paired client | The latest snapshot stays on this site until it is replaced or deleted. No Cloud copy is kept in this milestone. |
agent_packOptional | Publish AGENTS.md, llms.txt, ai-context.json, manifest.json and sitemap.xml for the delegated Space. | public Space title and summary; public page URLs; allowed block types | Public visitors and AI agents | Served while the Space is published. |
aggregate_metricsOptional | Record daily click totals per placement so the partner can measure placements. | date; placement identifier; click count | Stored on this site and readable by the paired client through the signed metrics route | 90 days on this site, then deleted. |
affiliate_serviceOptional | Allow links supplied by connected affiliate services to be published in this Space with disclosure. | approved public link identifier; placement identifier; disclosure text | Published on this site with disclosure; no service credentials are stored here | Until consent is withdrawn. |
Never collected: cookies, IP addresses, user agents, device fingerprints, unique visitor identifiers, visitor-level click events.
agent_pack is enforced locally at publication time. When it is withdrawn, AGENTS.md, the lowercase agents.md alias, llms.txt, ai-context.json, manifest.json and sitemap.xml return 404 with no-store semantics. The Space page and same-origin resolver continue under their Global Pause and Space-status rules.
02 / PUBLISHING AND LINKS
A visible, same-origin path to every destination
In M1, a partner publishes through the signed partneropen/v1 API, normally using the reference sync client. The Connector validates snapshots, limits block types, sanitizes rich text and stores the accepted version locally.
Every external destination must use HTTPS and an allowed host. Public HTML uses a same-origin resolver, shows “Disclosure: This is an affiliate link.” and uses rel="sponsored nofollow noopener". The rendered page never exposes a raw external href.
Cloud API requests are accepted only from the host allowlist: partneropen.com, www.partneropen.com. The site owner is responsible for the destination and any additional relationship or legal notice required by its jurisdiction.
03 / OWNER CONTROLS
Two controls, with no hidden control plane
- Global Pause
- Withdraw consent & disconnect
Global Pause is a separate publication overlay. It makes public Space pages, agent assets and resolver requests return a no-store 404; it does not delete state, revoke a partner or change the local snapshot. Resume restores an active published snapshot.
Disconnect is consent withdrawal and unpairing, never partner removal. It revokes the site secret, stops outbound calls, marks the connection disconnected, and retains local snapshots until explicit deletion. No Cloud-side snapshot, metrics or agent-file copy is stored in this M1; future service data is governed by that service's notice. Reconnection requires fresh consent and a fresh pairing code.
Withdrawal of an optional scope takes effect at that scope's boundary. The owner can explicitly delete local snapshots separately; disconnect never silently removes the partner or claims to erase another service's data.
04 / RETENTION AND MILESTONES
WordPress remains the durable system of record
The latest published snapshot remains on this site until it is replaced or explicitly deleted. Aggregate click totals are retained locally for 90 days, then pruned by a daily job. Uninstall deletes the plugin options, snapshots, click totals and plugin transients.
The site secret is stored in a non-autoloaded WordPress option, returned exactly once during pairing and never included in REST status, snapshots or public agent files. PartnerOpen Cloud keeps no snapshot, metrics or agent-file copy in this milestone because there is no Cloud ingest endpoint.
The tenant-backed partner editor is a deferred milestone. Passwordless login, tenant and Space isolation, hosted page editing, email delivery, Cloud-side metrics storage, billing and service/network adapters are not promises of this M1 site.
05 / RESPONSIBILITY
Use the Connector lawfully
The site owner is responsible for choosing lawful destinations, maintaining an accurate disclosure, publishing any additional notice required for the site audience and reviewing the configured consent scopes.
PartnerOpen does not guarantee ranking, placement, moderation, approval, conversions, revenue or availability of any external destination. Users must comply with the laws, terms and policies applicable to their sites and destinations.