End User Licence Agreement

This English text is a convenience translation. The German version is authoritative to the extent permitted by law.

1. Application and incorporation

1.1 This End User Licence Agreement governs use of WPAgently's paid components and the special conditions for optional Power mode. The licensor is Finn Hillebrandt, Am Brandberg 10, 21401 Thomasburg, Germany, referred to as the “Provider”. The user is referred to as the “Customer”.

1.2 This EULA forms part of the product-specific Supplier Agreement in Polar Checkout. It becomes contractually binding only if Polar makes it available before the order and the Customer agrees to it in checkout. Installation or activation alone does not replace valid incorporation.

1.3 The Terms and Conditions additionally govern provision, term, support, rights in the event of lack of conformity, and liability. This EULA takes precedence for specific rights of use and Power mode. Mandatory law and the GPL rights under Section 2 remain unaffected.

2. Components and different licences

2.1 WPAgently consists of:

1. the “wp-agent-companion” WordPress plugin
2. the “wp-agent-power” WordPress plugin
3. the “wp-agent” Node CLI, including presets
4. agent skills, templates and documentation
5. licence, update and support services

2.2 The two WordPress plugins are provided under GPL-2.0-or-later. Their supplied licence texts apply. The Customer may use, inspect, modify and redistribute the plugins to the extent permitted by the GPL. Nothing in this EULA restricts those rights.

2.3 The Node CLI, presets, agent skills, templates and documentation are protected by copyright and are not licensed under the GPL unless an individual file states a different licence. The Provider grants the rights in Section 3 for these components.

2.4 Third-party rights in bundled libraries, icons or other components are governed by their supplied licence and notice texts.

3. Rights to paid components

3.1 For the contract term, the Customer receives a non-exclusive and non-transferable right to install and use the components listed in Section 2.3 for their own WordPress projects or client projects managed under the Agency plan.

3.2 The number of official website activations depends on the plan:

• Solo: 1 website
• Pro: up to 5 websites
• Agency: up to 25 websites

The limit applies to licence activation, the official update channel, support and use of paid components. It does not restrict GPL rights in plugin code.

3.3 The Customer may create backup copies of proprietary components and install them on their own devices or devices of their organisation where required for contractual use.

3.4 Without the Provider's consent, the Customer must not publish, rent, sell, sublicense, distribute as their own product, or make the proprietary components or licence key available to third parties outside the purchased scope.

3.5 Mandatory statutory rights relating to error correction, interoperability, study or decompilation remain unaffected. This Section does not restrict acts permitted by the GPL for the WordPress plugins.

4. Bring your own agent and external services

4.1 The Customer uses a compatible AI client, particularly Claude Code, Claude Desktop or Codex, or the optional integrated WordPress chat under their own contract with a compatible AI provider. The Provider does not provide an AI account or compute allowance.

4.2 During normal operation, WordPress content, database content and WordPress credentials are not transmitted to a WPAgently application server. Free does not communicate with Polar. After voluntary activation of a paid licence, licence activation, daily validation and deactivation communicate directly with Polar. The plugins also retrieve static update manifests and, when updating, packages from wpagently.com. The Privacy Policy provides details.

4.3 The Customer decides what content their AI agent processes and publishes. The Customer is responsible for legal review, factual accuracy, third-party rights and compliance with the relevant AI provider's terms.

4.4 When the integrated WordPress chat is used, messages and site data retrieved through read-only Abilities for the response are transmitted directly from the WordPress installation to the AI provider selected under Settings > Connectors. This data flow does not pass through a WPAgently application server. The Customer decides whether to use this optional feature and what data to process under their contract with the AI provider.

5. General security rules

5.1 The Customer protects WordPress Application Passwords, OAuth tokens, AI credentials, licence keys, backup passphrases and local configuration files against unauthorised access. Secrets must not be placed in public repositories, prompts, support messages or unprotected backups.

5.2 For standard content mode, the Customer should use a dedicated WordPress user with the documented minimum permissions. Administrator credentials should be used only where a specific administrative capability requires them.

5.3 The Customer installs security updates promptly, keeps WordPress, PHP, Node.js and installed extensions current, and reviews changes before publication.

6. Optional Power mode

6.1 Purpose and permission levels

Power mode is delivered as the separate “wp-agent-power” plugin. It is disabled by default and must be deliberately installed, licensed and enabled. It is intended for technically experienced users performing development, staging, maintenance, backup and restore work.

Its technical surface includes, in particular:

1. P0 read access to files, options, selected database queries and environment information
2. P1 with a restricted list of WP-CLI maintenance commands
3. P2 file writes, which can already enable arbitrary code execution when executable PHP files are written
4. P3 controlled database and option changes
5. P4/P5 direct execution of arbitrary PHP code
6. BACKUP with complete database and file export
7. RESTORE for database and file restoration

All levels are closed by default. The current technical documentation describes gates, environment checks, confirmations, backup requirements and limitations.

6.2 Specific risks

The Customer acknowledges in particular that:

1. P0 may read confidential data despite redaction patterns where a secret uses an unrecognised format.
2. P2 already crosses the boundary into possible code execution. A written PHP file or must-use plugin can fully control the website.
3. P4/P5 executes arbitrary PHP code with the rights of the WordPress process. Code may read, modify or delete data, disable safeguards and make external connections.
4. BACKUP deliberately exports complete and unredacted data. A backup may contain personal data, password hashes, tokens, keys and trade secrets.
5. RESTORE overwrites database content or files and may cause data loss or downtime if the target, source state or interrupted operation is incorrect.
6. Prompt injection, manipulated content, incorrect assumptions or compromised dependencies may cause an AI agent to perform unintended actions.
7. A compromised WordPress administrator password or application password may call offered Power functions directly. Local CLI confirmations and local backup checks do not protect against such a direct request.

6.3 Customer duties

When using Power mode, the Customer must:

1. use an HTTPS-protected connection,
2. use a dedicated WordPress application password with the required permissions, keep it secret and revoke it when no longer needed,
3. open the master switch and individual levels only for the required period and close them afterwards,
4. not make the Power endpoint generally accessible without WordPress authentication through a proxy or other misconfiguration,
5. create a current, complete and separately stored backup before every state-changing action and reasonably verify that it can be restored,
6. encrypt sensitive backups with a strong passphrase stored separately,
7. verify the target site, environment, path, tables, intended change and backup assignment before confirming an action,
8. use P2 and P4/P5 primarily on development or staging systems,
9. use them on production only after deliberate risk assessment and with the intended production approvals,
10. supervise state-changing agent actions and review the result, audit log and website condition afterwards.

6.4 Limits of safeguards

Power mode includes server-side licence, role and level gates, environment locks, protected areas, local confirmations, automatic snapshots for supported CLI paths, crash guards, health probes, a cooperative local lock and a hash-chained server-side audit log.

These mechanisms reduce the likelihood of mistakes but do not guarantee protection against data loss, exfiltration or compromise. In particular:

1. Mandatory backup, unlock session and typed confirmation are enforced by the CLI. A direct authenticated web request can bypass those client-side steps.
2. Not every file operation supports automatic rollback. Arbitrary PHP execution cannot be reliably rolled back automatically.
3. Successfully executed P4/P5 code can alter or remove audit logs, gates and emergency-disable functions.
4. Health probes detect certain technical failures, but not a logically incorrect or deliberately harmful state that continues to respond.
5. The audit log does not record every read operation and records backup metadata rather than exported row content.

Typed confirmations support operational discipline. They are not electronic signatures and do not conclusively prove that an action was legally or technically informed.

6.5 Activation and deactivation

Administrators can manage the master switch and levels in WordPress under Tools > WP Agent Power or through the documented WP-CLI commands. The local CLI additionally uses a time-limited unlock session. A valid WPAgently licence is required for Power functions to be registered.

The Customer can disable Power mode by closing levels, closing the master switch, ending the local session, revoking the application password or deactivating the plugin. The Provider has no independent remote access to the Customer's website and no separate server-side shutoff control.

7. Conformity and liability

7.1 The statutory rights in the event of lack of conformity and the liability provisions in the Terms apply to Power mode. The risk notice does not limit mandatory rights or create a blanket exclusion of the Provider's liability.

7.2 The specific cause, compliance with the duties in Section 6.3 and proven contributory fault are considered under applicable law when assessing damage.

7.3 Compatibility statements are binding only where expressly designated as agreed characteristics when the contract is made. The documentation distinguishes practically tested, defensively supported and unconfirmed configurations.

8. Updates and product changes

8.1 During the contract term, the Provider supplies required functional and security updates. The Customer has no entitlement to a specific new feature or the permanent retention of an experimental feature that was not agreed.

8.2 For a valid security reason, the Provider may restrict Power mode in a future version, strengthen a gate or remove an exposed function. Consumer information and termination rights for modifications to digital products remain applicable. Existing GPL plugin copies are not remotely modified as a result.

9. Term and consequences of termination

9.1 The right to use proprietary components exists during the contract term. After termination, the Customer must not use them for new or production operations. Copies may be retained temporarily where required for backup, proof of legal claims or orderly uninstallation.

9.2 Licence activations, official update access, paid downloads and support end with the subscription. GPL rights in WordPress plugins already received and mandatory statutory rights remain unaffected.

10. Final provisions

10.1 German law applies, excluding the United Nations Convention on Contracts for the International Sale of Goods. Mandatory consumer protections of the state in which the consumer has their habitual residence remain unaffected.

10.2 If a provision is invalid, the remaining provisions remain effective. Statutory law replaces the invalid provision.

10.3 Individual agreements take precedence over these pre-formulated terms.