What leaves your site
Short version: with no licence key, nothing. With a licence key, only what a button you pressed needs: a downsized copy of each picture while a describe run is in progress, and for a plan, labels and counts, never pictures.
This page lists every outbound request the plugin can make, what is in it, and how to switch it off.
Nothing is sent until you ask #
- No request on page load.
- No request on upload.
- No request in the background.
- No telemetry, no usage beacon, no "check for notices" poll.
The original plugin this one is forked from polled its author's server twice a day for admin notices and printed whatever came back into your dashboard. That was removed and nothing replaced it.
Demo mode invents captions locally from filenames and sends nothing anywhere.
Every outbound request, in full #
The plugin talks to two hosts: the AI service at ai.vergelabs.nl, and
vergelabsmedia.com when you start a free trial or connect a licence.
1. https://ai.vergelabs.nl/v1/describe #
When: once per image, only while a describe run you started is in progress.
What is sent:
| Field | Value |
|---|---|
image | A downsized copy — the largest thumbnail under about 1.5 MB. Never the original file. |
filename | The file's basename |
mime | Its MIME type |
site | Your site address |
environment | What wp_get_environment_type() says |
license_key | Your key |
profile | Your site profile text, if you wrote one |
context | See below |
context carries what your site already knows about the image: its title and
caption, the parent post's title, WooCommerce product categories if the parent is a
product, and — with Page context on — the title of the page it appears on plus
that page's focus keyphrase, meta description and up to three related keyphrases
from Yoast, Rank Math, SEOPress or All in One SEO.
Page context is one switch, on by default. Off, nothing about your pages leaves the site.
What comes back: caption, alt text, tags, a suggested title, the attributes, an embedding, the model provenance fields, and your remaining credit balance.
What is kept: a usage count. The image is processed and discarded, and is not used to train anything.
2. https://ai.vergelabs.nl/v1/embed #
When: once per search phrase, when you use search by meaning.
What is sent: the phrase you typed, your site address, your licence key. No image.
What comes back: a vector.
3. https://ai.vergelabs.nl/v1/folders #
When: when you type an instruction into folder talk.
What is sent: your instruction, your current folder names with their counts, and a sample of captions from your own index. Your site address and licence key. No images.
What comes back: a revised folder plan.
The part of the Folders screen that streams a reply as it is written is sent from your browser, not from your server, so your own IP address and browser headers reach the service, as they would visiting any website.
4. https://ai.vergelabs.nl/v1/plan-tree #
When: only when you press Plan my folders. See Plan my folders.
What is sent: your site address, your licence key, a random reference number the plugin makes for the plan, and every distinct label the AI recorded about what your pictures show — for example "platform sneaker; footwear" — with how many pictures carry each and, where the description says so, how many of those are for men, women or kids. It also says whether an audience split is confirmed.
Labels and counts only. No picture, caption, file name or folder name is sent.
What comes back: the folder arrangements the service found. Choosing between them happens on your site, using vectors that never leave it.
5. https://ai.vergelabs.nl/v1/plan-tree/refund #
When: only when a plan is not shown to you — it would not improve the folders you already have, its answer did not arrive, or you confirmed your tree while it ran. The plugin then asks for the plan's credits back.
What is sent: your site address, your licence key and the plan's reference number. Nothing else.
6. https://ai.vergelabs.nl/v1/support/ticket #
When: only when you press send on the Get help screen.
What is sent: your question, your site address, a site token, optionally your email address, the system report shown to you on that screen, any known issues matching your stack, and your licence key if one is set.
You can read the system report before sending it — that is why it is displayed.
7. https://ai.vergelabs.nl/v1/known-issues #
When: only when you press Check for known problems on the Get help screen. The list is then kept for twelve hours.
What is sent: no key and no counts — only the HTTP request itself, which, like every request WordPress makes, identifies your site address.
8. https://vergelabsmedia.com #
When: when you press Start on a free trial, or connect a licence.
What is sent: for a trial, the email address you type and your site address, to
/api/trial, which answers with a free key holding 25 credits. For a connection,
your site address and the address of your admin screen; a one-time code comes back
and your site exchanges it for a key.
What never leaves #
- Your media files, in the original.
- Any file that is not an image, ever — only images are described.
- Your folder structure, except your folder names, their parents and how many files each holds, when you propose, confirm, fill or talk to the Folders screen.
- Post content.
- User accounts, email addresses (unless you type one into a support ticket), or anything about your visitors.
The service address is hard-coded #
The AI service address, https://ai.vergelabs.nl/v1, is written into the source with
no WordPress filter.
That is deliberate. The requests carry your licence key, and a filter would let any
co-installed plugin redirect them to a harvester. The only override is the
VERGEML_AI_SERVICE constant in wp-config.php, which is for development and
refuses non-HTTPS values.
Staging copies are refused #
Describing is refused on a site whose environment type is not production, so a
clone cannot spend your balance. Override with VERGEML_AI_ALLOW_NONPROD if you
mean it.
Your licence key at rest #
Sealed with AES-256-GCM, the encryption key derived from your site's auth salt.
Write-only through REST, masked in the UI, and never returned by the status
endpoint — which answers with a boolean has_license only.
A copied database does not yield a working licence. Changed salts read as "no licence", and re-entering the key is the recovery.
Published documents #
- Sub-processors — every company that touches the data, what each one reaches, and where it is.
- What is kept, and for how long — per category, naming the file in the code that proves it.
- Data Processing Agreement — Art. 28 GDPR.
Verifying any of this #
The plugin is GPLv2. Every claim on this page is checkable in the source:
| Claim | Where |
|---|---|
| The service URL is hard-coded, no filter | core/ai.php |
| Exactly what a describe request contains | core/ai.php, vergeml_ai_describe_request() |
| What page context adds | core/seo-context.php |
| The key is sealed at rest | core/ai.php, the seal/unseal pair |
| Nothing is sent without a key | core/ai.php, the no-licence guard |
| Set aside contains no delete | core/quarantine.php |
| Folder talk sends no images | core/folder-talk.php |
| The plan sends labels and counts only | core/plan-tree.php |
Written from version 3.15.0 of the plugin. Last updated 2026-10-02. All documentation · Legal · Support