Ninhle AI Sales Assistant for WooCommerce

Description

Ninhle AI Sales Assistant is an AI sales agent for WordPress and WooCommerce. It answers customer
questions using your actual product data — never invented prices or stock — qualifies
buyers, handles objections, captures leads and hands off to a human when needed.

Free features

• Bring your own key — choose Anthropic Claude, OpenAI or Google Gemini as your AI provider. You control the account and the spend.
• Grounded in real data — product answers come from a synced WooCommerce catalog and live store lookups, not from model memory.
• Store tools — product search and details, order status (only after the customer proves they own the order), digital downloads, store policies and site content.
• Sales playbook and rules — an editable script covering persona, qualifying questions, objection handling and closing, plus keyword rules for instant answers.
• Lead capture — a dedicated contact panel in the chat widget, with leads stored in your own database and exportable to CSV.
• Human handoff — escalates on complaints, explicit requests or low confidence, and can notify a webhook URL you choose.
• Conversation inbox — read every conversation in WP Admin and release it back to the bot after a person has stepped in.
• Your brand — widget name, logo, colour and font.
• Local-only mode — answer product, cart and order questions from store data without calling any AI provider.
• Privacy built in — WordPress personal-data export and erasure, attachment retention, rate limiting.
• Translation-ready — every string can be translated on translate.wordpress.org.
• WooCommerce compatible — declares support for High-Performance Order Storage (HPOS) and the Cart/Checkout blocks.

Premium plans

Ninhle AI Sales Assistant is free to install and use. Optional paid plans add extra code to the
plugin; nothing in the free version is locked or time-limited.

Starter — product variations with per-variation add-to-cart links, Telegram
notifications for new leads and handoffs, a sales dashboard, and cached answers
for repeated questions.

Pro — everything in Starter, plus coupon validation, automatic failover to a
second AI provider, daily and monthly AI budget caps, rule-based lead scoring with
advanced analytics, price-output verification, and signed HMAC-SHA256 webhooks
for n8n, Make, Zapier and CRMs.

AI usage is never included: OpenAI, Anthropic and Google bill you directly for
your own API key, on every plan including Free.

External services

The plugin connects to the services below. Except for the AI provider you configure,
each one is used only when you turn the related setting on.

AI provider (the one you configure) — receives the visitor’s chat messages, recent
conversation history, your sales playbook and business information, and product data from
your own store, each time a visitor sends a message. Nothing is sent in local-only mode.

• Anthropic (Claude) — https://www.anthropic.com/legal/privacy — https://www.anthropic.com/legal/consumer-terms
• OpenAI — https://openai.com/policies/privacy-policy — https://openai.com/policies/terms-of-use
• Google (Gemini) — https://policies.google.com/privacy — https://ai.google.dev/gemini-api/terms

Link reading (optional, off by default) — when you enable “Let the bot read links
customers send”, a URL a visitor pastes into the chat is sent to r.jina.ai to fetch its
text (https://jina.ai/legal/). YouTube links are read from youtube.com instead, to get the
video title and public transcript (https://policies.google.com/privacy,
https://www.youtube.com/t/terms). Leave this off if visitors might paste private links.

Google Fonts (optional) — only if you pick a Google font for the widget in the
settings. Visitors’ browsers then load that font from fonts.googleapis.com
(https://policies.google.com/privacy). The default font loads nothing from Google.

Handoff webhook (optional) — only if you enter a webhook URL. On a handoff the plugin
sends the conversation ID, contact ID and handoff level to that URL, which you control.

Telegram (paid plans only, optional) — the free version contains no Telegram code. In
the Starter and Pro plans, if you enter a Telegram bot token and chat ID, new leads (name,
email, phone) and handoff requests (priority, issue, summary, conversation number) are sent
to api.telegram.org (https://telegram.org/privacy, https://telegram.org/tos).

Automation webhooks (Pro plan only, optional) — the free version contains no code for
this. In Pro, if you enter a webhook URL, lead and handoff events are posted to that URL,
which you control, signed with your secret.

Freemius (licensing) — the plugin bundles the Freemius SDK for optional upgrades.
It sends data to Freemius only if you opt in or start a paid plan or trial
(https://freemius.com/privacy/, https://freemius.com/terms/).

Security

API keys are stored server-side and never sent to the browser; the settings screen
shows only a masked value. Every provider call is made from your server through the
WordPress REST API.

Database queries use $wpdb->prepare(). Every REST route declares a real
permission_callback, and the endpoints the AI uses as tools are internal-only –
they cannot be reached from outside the site. Visitor sessions use hashed tokens
and chat messages are rate limited per session.

Chat messages are rendered as DOM elements rather than injected HTML, and only
http and https links are ever made clickable, so content returned by the AI cannot
inject markup.

Please report security issues privately to the author rather than in a public forum.

Privacy

Conversations, contacts and leads are stored in your own WordPress database. The
plugin registers with Tools > Export Personal Data and Tools > Erase Personal Data,
so you can answer data-subject requests from WordPress itself. Message attachments
are purged on a configurable retention schedule. No data is sent anywhere except the
services listed under External services.