Privacy policy
What data SeekGist collects, why, and your rights.
This policy explains what personal data SeekGist ("we") collects, why, and what rights you have.
There are two groups of people:
- Store owners and their teams who use the SeekGist dashboard. For their data, SeekGist is the controller (we decide why and how it is used).
- Shoppers who search on a store that uses SeekGist. For their data, the store is the controller and SeekGist is the processor. The Data Processing Agreement covers this.
1. Data we collect
| Data | From whom | Why |
|---|---|---|
| Name, email, password (stored only as a hash), two-factor settings | store owners and team members | to run your account and keep it secure |
| Store name, settings, API keys (stored only as a hash) | store owners | to run the Service |
| Billing details | store owners, through our payment provider | to bill you; we do not store card numbers |
| Product catalog | the store | to build the search index; it should not contain personal data |
| Search queries and events (click, add to cart, order), with a random session id and the device type | shoppers, through the store | to return results, count usage, and show analytics to the store |
| Technical logs: IP address, browser, request id, time | everyone who calls the Service | security, abuse prevention and fixing errors |
| Name, email, company and message of a demo request | people who book a demo | to answer the request |
By default SeekGist stores no shopper names, emails, phone numbers or addresses. Recent searches stay only in the shopper's browser. If a shopper types personal data into a search, it is stored as typed, like any other query.
2. Cookies and browser storage
sg_session: keeps you signed in to the dashboard. Needed for the Service.NEXT_LOCALE: remembers your language.- The theme (light or dark) and the widget's recent searches are kept in the browser's local storage.
We do not use advertising or analytics cookies.
3. Legal bases
- To run the contract with the store (account, billing, the Service itself).
- Legitimate interests: security, abuse prevention, and improving the Service.
- Legal duties, for example tax records.
- Consent, where the law requires it.
4. Who we share data with
We share data only with service providers who help us run SeekGist, under contracts that protect it ("subprocessors"):
| Subprocessor | What for | Where |
|---|---|---|
| Hetzner Online GmbH | servers, databases, search engine and backups | Germany |
| Stripe | billing and card payments | United States |
| Resend | account and billing emails | United States |
| Cloudflare | DNS, the [email protected] inbox, and uptime checks | United States (global network) |
No translation service provider is used yet: catalog translation runs on a test translator inside SeekGist. Before a provider receives any data, we add it to this list and tell store owners at least 30 days before.
We do not sell personal data. We may share data if the law requires it.
5. International transfers
Our servers and databases are in Germany (EU). Stripe, Resend and Cloudflare are based in the United States and may process data there. For these transfers we rely on safeguards the law accepts, such as the standard contractual clauses in each provider's data processing terms.
6. How long we keep data
- Account data: while your account exists. After the contract ends you can export it for 30 days; then we delete it.
- Search logs and events: 90 days by default. Each store can set 7 to 730 days in its settings.
- Technical logs: deleted automatically as the log files rotate (each service keeps at most 50 MB of logs).
- Demo requests: deleted 90 days after the request is closed, and at most 365 days after it was sent.
- Billing records: as long as tax law requires.
7. Your rights
Depending on where you live, you can ask to see, correct, export or delete your data, to limit or object to its use, and to complain to a data protection authority. Shoppers should first contact the store; we help the store answer. Store owners can export and delete their store's data in the dashboard. Contact: [email protected].
8. Security
API keys and passwords are stored only as hashes. Platform access tokens are encrypted. Each store's data is kept apart from other stores' data in the database. Traffic is encrypted with TLS. Team access uses roles, and important actions are written to an audit log.
9. Children
SeekGist is a business service and is not meant for children.
10. Changes
We will post changes here and tell store owners by email before important changes take effect.
11. Contact
For privacy questions, data requests and legal notices, email [email protected].