Learn what personal and operational data SmartyFind processes, for what purposes, how long it is retained and what GDPR rights you can exercise.
SmartyFind processes three primary categories of data: (a) B2B account and administrator data (name, work email, organization, security audit logs); (b) public product catalog data from connected stores (SKUs, attributes, images, inventory); and (c) pseudonymous search widget telemetry (search queries, product clicks, cart events, conversions and session tokens).
Account data is processed to perform our B2B contract, authenticate users and secure the platform (GDPR Art. 6(1)(b) and (f)). Storefront search telemetry is processed as a Data Processor on behalf of the merchant strictly to deliver search relevance, recommendations and conversion analytics.
Every tenant and store is logically isolated across PostgreSQL, OpenSearch indices and ClickHouse analytics tables. Connector credentials are encrypted at rest, and passwords and API keys are stored using strong cryptographic hashes.
Catalog records are retained while the store integration remains active. Search and conversion telemetry is retained according to the active plan's retention window (30 to 365 days) and purged upon account deletion.
Under GDPR, individuals have the right to access, rectify, erase, restrict, port or object to the processing of their personal data. Privacy inquiries can be submitted via our contact page or directed to privacy@smartyfind.com.
Open the relevant guide instead of starting a conversation from zero.
Review how essential authentication, preference and optional analytics cookies are used in SmartyFind.
Open →Trust centerReview SmartyFind GDPR Article 28 processor responsibilities, technical security controls, subprocessors and data deletion terms.
Open →SecurityLearn how SmartyFind handles authentication, isolation, encryption, audit and operational monitoring.
Open →