Privacy Policy

This information describes the processing of personal data in connection with the AI-powered product search on our website.

Visitors can specify their search criteria in their own words. A separate results page displays relevant products from our range. Additionally, a brief, automatically generated explanation may be shown as to why a product matches the search query.

Which service provider is used?

Provider: OpenAI
Service used: OpenAI API
Model used: gpt-5-mini
API endpoint: https://eu.api.openai.com/v1
Processing: Server-side via our systems
Location of processing: International / Global

The AI ​​search is provided via the OpenAI API. The visitor’s browser does not communicate directly with OpenAI. The request is transmitted exclusively from our server to the OpenAI API.

Processing by OpenAI, as well as by OpenAI’s affiliated companies and sub-processors, may take place within and outside the European Union or the European Economic Area, depending on the specific technical infrastructure and the terms and conditions applicable to the service.

OpenAI publishes an up-to-date list of the sub-processors used for its services and their processing locations. This list is subject to change.

What data is transmitted to OpenAI?

The following information is transmitted to OpenAI for the AI-powered product search:

the search text entered by the visitor (maximum 300 characters),
the website language,

data from our product catalog, in particular categories, product names, prices, colors, materials, and short descriptions.

The search text is only transmitted to OpenAI to the extent necessary for performing the product search.

What data is not transmitted to OpenAI as part of the search query?

The following are specifically not included in the search query transmitted to OpenAI:

Visitor’s IP address,
Name and email address,
Customer account or order data,
Shopping cart information,
Session ID,
Cookies,
Other directly identifying account data.

Since the request is made exclusively server-side, the visitor’s browser IP address is not transmitted to OpenAI as part of the API request.

Regardless, technical connection and system data may be processed during the technical provision of an external API service. The applicable data protection and terms of service of the service provider apply in this regard.

Use of API Data by OpenAI

According to the current terms and conditions for the OpenAI API, API inputs and outputs are generally not used for training or improving OpenAI models unless the customer has expressly granted permission.

This is subject to the OpenAI settings and terms of service applicable to the specific API used and the particular account or project.

International Data Transfer

Since the AI ​​product search does not require processing to take place exclusively within the European Union, the use of the OpenAI service may involve the transfer of personal data to countries outside the European Union or the European Economic Area (EEA).

The current OpenAI Data Processing Addendum provides regulations for international data transfers to EEA data. If OpenAI transfers data from the EEA to other OpenAI companies or third parties outside the EEA, this is done in accordance with the current contractual terms, in particular based on Standard Contractual Clauses (SCCs) or – where applicable – on the basis of an adequacy decision by the European Commission pursuant to Article 45 GDPR.

If a transfer is based on Standard Contractual Clauses, it is carried out on the basis of Article 46(2)(c) GDPR.

The applicable safeguards for international data transfers depend on the specific OpenAI contract and service configuration.

The current list of sub-processors used by OpenAI and their processing locations is published by OpenAI.

Data Processing on Our Behalf

To the extent that OpenAI processes personal data on our behalf, this processing is based on the data protection agreements in force between us and OpenAI, in particular the Data Processing Addendum (DPA).

For customers in the European Economic Area (EEA), the current OpenAI DPA includes provisions for the processing of EEA data and international data transfers.

What data do we store ourselves?

For every search performed, a data record is created in our backend.

This record contains, in particular:

the entered search text,
the language used,
Searcher type (guest, customer, dealer, or administrator; each only as a category),
for administrators, additionally the user account, if applicable, for internal testing,
technical information such as processing time, costs, model used, status, and, if applicable, reason for rejection,
the displayed products and the product justifications generated by the model,
the raw data transmitted to the model, insofar as it is product data without personal reference.

For regular customers, neither name nor email address nor customer account is stored in the search record.

Protection against misuse

To limit misuse, an HMAC-based IP address verification value is also used.

The original IP address is not stored.

The verification value serves solely to limit the number of search queries within a day and to detect abusive multiple queries.

The verification value is automatically deleted after the designated retention period expires.

Linking to Orders

If a search later results in an order, the order will only record which search preceded it.

Additionally, the language, visitor type, and time of the search will be stored.

The original search text is not saved with the order.

Statistical Analysis

Only aggregated daily values ​​are collected for statistical purposes.

These include, in particular:

Number of searches,
costs incurred,
languages ​​used,
reasons for rejection.

The daily statistical values ​​do not contain any directly personally identifiable information.

Performance measurement is performed entirely server-side. No additional analytics or tracking cookies are used on the user’s device for this purpose.

Data Retention Periods

The following data retention periods apply to the individual data categories:

Data / Processing / Retention Period
Results page including text and products: 7 days
Raw data from the model run: 14 days
Search record including search text: 90 days, then automatic deletion
HMAC checksum of the IP address: 24 hours
Duplicate submission protection: 60 seconds
Note on the order without search text for the duration of the order retention period
Statistical daily values ​​without personal reference: indefinitely

The deletion of time-limited data is performed automatically via a daily background process.

Storage at OpenAI

In addition to our own data retention periods, OpenAI’s storage and deletion policies apply to the OpenAI API.

According to OpenAI’s current information, API inputs and outputs are stored by default for up to 30 days for the purposes of abuse monitoring and security control, unless a different configuration has been agreed upon or activated for the specific account or service.

OpenAI points out that further configurations, in particular Zero Data Retention (ZDR), may be available for certain authorized API customers and use cases.

For our specific use, the settings actually activated for our OpenAI account or project and the terms and conditions agreed upon with OpenAI apply.

Cookies

The AI ​​product search does not introduce any additional custom cookie.

Only the existing WooCommerce shopping cart cookie is used:

Cookie: wp_woocommerce_session_*
Content: randomly generated session identifier
Duration: 2 days for guests, 7 days for logged-in customers

In connection with the AI ​​search, this cookie is simply set earlier: when the results page is accessed, and not only when an item is first added to the shopping cart.

Only the randomly generated session identifier remains on the end device.

The server also stores information about which search was last displayed.

Consent

Before submitting a search query, a checkbox must be actively selected.

Without confirmed consent, the server rejects the request and does not transmit the entered search text to OpenAI.

This consent specifically refers to the transmission of the search text entered by the visitor to the external AI service provider for automated processing and identification of suitable products.

The corresponding information text can be maintained separately for each language version of the website.

Furthermore, the use of artificial intelligence is indicated both directly in the input field and above the heading on the results page.

Automated Product Recommendations

The AI ​​product search analyzes the entered search text and identifies suitable products from our product catalog.

The product recommendations and the accompanying explanations are automatically generated by an AI model.

The results do not constitute individual advice and do not guarantee that a previously made product will be suitable.

Results Page

The results page has the following characteristics:

It is accessible exclusively via a randomly generated and unguessable address (256 bits).

The complete address is not stored in the database. Only a checksum is stored there.

The page is excluded from search engines and is not cached.

When switching to a product, the address of the results page is not transmitted as a referrer (referrer policy: no-referrer).

The results page can be shared. Anyone with the corresponding link can access the page.

Since the results page can be accessed via the individual link, the search text should not contain confidential or particularly sensitive information.

Rights of Data Subjects

For regular customers, the search data record generally does not contain any information that allows it to be directly associated with a specific person.

However, an association may be possible if a search subsequently resulted in an order, as the order contains a reference to the search in question.

In this case, the corresponding data record can be identified via the order and—provided the legal requirements are met and the data record is still stored—deleted.

Data subjects also have the statutory rights under the GDPR, in particular the right to information, rectification, erasure, restriction of processing, and—provided the respective requirements are met—the right to data portability and the right to object.

If processing is based on consent, this consent can be withdrawn at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Legal Bases

According to current assessment, the following legal bases are particularly relevant for the various processing operations:

Transmission of the entered search text to OpenAI:

Consent pursuant to Art. 6 para. 1 lit. a GDPR via the explicitly confirmed checkbox.

Storage of the search data record:

Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR, in particular for traceability, cost control, error analysis, quality assurance, and the detection and prevention of misuse. Storage is limited to a maximum of 90 days.

Storage of the HMAC checksum of the IP address:
Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in protecting the service from misuse.

Note on the order:
Legitimate interest or the legal basis applicable to the ordering and documentation processes, in particular for the traceability and evaluation of the use of our own service.

Statistical evaluation:
Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in measuring and improving the reach, use, and effectiveness of our own service, insofar as only aggregated or non-personally identifiable data is processed.

Third-Country Transfer

The consent required for using the AI ​​search pursuant to Art. 6 para. 1 lit. a GDPR and the data protection requirements for transferring personal data to third countries must be distinguished.

Insofar as personal data from the European Economic Area is transferred to third countries in connection with the use of the OpenAI service, the transfer is based on a transfer mechanism permissible under Chapter V GDPR.

According to the current OpenAI Data Protection Agreement (DPA), standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR or – where applicable – an adequacy decision pursuant to Art. 45 GDPR are particularly suitable for this purpose.

The safeguards applicable to each transfer depend on the specific contract and service configuration.

Performance Measurement

The performance measurement of the AI ​​product search is deliberately not legitimized by the same consent as the transmission of the search text to OpenAI.

Performance measurement is not required for the transmission of the search text to OpenAI.

The statistical analysis is performed server-side and does not use any additional cookies or other information on the end device for the aggregated daily values.

Insofar as the performance measurement is based on a legitimate interest, it is carried out on the basis of Article 6(1)(f) GDPR.

Right to object

Insofar as individual processing operations are based on a legitimate interest pursuant to Article 6(1)(f) GDPR, there is generally a right to object pursuant to Article 21 GDPR.

An objection to the performance measurement can be implemented practically by removing the corresponding note from the order in question.

The aggregated daily statistics already generated will not be affected by this.

This does not change the data, as it contains only aggregated figures without any personal information.

Deactivation

The AI ​​product search can be completely deactivated at any time – both via the server configuration and via the WordPress backend.

When deactivated, the input field will no longer be displayed, and no new AI search queries will be processed.

The performance measurement based on orders can be deactivated separately.