This is a convenience translation of our German data processing agreement (Vereinbarung zur Auftragsverarbeitung) and its annex on technical and organisational measures. Only the German versions at /avv and /tom are legally binding. Version of 9 October 2026 · Agreement under Art. 28 GDPR.
The processor is webpowers UG (haftungsbeschränkt), Hillenbrandstr. 9, 86156 Augsburg, Germany. The controller is the store operator named in the Grumeria account. This agreement supplements the SaaS contract. In case of conflict, the provisions of this agreement take precedence for the processing of personal data.
The subject matter is the operation of a hosted store search, including product index, search API, widget, interaction measurement and admin reporting. The processing serves to deliver, improve and secure the search. It lasts for the term of the main contract plus technically necessary deletion and backup periods.
We process product and content data, search terms, search method, number of results, timestamps, product IDs and interaction types, and for clicks their source (search, recommendation, category). For purchase signals, where reported by the store, this includes quantity, gross value of the order line and currency, otherwise a value estimated from the catalog price, as well as an order key assigned by the processor to each report. For product recommendations, pseudonymous, aggregated co-occurrences per product pair are additionally derived from these interactions (which products are bought or viewed together); a pseudonymous order identifier (HMAC, no plain-text order number) is used for grouping only.
For interactions, a salted, truncated hash that changes daily (daily hash) is stored instead of the IP address; the raw IP address is not stored in the search or interaction log. The daily hash is only used within the same calendar day (UTC): for duplicate and abuse checks, for recommendations based on products viewed together, and to attribute a purchase to a previous search click on the same product. The controller only receives aggregated figures from this attribution. No visitor profiles are created. Names, addresses, payment data and plain-text order numbers are not processed. Data subjects are visitors and customers of the store operated by the controller.
We process data only on documented instructions from the controller, unless a legal obligation requires otherwise. The product feed, the configuration and the use of the service count as documented instructions. Persons involved in the processing are bound to confidentiality and only receive the access rights they need.
The agreed measures are described in the annex below. We may adapt them to technical progress as long as the agreed level of protection does not decrease.
Currently used: Fly.io, Inc. for hosting and platform operation (data location Frankfurt), Tigris Data, Inc. for the daily database backup encrypted with AES-256-GCM (retention 30 days; the key is derived from a passphrase held only by the processor and is not available to the storage provider), Google Ireland Limited for sign-in to the customer account, Stripe Payments Europe, Limited for billing and payments, and ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf (Germany) as provider of the sender mailbox hello@grumeria.com for sending emails to the controller via SMTP. Weekly reports and notes on searches without results may contain search terms that were searched at least three times in the store. Further sub-processors are only used after documented selection and with the required data protection agreements. Material changes are notified to the controller electronically in advance; a justified objection on data protection grounds remains possible.
We support the controller to a reasonable extent with access, rectification, erasure, restriction, data portability, data protection impact assessments and requests from authorities. We notify the controller without undue delay of breaches affecting the data processed on its behalf, with the available information on nature, scope, consequences and measures.
Search and product events are deleted automatically after 100 days. After the end of the contract we delete or anonymise data processed on behalf of the controller, unless there is a statutory retention obligation. An account export can be requested in the customer area before deletion.
On request we provide reasonable evidence of compliance with this agreement. Audits are possible with reasonable advance notice, while protecting business and trade secrets and without disproportionate disruption of operations.
Production runs in the hosting provider's data centres in Frankfurt. Administrative access is limited to authorised persons. Customers authenticate via Firebase Authentication; sessions use secured HttpOnly cookies, CSRF checks and role-based engine assignment.
Roles (owner, editor, viewer) and engine assignments are checked on the server. Database queries and configurations are restricted to the respective engine. Public search access can be limited to allowed store domains; secret admin keys are never delivered to the browser or widget.
External connections use TLS. Security headers enforce HTTPS and restrict browser features. Feed URLs are checked against internal, local and cloud metadata targets; redirects are validated again and access tokens are not passed on to other hosts. Inputs are validated, and search filters are only built from approved attributes.
The web application, database and search service are monitored separately. Health checks, worker monitoring, rate limits, proof of work under unusual load and quotas protect the service. If the search is unreachable or the search quota is used up, the widget falls back to the store's native search.
New data is first built in a shadow index and only published atomically. Empty, strongly deviating, incomplete feeds or feeds above the product limit do not replace the last complete index. Feed fingerprints and processing logs make updates traceable.
Database backups can be stored encrypted in a separate object store; recovery tests must never run against the production database. Search and interaction events are deleted automatically after 100 days. Account export and account deletion are available in the customer area.
Feed runs, status and document counts are logged; recurring customer emails are idempotent. Technical warnings can be reported to an operations webhook. Incidents are analysed, contained and communicated according to the agreed notification process.
The embedded Grumeria product search sets no marketing cookies, creates no personal search profiles and loads web fonts locally. Raw IP addresses are not stored in search or interaction logs. Instead, a salted, truncated hash is created that changes daily (daily hash). It is only used within the same calendar day (UTC): to limit duplicates and abuse, for recommendations based on products viewed together and to attribute search clicks to purchases for aggregated reports. Purchase reports only contain product IDs, quantities, values and the currency, no plain-text order numbers, names or addresses. In consent mode, statistics, clicks and purchase signals are only recorded after consent in the store.