This is a convenience translation of our German privacy policy (Datenschutzerklärung). Only the German version is legally binding.
webpowers UG (haftungsbeschränkt), Hillenbrandstr. 9, 86156 Augsburg, Germany. Managing director: Maksym Vovk. Contact for data protection requests: hello@grumeria.com.
For the customer account we process the email address, Firebase ID, creation time and, for paying accounts, Stripe customer and subscription IDs. To provide the search we store the store configuration, feed URL, field mapping and product data. Payment and card data are processed by Stripe under its own responsibility.
In the separate consent mode (JTL connector or embed script widget-consent-v1.js) the product search also works without consent to search statistics. Without this consent, search terms are only processed to answer the request and no search or product events are stored for statistics. To calculate the booked search quota, an aggregated count per store search and calendar day is kept, without search terms, visitor IDs or individual search times. With consent, the search statistics contain the search term, search method, number of results and time, but no IP address and no personal search profiles.
Also only with consent, we store which products were shown and clicked in the search, and for clicks also the source (search, recommendation or category). The store reports purchase signals on the order confirmation page: for each purchased product the product ID and, where transmitted, quantity, gross value of the order line and currency. We assign our own order key to each report. If a value is missing, we estimate it from the current price in the search index. We do not receive names, addresses, payment data or plain-text order numbers.
For impressions, clicks and purchases we store, instead of the IP address, a salted and truncated identifier that changes daily (daily ID); the IP address itself is not stored. The daily ID is only used within the same calendar day (UTC): for abuse and duplicate checks, for product recommendations based on products viewed together, and to attribute a purchase to a previous search click on the same product. From this attribution the store operator only receives aggregated figures such as search-related revenue, no information about individual visitors. For product recommendations we also derive statistical relationships between products that were bought together; a pseudonymous order ID is used for grouping, plain-text order numbers are not required. Recommendations are based on aggregated product relationships and do not create permanent visitor profiles. We delete impressions, clicks and purchase signals with their values after 100 days.
The application, database and search index are operated by Fly.io in the Frankfurt region. For sign-in we use Firebase Authentication (Google Ireland Limited), for billing and payments Stripe Payments Europe, Limited. Where providers process data outside the European Economic Area, we base the transfer on an adequacy decision or EU standard contractual clauses. Required data processing agreements are concluded with the service providers used.
For the daily database backup we use the S3-compatible object storage Tigris (Tigris Data, Inc.). Backups leave our systems only encrypted with AES-256-GCM; the key is derived from a passphrase known only to us and is never held by the storage provider. Retention period 30 days.
We send emails to account holders (section 12) and team invitations (section 11) via SMTP through our mailbox hello@grumeria.com at our email provider ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf (Germany). The provider receives the recipient address and the content of the message; weekly reports and notices about searches without results may contain frequent search terms from the respective store.
We send technical error messages from operations to a notification service chosen by us. They contain the error location, error type, a shortened error message and the software version. Email and IP addresses, credentials, keys and URL parameters are removed before sending.
Performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR), legitimate interests in secure, stable operation and abuse prevention (Art. 6(1)(f) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR). In the separate consent mode, the optional search statistics including purchase signals are processed on the basis of the consent given in the respective store (Art. 6(1)(a) GDPR). It can be withdrawn there in the privacy settings; the product search remains available. The legal bases for team invitations and emails to account holders are set out in sections 11 and 12.
Search and product events, including purchase signals with their values, are deleted automatically after 100 days. Aggregated daily counters without visitor reference are deleted together with the corresponding store search. We store feed and account data until the account is deleted or statutory retention periods end. Billing records are kept in line with tax and commercial retention periods. The retention of team invitations and email settings is set out in sections 11 and 12.
Within the statutory scope you have the right of access, rectification, erasure, restriction, data portability and objection. Account export and deletion are available directly in the account area; alternatively a message to hello@grumeria.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
When you visit our website, the hosting provider processes technically necessary connection data, in particular IP address, time, requested address and browser information, in order to deliver the website and fend off attacks. The IBM Plex fonts used are served locally; your browser does not contact Google Fonts servers for them.
For the feed check without an account, our server fetches the store or feed address you enter and shows only a summary. So that you can try your own search terms, the products' title, brand, categories, short description and image address stay in the server's memory for up to 15 minutes and are discarded afterwards; we do not store the feed content or your search terms in a database. For our statistics we store per check only the domain of the checked address (without path or parameters), the detected shop system, whether the check succeeded, the number of products, whether it was started from a shared link, and a partner code from the page address, no IP address; these entries are deleted after 90 days (Art. 6(1)(f) GDPR, our interest in evaluating how the feed check is used). If a store address was checked, our server also sends your own search term to that store's public search for comparison and shows only the number of results it reports; the store receives the search term, not your IP address. The example searches show product images from the checked feed. Your browser loads these images directly from the store's server or its image service, which, as with any page request, receives your IP address and browser information; no referrer is sent.
In the customer area we set technically necessary session and CSRF cookies. We store your decision on optional ad measurement for six months in the cookie gm_ads_consent. Only after consent does our own website load Google Ads; Google advertising cookies, in particular _gcl_*, may then be stored for up to 90 days. The product search embedded in customer stores is not connected to Google Ads by this. The optional purchase tracking of the JTL connector uses the browser’s session storage after consent so that an order is not reported more than once. We store the decision on attributing ad clicks (section 10) for six months in the cookie gm_acq_consent; after consent we additionally set the cookie gm_acq for 30 days with a random reference without email address or URL data.
If you consent in the privacy settings, we use Google Ads by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to attribute ad clicks to a first paid Grumeria subscription. For this, Google receives among other things click and cookie IDs, IP address and browser information as well as a pseudonymous transaction ID, the net amount and the currency of the purchase. We do not transmit an email address, name or card data for this. Sign-ups, free trials and ongoing subscription renewals do not count as new customer revenue. Personalised advertising and Google Analytics are disabled.
Before consent we do not load the Google tag. You can refuse or withdraw at any time via “Privacy settings”; the website, search and booking remain usable. The legal basis is your consent (Art. 6(1)(a) GDPR). A withdrawal applies to the future. Google may also process data in the USA; information on Google’s processing and international transfers can be found in the Google Privacy Policy and under Google Business Data Responsibility. Consent to this measurement is independent of the search statistics in customer stores.
We run ads via SourceKnowledge. If you reach our website through such an ad and consent in the privacy settings, we store the campaign details from the link (campaign, the provider’s campaign and click ID, publisher ID, channel), the path visited, the time and the version of your consent. If you sign up within 30 days, we link these details to your account and evaluate internally whether this led to a sign-up, a first product import and paid subscriptions (net amount and currency of first and subsequent payments as well as refunds). This tells us whether the advertising pays off. Visit details that are not linked to an account are deleted after 90 days; linked details are stored until you withdraw consent or delete your account.
We do not transmit any data to SourceKnowledge. Without consent we store none of this; the website, sign-up and booking remain fully usable. The legal basis is your consent (Art. 6(1)(a) GDPR). A withdrawal via “Privacy settings” applies to the future, removes the cookie gm_acq and unlinks the click from the account. Invoice and payment data that we keep for legal reasons are not affected. This consent is independent of the Google Ads conversion measurement in section 9.
Store owners can invite further people by email as editors or viewers. For this we process the invited person’s email address, the intended role, the store, the inviting account, the language of the invitation and the creation, sending, expiry and acceptance times. The address comes from the inviting owner. We send an invitation with an acceptance link that is valid for seven days; it is only resent at the owner’s request. The legal basis is the legitimate interest of the owner and our own in enabling collaboration in the customer account (Art. 6(1)(f) GDPR).
We delete revoked invitations immediately and unaccepted ones 30 days after expiry. An accepted invitation is kept as proof of access until the person is removed from the team or the store or an involved account is deleted. Anyone who does not want to accept an invitation does not need to do anything. Please send questions and objections to hello@grumeria.com.
We send emails to the account’s email address, and store-related messages to the owner of the respective store. You receive contract information regardless of your settings: welcome and trial start, first complete product index, feed errors, outdated JTL export, upcoming end of trial and reaching 80 percent of the search quota (Art. 6(1)(b) GDPR).
In addition, we send notices and reports on the use of the booked service: the weekly report, notices about an unusually high number of searches without results, and setup reminders. The basis is our legitimate interest in supporting you in using the service (Art. 6(1)(f) GDPR); insofar as these emails count as advertising, we only send them for our own similar services in accordance with Section 7(3) of the German Unfair Competition Act (UWG). You can object to each of these email types at any time, via the unsubscribe link in every such email or by message to hello@grumeria.com. This incurs no costs other than transmission costs at basic rates. These emails only mention search terms once they have been searched at least three times.
We store your unsubscribes in the account until it is deleted. So that no email arrives twice, we record the type and time of each email sent; these records are deleted together with the account.
For search and interaction data from embedded stores, Grumeria generally acts as a processor. A contract under Art. 28 GDPR is concluded with the store operator for this.