GDPR & Data Sovereignty

Our approach to data protection

GDPR compliance is not an afterthought at Koply — it is a core design decision. Unlike US-based search providers, your product catalogue and your customers' search behaviour never leave the European Union. This fundamentally simplifies your GDPR obligations.

What data does Koply process from your store visitors?

The Koply widget processes search queries typed by your visitors. Specifically:

• The search query text is sent to our API to retrieve results.
• The approximate country of origin is inferred from the IP address using a database stored on our own servers in the EU. The IP address is not stored in analytics data and is not sent to any other service; it only remains in technical server logs for up to 30 days for security purposes.
• No cookies are set on your visitors' browsers by the Koply widget. The widget stores one random, anonymous identifier in the browser's local storage, which expires after 24 hours and contains no personal data.
• Linked only to that identifier, Koply records searches, clicks on results, add-to-cart actions from results and, where you enable it, completed orders (order reference, total and products).
• No personal identifiers (name, email, device fingerprint) are collected from your visitors.
• No cross-site tracking takes place.

The identifier is random and anonymous, but the ePrivacy rules on storing information on a user's device apply regardless of the technology used. We therefore recommend that you mention Koply in your cookie policy and decide, with your legal advisor, whether to collect consent before measuring. The widget has a consent mode in which nothing is stored or sent until your consent tool authorises it, and search works the same either way. See the integration guide (in Spanish) for the details and ready-to-use wording.

Infrastructure and data location

Data Processing Agreement (DPA)

When you use Koply to process search queries from your store visitors, Koply acts as a data processor on your behalf. We are happy to sign a Data Processing Agreement (DPA) as required by GDPR Article 28. To request a DPA, contact us at privacy@koply.eu.

AI features and data privacy

Some Koply features use AI models (Claude by Anthropic) to improve search quality:

• Synonym suggestions — analyses product titles and categories from your catalogue. No visitor data is involved.
• Product enrichment — generates descriptions for products without one, using title, brand and category. No visitor data is involved.
• Zero-results recovery — reformulates a search query that returned no results. The query text is sent to the AI without any visitor identifier attached.
• Image search — the uploaded image is analysed to extract a text description, then immediately discarded. Images are never stored.

All AI processing uses anonymised or non-personal data. Anthropic processes data under a commercial agreement that includes GDPR-compliant data protection provisions.

Your obligations as a Koply customer

As a Koply customer (data controller), you remain responsible for:

• Informing your store visitors about the use of third-party services in your Privacy Policy. You may reference Koply as an "EU-hosted site search provider that measures search performance using a random, anonymous identifier that expires after 24 hours."
• Ensuring your product feed does not contain personal data (it should contain only product information).
• Responding to data subject requests from your customers. For requests that require data deletion from Koply's systems, contact us at privacy@koply.eu.

Data Controller

Questions

For any GDPR-related questions or to request a Data Processing Agreement, contact us at privacy@koply.eu.