GDPR Compliance
Last updated: July 10, 2026
1. Our commitment
AppIn is operated by ISAP OÜ, a company registered in Estonia (registry code 16838751) — an EU member state. We build the service around GDPR requirements and give you the tools to meet your own obligations: a Data Processing Agreement, EU hosting, and sub-processor transparency.
This page explains in plain language how we handle personal data so you can assess whether AppIn fits your compliance needs. It is not a warranty of your own compliance — that also depends on how you configure AppIn and what you disclose to your users. It complements — but does not replace — our Privacy Policy and our Data Processing Agreement (DPA).
2. Where your data lives
All application data — your account, your indexed content, the vector database, query logs — is hosted on Hetzner data centers in Germany and Finland (EU).
Unlike many AI search products, our embedding and ranking models are self-hosted on our own EU infrastructure. Your indexed content does not leave our servers for embedding, vector search, or reranking — those operations run on our own EU infrastructure and are not sent to a third-party AI service. LLM features are the exception, described in section 4 below.
3. Controller vs. processor — who is responsible for what
Where we are the controller
For your account data, billing data, contact-form submissions, and data collected on our marketing site, ISAP OÜ is the data controller. Our Privacy Policy covers this processing.
Where you are the controller
For the content you index (catalogs, pages, docs) and for the search queries and chat messages your end users submit on your site, you are the controller and we are your processor, acting on your instructions under our DPA.
What this means for you in practice
- You should mention AppIn as a service provider in your own privacy notice, since your visitors' search queries pass through our service.
- The WooCommerce plugin sends no shopper personal data by design — only your catalog data, the search query text, and standard HTTP metadata. There is no shopper tracking to disclose beyond that.
- The DPA gives you the processor commitments GDPR requires from you (Art. 28): documented instructions, confidentiality, security measures, sub-processor control, deletion at end of service.
4. What leaves the EU — and why
The core of the service stays in the EU: indexed content is embedded and searched on our own EU servers. Three categories of processing involve providers outside the EU:
- LLM features — for search query parsing, chat responses, content cleanup, and index-time synonym enrichment of product titles, only the text needed for the feature is sent to an LLM provider. With our platform keys, requests are processed by Google (Gemini API), OpenAI, Anthropic, or Mistral AI (or Azure OpenAI where configured for a site), depending on the feature and site configuration. If you bring your own key (BYOK — OpenAI, Azure OpenAI, Anthropic, Google Gemini, or Mistral), requests go to your configured provider under your own agreement with them.
- Cloudflare — DNS, CDN, DDoS protection, and widget delivery. Browsers loading the widget transmit standard HTTP metadata (IP address, user agent, referrer).
- Sentry — error monitoring; error reports may include request metadata.
- Messaging channels (optional) — if you connect the chat assistant to Telegram, WhatsApp, or Facebook Messenger, conversations also pass through the channel operator's platform under its own terms. You choose whether to enable these channels.
All of these transfers are covered by Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework, as listed in the table below.
5. Sub-processors
We use the following sub-processors to deliver the service:
| Sub-processor | Location | Purpose | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Germany/Finland (EU) | Cloud hosting of all application data | n/a (EU) |
| Cloudflare, Inc. | US/global (EU endpoints) | DNS, CDN, DDoS protection, widget delivery | EU–US Data Privacy Framework + SCCs |
| Google (Gemini API) | US/global | LLM processing (platform keys) | SCCs (in the provider's DPA) |
| OpenAI, L.L.C. | US | LLM processing (platform keys) | SCCs (in the provider's DPA) |
| Anthropic, PBC | US | LLM processing (platform keys) | SCCs (in the provider's DPA) |
| Mistral AI | France (EU) | LLM processing (platform keys) | n/a (EU) |
| Functional Software, Inc. (Sentry) | US | Error monitoring | EU–US Data Privacy Framework + SCCs |
| Microsoft (Azure OpenAI) | Per configuration | LLM processing only where configured for a site | SCCs (in the provider's DPA) |
- LLM sub-processors process data only when our platform keys are used. With BYOK, the LLM provider is engaged directly by you and is not a sub-processor of AppIn.
- Revolut processes payment data as an independent controller — it is not a sub-processor of your Customer Content.
- We notify customers of sub-processor changes (by email or dashboard) with a 30-day objection window before the change takes effect.
6. Your rights — and your users' rights
Under the GDPR you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Portability — receive your data in a structured format
- Restriction — restrict processing of your data
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent
To exercise these rights, contact [email protected]. We respond within one month.
If an end user contacts us about personal data processed on a customer's site — data for which the customer is the controller — we redirect the request to the customer and assist the customer in fulfilling it, as required by the DPA.
7. Security measures
- TLS for all connections; HTTPS everywhere
- Secret API keys stored SHA-256-hashed; public keys are site identifiers safe to expose in browsers
- BYOK LLM keys encrypted at rest
- Tenant isolation — content lives in dedicated vector collections, per site or per shared data source where several of a customer's sites share one catalog
- Rate limiting per plan, API-key authentication, least-privilege admin access
8. Data retention
- Search query logs — automatically deleted after 3 months
- Chat sessions — soft-deleted 2 months after expiry, permanently deleted 6 months after soft-deletion
- Token usage logs — retained as billing records for as long as accounting and tax law requires (generally seven years), including after account closure
- Indexed content — retained while the account/site is active; removed via API delete, site deletion, or account deletion
- Contact form messages — retained up to 12 months
- Account data — retained while the account is active; deleted on account deletion request
- Unverified accounts — soft-deleted 15 days after registration (after email warnings), permanently deleted 30 days later
9. Breach notification
If a personal data breach occurs, we act without undue delay. Where the GDPR requires it, we notify the competent supervisory authority within 72 hours of becoming aware of the breach. For data we process on your behalf as processor, we notify you — the controller — without undue delay after becoming aware, so you can meet your own notification obligations.
10. Data Processing Agreement (DPA)
Our DPA applies automatically to every customer as part of our Terms of Service — no separate signature is needed to be covered. If you require a countersigned copy for your records or your own compliance documentation, email [email protected].
11. Supervisory authority & contact
Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You also have the right to lodge a complaint with the supervisory authority in your own EU member state.
Data protection questions: [email protected]
ISAP OÜ
Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia
Registry code: 16838751