Privacy Policy
Last updated: 11 October 2026
ThunderBar (thunderbar.io) is owned and operated by INWEBPRO (InWebPro Ltd, Ir. Polytechneiou 73A, 124 62 Chaidari, Greece). This policy explains what data we process, why, for how long and what your rights are, under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
For the thunderbar.io website, accounts and billing, INWEBPRO is the controller.
For the data of visitors to online stores that use ThunderBar (searches, clicks, orders from search, availability alerts), each store is the controller. INWEBPRO processes this data on the store's behalf, only to provide the service. If you are a visitor of an online store, please contact the store about your data; we will help it reply.
2. Data from the website and your account
| Category | Examples | Purpose |
|---|---|---|
| Account | Name, email, password (hashed), language, role | Create and secure your account |
| Stores | Store URL, product catalog (title, price, image, category), settings | Run the search |
| Billing | Billing details, plan | Contract and tax obligations |
| Support | Requests and messages | Customer support |
| HachiChat assistant | The messages you write, only if you use it | Answer your questions |
| Technical | Server requests, time, IP address in server logs | Security and abuse prevention |
3. Data of online store visitors (on the store's behalf)
- Searches: the words the visitor types, how many results were found, device type and country (approximate, from the browser language or the network infrastructure). The IP address is not stored with searches.
- Clicks, add to cart, wishlist from results and product recommendations.
- Orders that came from search or recommendations: order number, products, amounts, status and payment method. No customer name, address, phone or email. We do not process card details.
- Identifiers: a random visitor ID (cookie
tb_vid, only if the store has turned on personalisation) and, for logged-in customers, a hashed ID that does not reveal who they are, for "recent searches" and personalisation. - Availability alerts ("Notify me when it is back"): email, product or search and size, language. The email is used for one message when the product is back and is deleted automatically within 90 days at the latest. If the visitor also ticks the newsletter (a separate, optional checkbox), the store may add it to its own list. Every email has a cancellation link.
- Google Analytics 4 / Meta Pixel: if the store uses them, the search window sends search, click and add-to-cart events there from the visitor's browser. They go straight to the store's own accounts; we do not receive them. The store can switch this off.
4. Legal basis
Performance of a contract (accounts, service), legal obligation (billing), legitimate interest (security, abuse prevention, improving the service with aggregated data) and consent (functional cookies on the website, newsletter in availability alerts). For store visitors' data, the legal basis is set by the store as the controller.
5. How long we keep data
- Account: while it is active, and billing records for as long as the law requires.
- A store's search statistics: for as long as we work together, for reports and period comparisons; deleted at the store's request or when the cooperation ends.
- Availability alert emails: 90 days at the latest.
- Search window cookies on stores:
tb_attr30 days,tb_vid12 months. - Server logs: for a limited period, for security.
6. Who we share data with
We do not sell data and we do not share it with other customers. The service is hosted on our own servers in the European Union, which also send the emails (account, reports, availability alerts). If a store chooses so, availability alerts are sent from its own mail server.
AI provider: for AI features we use Anthropic (Claude, USA). We send it the text of a search when a complex phrase needs to be understood (without visitor identifiers), and aggregated search data and product titles for reports, questions about your data, newsletter texts and title suggestions. We do not send it customer emails, names or order details. Transfers follow the provider's commercial terms and data processing agreement.
Google (Google Ireland Ltd), only if you accept statistics or advertising cookies on thunderbar.io: Google Analytics and Google Ads measurement. Google may process this data in the USA under the EU-US Data Privacy Framework.
7. Cookies
On thunderbar.io we use necessary cookies. With your consent we also use Google Analytics (statistics: how many people visit and which pages they read) and Google Ads (whether our ads lead to sign-ups), and load the chat assistant. Nothing beyond the necessary is used until you agree, and you can change your choice at any time. In your account we only use necessary cookies. Fonts are served from our own server.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
PHPSESSID | Necessary | Login, language, form security | Until you close the browser |
tb_cc | Necessary | Your cookie choice | 6 months |
| HachiChat (INWEBPRO) | Functional, only with consent | The chat assistant; if you use it, it may keep the conversation in your browser | As set by the assistant |
_ga, _ga_* | Statistics, only with consent | Google Analytics 4: tells visits apart and measures page views | Up to 2 years |
_gcl_au | Advertising, only with consent | Google Ads: measures whether an ad led to a sign-up | 90 days |
On online stores that use ThunderBar, the search window may use the following. Each store lists them in its own cookie policy and can connect them to its own consent banner.
| Name | Purpose | Duration |
|---|---|---|
tb_vid (cookie) | Random ID for personalisation, only if the store has turned it on | 12 months |
tb_attr (cookie) | Which products were opened from search (product code and search word), to measure sales | 30 days |
| sessionStorage | Recent and popular searches, search window settings, avoiding double counts | Until the tab is closed |
8. Your rights
You have the right to access, correct, delete, restrict, port and object, and to withdraw any consent at any time. Email us at info@thunderbar.io and we will reply within one month. You can also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
9. Security
Encrypted connections (HTTPS), hashed passwords, role-based access, request limits and backups. No system is completely secure, so please use a strong, unique password.
10. Changes
When something material changes, we will let you know by email or with a notice on the website.
11. Contact
INWEBPRO (InWebPro Ltd), Ir. Polytechneiou 73A, 124 62 Chaidari, Greece · info@thunderbar.io