Security and data

A summary of our Privacy Policy and Data Processing Agreement, 17 October 2026.

Where the data lives

On our own servers, in a physically secured data centre in the European Union. Emails (account, reports, availability alerts) are sent from there too, or from your own mail server if you choose so.
If agreed, ThunderBar can run on a server of your own (Custom plan).
All connections are encrypted (HTTPS).

Searches: the words, how many results were found, device type and approximate country.
Clicks, add to cart and wishlist from results and recommendations.
Orders that came from search: order number, products, amounts, status and payment method. No customer name, address, phone or email, and no card details.
Identifiers: a random visitor ID, only if you turn on personalisation, and a hashed ID for logged-in customers that does not reveal who they are.
IP address, for security and abuse prevention only: in full for 7 days, then only the network, deleted after 90 days. It is not shown to stores and not shared.
Emails for "Notify me when it is back", if you turn it on: kept for 90 days at the most.

We do not sell data and we do not share it with our other customers.
Anthropic (Claude, USA), for the AI features: the text of a search when a complex phrase needs to be understood, without visitor identifiers, and aggregated data for reports and texts. No IP addresses, emails, names or order details.
Google Analytics 4 and Meta Pixel, only if your store uses them: the events go from the visitor's browser straight to your own accounts. We do not receive them.
Public IP address registries (e.g. RIPE NCC), only to check a suspicious network: only the network address is sent.
For any new sub-processor of visitor data, we tell you by email at least 30 days in advance.

Roles per store (owner, admin, view only), and staff access only where needed.
Hashed passwords, lockout after failed attempts, rate limits and a log of administrative actions.
Your mail server password is stored encrypted.
Checks for suspicious traffic: a network that inflates searches or clicks can be left out of the statistics, while search keeps working for everyone.
Backups.

For your visitors' data, your store is the controller and INWEBPRO the processor, under the Data Processing Agreement (GDPR Article 28), which you accept when you sign up. A signed copy is available on request.
We inform you of a personal data breach without undue delay, and at the latest within 48 hours.
When the subscription ends, you can download your statistics (CSV) and we delete the store's data within 30 days.