Privacy Policy
Draft for legal review. Company details are filled in from the site configuration. Prepared against GDPR Articles 12–14 and the EDPB transparency guidelines.
Effective 25 October 2026.
1. Who we are
The controller for the processing described here is [не задано: legalName] ("AACSearch", "we"), [не задано: address], e-mail privacy@aacsearch.com. EU representative under Art. 27 GDPR: [не задано: euRepresentative].
This policy covers our website, accounts, billing, support and marketing. When our customers use AACSearch to search or recommend on their websites, the customer is the controller of their visitors' data and we act as a processor under our Data Processing Agreement; see section 9.
2. What we process, why, and on what legal basis
| Purpose | Data | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Create and run your account | name, e-mail, password hash, organisation, role | contract (6(1)(b)) | account lifetime + 3 years |
| Provide the service and support | API usage, logs, support messages | contract (6(1)(b)) | logs 90 days; tickets 3 years |
| Billing, invoices, tax | billing contact, company details, payment status (no full card numbers) | legal obligation (6(1)(c)), contract | as tax law requires (up to 10 years) |
| Security and abuse prevention | IP address, request metadata | legitimate interest (6(1)(f)) — protecting the service | 90 days |
| Product analytics on our website | cookie identifiers, pages, device data | consent (6(1)(a)) | up to 13 months |
| Newsletter | consent (6(1)(a)) | until you unsubscribe | |
| Service and legal notices | contract / legal obligation | account lifetime |
Providing account and billing data is necessary to conclude the contract; without it we cannot provide the service. Everything based on consent is optional.
3. Automated decisions and profiling
We do not make decisions with legal or similarly significant effects based solely on automated processing (Art. 22). Personalised ranking and recommendations inside customers' sites run as a processor service on the customer's instructions.
4. Recipients
We share data with service providers who process it on our behalf under Art. 28 contracts (hosting, e-mail delivery, payment processing, error monitoring) — listed with location and transfer safeguard on our Sub-processors page — and with authorities where the law requires it. We do not sell personal data.
5. International transfers
Where data leaves the EEA we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified US recipients) or on the Standard Contractual Clauses (Decision (EU) 2021/914) with supplementary measures. A copy of the safeguards is available from privacy@aacsearch.com.
6. Your rights
You have the right to access, rectify, erase, restrict, object to processing and to data portability (Arts. 15–21), and to withdraw consent at any time without affecting earlier processing (Art. 7(3)). Write to privacy@aacsearch.com; we answer within one month (Art. 12(3)).
You may lodge a complaint with a supervisory authority, in particular in your country of residence, work or of the alleged infringement (Art. 77).
7. Cookies
See the Cookie Policy. Non-essential cookies are set only after you accept them, and you can change your choice at any time.
8. Security
Encryption in transit (TLS), hashed API keys and passwords, role-based access, audit logging and per-tenant isolation; details in the technical and organisational measures annex to the DPA and on the Security page.
9. Data we process for our customers
Search queries, click events and documents sent to AACSearch by a customer's website are processed on that customer's behalf. Questions about that data should go to the customer; we will forward requests we receive. The customer's own privacy notice must describe the search widget and assistant — suggested wording is in the DPA.
10. Changes
We will post changes here with a new effective date and notify account holders of material changes by e-mail.