Privacy and data security policy

This policy explains what data the Findora Cloud service (findora.tech, my.findora.tech and the search service on our customers' stores) processes, why, for how long and how we protect it.

1. Who we are

CLOUDON I.K.E. (CLOUDON Private Company), VAT EL998107371, Peloponnisou 13, 15341 Agia Paraskevi, Athens, Greece, tel. +30 210 7222560, email findorasupport@cloudon.gr.

For the data of our customers (the stores that buy a subscription) and of findora.tech visitors, we are the controller.
For the data of store visitors who use Findora search, we act as processor on behalf of each store, following its instructions and the data processing agreement (DPA), available on request.

2. What data we process

Customers (stores) and users of the my.findora.tech portal

Company and billing details: legal name, VAT number, tax office, address, billing email, phone, contact person.
Portal users: name, email, role, hashed password and two-step verification data.
Payments: amount, date, status and card type/last 4 digits. Card details never pass through us: they are processed directly by the payment provider (Revolut).
Support requests (including any attachments you upload, e.g. screenshots, and the state of your installation at the time of the request) and a log of portal actions (with IP address), to help you, and for security and traceability. They are kept while the account exists and deleted together with the store.
A history of logins and security changes on your account (login, failed login, logout, password, email or 2FA change), with IP address and browser, so you can see where you are logged in and we can alert you to logins from a new device. It is deleted automatically after 180 days.
Contact details you optionally add to your account (job title, phone, mobile, preferred contact method and hours) and your choice of which emails you receive; used only to serve you and deleted together with your account.
The store's product catalogue (Findora Feed): names, prices, availability, categories, images. It contains no personal data.

Store visitors (through the search script)

Search terms, clicks, add-to-cart events and purchases that came from search, with an anonymous session identifier and device type, for the store's reports.
We do not collect visitors' names, emails, addresses or payment details. The IP address is used only to protect against abuse (rate limits) and is not stored with searches.
Features such as "Recent searches", "Recently viewed" and the shopping assistant's conversation "History" are stored only in the visitor's browser (the assistant history is cleared when the tab is closed).
AI assistant (only if the store enables it): the text of questions and the product data are sent to Anthropic's Claude model to produce the answer. The conversation is kept on our servers for one hour so it can continue, and answers to common questions are cached for up to 24 hours for speed. In addition, the text of the visitor's questions is stored for the store's reports ("Customer questions"), and the assistant's answers, together with the question and the visitor's 👍/👎 (if given), are kept for 90 days to check and improve the quality of the answers, without IP addresses or other identifying data; emails, phone numbers and long numbers (e.g. social security, tax or IBAN numbers) are removed automatically before storage. No identifying visitor data is sent to the model. We recommend that visitors do not type personal health details into the assistant.
"Notify me" (only if the store enables it): when a visitor asks to be notified about an out-of-stock product, we keep their email, with their explicit consent, only to send one email when the product is back (in the store's name) or to hand it to the store if the store sends the notice itself. The email is deleted as soon as the notice is sent or, otherwise, after 90 days; the visitor can cancel at once. Our sending logs keep only the domain (e.g. "***@gmail.com").
Google Analytics 4 (only if the store provides its Measurement ID): the script sends search events (search term, click on a result) to the Google Analytics the store already runs on its page. We do not load our own Google Analytics or set cookies; the store's cookie consent applies, and the store is the controller of that data.
AI search (semantic and photo search, only if the store enables it): the text of a natural-language question, or the photo the visitor chooses (first reduced on their device), is sent to Anthropic's Claude model to find the relevant products. The photo is not stored, neither by us nor by the store; we only keep the resulting search terms (for 30 days, without visitor data). Please do not photograph faces or documents.

findora.tech visitors

"Request a demo" form: name, email, company, phone, website, message, IP address and browser (for spam protection).
Visit analytics with Microsoft Clarity (cookieless unless you accept cookies) and, only with your consent, with Google Analytics (see Cookies).

3. Why we process it (legal basis)

Performance of the contract: providing the service, account, billing, support.
Legal obligation: issuing invoices and keeping tax records.
Consent: Google Analytics and Microsoft Clarity analytics cookies on findora.tech; you can withdraw it at any time from "Cookie settings".
Legitimate interest: security, abuse prevention, improving the service and website, answering demo requests.
For store visitors' data: the store's instructions, as controller.

4. How long we keep it

Searches, clicks and events for reports: 13 months, then deleted automatically.
Technical request logs: 90 days.
AI assistant conversations: 1 hour (anonymous answers to common questions: 24 hours).
Text of questions to the AI assistant (without identifying data), for the store's reports: 13 months, then deleted automatically.
Visitor emails for "Notify me": until the notice is sent, at most 90 days.
Account data: for the duration of the subscription. After it ends, the store's data is permanently deleted at your request, after we give you an export if you ask for one.
Payments and invoices: as required by tax law.

5. Where it is hosted and who we work with

The service is hosted on servers in the European Union (Hetzner Online GmbH, Germany). Partners that process data on our behalf:

Partner	Role
Hetzner Online GmbH (Germany)	Server hosting and encrypted backups, in the EU
Cloudflare, Inc.	Content delivery network and attack protection
Revolut	Card payments, when you choose to pay through Revolut
Anthropic PBC	AI model for the shopping assistant, AI search and product classification (product and question texts; product photos, not stored)
Microsoft Corporation	Clarity, findora.tech analytics (cookieless unless you accept cookies)
Google Ireland Ltd	Google Analytics, findora.tech traffic statistics, only with your consent

Any transfer outside the EU takes place with the appropriate GDPR safeguards (e.g. standard contractual clauses). We do not sell data or share it for advertising.

6. How we protect data

Encryption on every connection (HTTPS/TLS 1.2+), with Cloudflare protection against attacks and bots.
Passwords stored only as hashes. Mandatory two-step verification for administrators.
Keys and secrets encrypted in the database. Per-user roles and permissions, with a full action log.
Servers reachable only with SSH keys from specific addresses, firewall and automatic security updates.
Each service in its own isolated container, with rate limits per store and per IP address.
Daily encrypted backups in the EU.
The search script never breaks a store: if the service does not respond, the store's own search works as before.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Send your request to findorasupport@cloudon.gr and we will reply within one month. Store visitors should first contact the store, and we will help it respond.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

8. Changes

If something material changes, we will inform our customers by email and update the date at the top of this page.