Seekmodo

Data Processing Addendum

Effective: 2026-06-20

This DPA forms part of your subscription agreement. Seekmodo is provided by Numinix ("Numinix", "we", "Processor"). It describes how we process personal data on behalf of the customer ("Controller").

1. Subject matter

Processing of catalog documents, search queries, and click events sent through Seekmodo for the purpose of providing search and AI-surfacing services. Where we use anonymous, aggregated query/click signals to train shared cross-tenant relevance models (per §10 below), Numinix acts as Controller for the aggregated dataset; raw, tenant-attributable data is processed strictly as Processor per this DPA.

2. Categories of data subjects

  • End-shoppers visiting the Controller's storefront.
  • Account holders managing the Seekmodo subscription.

3. Categories of personal data

  • Search query strings (may include free-text user input).
  • Pseudonymous session IDs and IP addresses (last 30 days).
  • Account email and bcrypt-hashed password.

4. Sub-processors

We use the following sub-processors. Material changes are communicated 30 days in advance and you may terminate without penalty if you object.

  • PayPal (Holdings) Inc. — subscription billing, Card Fields card-on-file vault, and prepaid-credit top-ups. Card numbers never touch Seekmodo; PayPal tokenises and stores them.
  • Resend, Inc. — outbound transactional email (signup, billing, dunning, account lifecycle) and inbound reply webhooks.
  • Cloudflare, Inc. — DNS, CDN, WAF, and Turnstile bot protection on signup and contact forms.
  • Google LLC — optional Sign in with Google (OAuth) and Google Analytics 4 (EU/EEA/UK/CH visitors only after cookie-banner consent).
  • OpenAI, L.L.C. — AI-assisted triage and draft replies for inbound support tickets (support@ / help.seekmodo.com only; not shopper search traffic).

5. Security measures

See the Security page for the live list. Highlights: TLS 1.3 in transit, AES-256 at rest, HMAC request signing, replay-window enforcement, per-tenant rate limits, and audit logging.

6. Sub-processor agreements

We have signed DPAs in place with each sub-processor that receives personal data on our behalf.

7. Cross-border transfers

Where personal data of EU/UK residents is transferred to the US, we rely on Standard Contractual Clauses (SCCs) executed with the relevant sub-processor.

8. Term & termination

This DPA applies for as long as the subscription agreement is in force, AND for as long as you maintain a Seekmodo account regardless of subscription state (a card-less trial counts; a trial-expired account that continues to ingest counts). On termination of either (subscription cancelled and account deleted), we delete or return personal data within 30 days unless retention is legally required. The 30-day soft-delete window from the Delete-account flow counts toward this period.

9. Contact

Data-protection enquiries: [email protected].

10. Aggregate cross-tenant model training

Seekmodo trains shared relevance models (per-vertical base learning-to-rank, synonym mining, zero-result rescue, abuse pattern libraries, fine-tuned embeddings) on anonymised, aggregated signals derived from tenant query and click traffic. The pipeline strips tenant identifiers, session IDs, and shopper IPs before aggregation. Only the trained model weights and statistical aggregates cross tenant boundaries — never raw, tenant-attributable records. Tenants are opted into this aggregation by acceptance of the Terms of Service; opting out is accomplished by clicking Delete account in /billing, which removes the tenant's signal contributions from any newly-trained models within 24 hours of the close. A per-tenant opt-out toggle that preserves the active subscription is on the product roadmap.