Privacy and GDPR

Vellumine's search analytics are built to tell you what your readers look for without tracking who they are. This page explains what is collected, how long it is kept, and what you need to do as the owner of the blog. The details are in Part B of our Privacy Policy and in our Data Processing Agreement.

What we collect when a reader searches

• The search query. It is converted to lowercase. Email addresses and phone numbers are removed before it is stored. Phone numbers are recognised in international format (starting with + or 00), in national formats that start with 0, and as 10-digit North American numbers written without separators or with dashes or dots (555-123-4567). This is best effort: other numbers, such as national numbers without a leading 0 or + or North American numbers written with spaces or brackets, and other personal data that a reader types into the search are not removed and are stored as typed.
• Which result was clicked and its position in the list.
• The number of results a search returned.
• The reader's country, derived from their connection. We do not store region or city.
• Device type and browser (for example "mobile" and "Safari").
• A daily session identifier that lets us count searches per visit. It is a keyed hash (HMAC-SHA256) of your collection's ID, the IP address and the browser's user agent, with a random secret that changes every day (UTC). Each day's secret is permanently deleted by 02:00 UTC two days later, after at most about 50 hours. The identifier cannot be reversed, and it cannot be used to link a reader's searches across days or across blogs.

What the search analytics never store

• IP addresses
• Full browser user-agent strings
• Cookies or any identifier that follows a reader across days or sites

Vellumine's search analytics never store IP addresses. We use the IP address and user agent only briefly to work out the country, device type, browser and daily session identifier.

The search bar sends the query in the body of the request, never in the URL. The exception is a search link that you share with the query in it (?q= or ?s=): then the query is part of your blog's page address, which your own hosting may log. Our search servers and reverse proxy don't write access logs; if we turn them on briefly to investigate a problem, they're kept for at most 30 days. Requests for the search script and analytics events pass through Cloudflare, which keeps request logs with IP addresses for 30 days. When you open the details of a query in your analytics, the redacted query is part of the request URL, so it also appears in these logs. The details are in the Privacy Policy.

The Vellumine search script does not set cookies in your readers' browsers. The search bar uses the browser's session storage for a short-lived filter cache and local storage only for the analytics opt-out you can set for yourself.

If you enable dynamic search suggestions, your blog's most popular queries (in their redacted form) become publicly visible in your blog's search configuration, which anyone can access.

How long data is kept

Analytics are stored in daily aggregates. When the retention period of your plan ends, they're permanently deleted within 30 days:

Collections without an active subscription use 90 days. If you delete a collection, its analytics are permanently deleted 30 days later. If you delete your account, they're deleted immediately. You can download your analytics first, see Export and Delete Your Data.

Your role and ours

Under the GDPR, you are the controller of your readers' data and Vellumine is your processor. Our Data Processing Agreement is part of our Terms of Service and applies automatically to your account. You don't need to sign anything. If you need a signed copy for your records, email us at chris@vellumine.com.

If your blog was set up through a Vellumine partner, such as your hosting provider, and you don't have a Vellumine account of your own, the partner's agreement with Vellumine applies instead. Please contact the partner about exporting or deleting your data.

What to add to your privacy policy

Because your readers' searches are processed by Vellumine, mention it in your blog's privacy policy. You can adapt this paragraph:

Site search. Our site search is provided by Vellumine (Christoph Emunds, Aichach, Germany). When you use the search, your search query, the result you click, your country, and your device type and browser are processed to deliver results and to give us statistics about what readers search for. Email addresses and many phone numbers are removed from queries before storage; other personal data you type into the search is not removed, so please do not enter personal data in the search. Vellumine's search analytics do not store IP addresses, and the search does not set any cookies in your browser. Vellumine's network provider keeps request logs, which contain IP addresses, for 30 days for security reasons. Vellumine uses hosting and content delivery providers, including Cloudflare (USA, under the EU–US Data Privacy Framework); the full list is in Vellumine's privacy policy. Vellumine processes this data on our behalf under a data processing agreement (Art. 28 GDPR). The legal basis is our legitimate interest in providing a working search and improving our content (Art. 6(1)(f) GDPR). Statistics are kept for your plan's retention period and are then permanently deleted within 30 days. More information: https://vellumine.com/privacy

If you enable dynamic search suggestions, you may also want to mention that popular (redacted) search queries are shown publicly as suggestions.

Members-only content

Vellumine indexes members-only and paid posts in full so they can be found by search. Readers only ever see the excerpt of such posts in search results, never the full text.