Privacy for CommerceCleaner

CommerceCleaner is an internal tool for customer inquiries, order matching, tasks and production and shipping follow-up. It is not currently offered as a public SaaS product for other businesses. You do not need a CommerceCleaner account to exercise your rights.

We handle inquiries, match existing orders, follow up outstanding services and commitments and avoid duplicate handling. Replies are prepared for human review. Comment moderation may be included where commissioned for the particular case.

Contractual inquiries and steps before entering a contract at your request rely on Article 6(1)(b) GDPR. Inquiries from people acting for a business, other service inquiries, case organisation, reply preparation and appropriate comment moderation may rely on Article 6(1)(f). Our interest is reliable customer service and traceable handling, subject to your overriding interests.

Compliance with specific legal obligations relies on Article 6(1)(c). Contacting us does not constitute blanket consent to further processing.

Case-related data includes platform and profile identifiers, usernames, message and comment text, conversation references and timestamps. It also includes contact or order information you provide, internal matches, processing status, tasks and reply drafts.

Sources are your direct communications, Instagram or Meta Business Suite and our own email and shop correspondence where needed for the particular case. Permission to read or moderate does not prove that automatic import has occurred. Attachment processing through the social integration is not represented as an existing function.

A message may be compared with existing correspondence or an order where there are reliable indications such as an order number or matching contact details already held. Similar profile names alone are insufficient. Uncertain matches require human review.

This is not a general combination of all social profiles or all customers across our shops.

Customer cases are handled exclusively and personally by the operator, Baris Bayraktar. We use IONOS for the website, all online shops, business mailboxes and server backups. Servers are backed up daily using Acronis through IONOS. Processing by the platform, email and AI services described here is unaffected.

Shop data may come from our shop system. Email correspondence comes from our business mailboxes. We use Outlook on desktop and mobile devices to handle email. Microsoft describes synchronisation of data with Microsoft servers in the mobile Outlook app. CommerceCleaner's local interface therefore does not mean email is processed exclusively on our computer.

The provider of the AI assistance we use is OpenAI Ireland Limited, Ireland (service: ChatGPT). Case-related communications and order information may be sent to this provider. Section 7 explains international processing and the safeguards described by the provider.

Meta operates Instagram, Facebook and Meta Business Suite and also processes platform data for its own purposes under its privacy policy. Meta is therefore not generally described as our processor. Other services' roles depend on their particular service and contractual arrangements.

We use external AI assistance to review customer inquiries, match them to orders and prepare reply text. Case-related communications and order information may be sent to the provider named in section 5. Processing is therefore not limited to the local computer. Draft replies are reviewed and approved by a person before sending.

A separate API integration has been technically prepared. Its existence does not establish current use of that API workflow. The adapter's intended case limits and redactions do not automatically apply to text, images or files used in the AI service. Complete anonymisation is not promised.

The documented API integration does not request storage of the response object for later API retrieval. This does not mean the provider stores no data at all. Security logs, retention of chat histories and separate account settings must be distinguished. Neither exclusively European processing nor complete zero retention is promised.

The operator must review and approve drafts before sending. AI does not grant approval. No solely automated decisions with legal or similarly significant effects under Article 22 GDPR are described. Technical messaging permission does not prove that automatic sending is operational.

Using external AI assistance, Outlook Mobile and Meta involves processing outside our local system. We do not promise exclusively European processing.

The European privacy policy of the AI provider named in section 5 describes processing in the United States, among other countries. Depending on the destination, the provider describes adequacy decisions or standard contractual clauses. Information and copies of applicable safeguards can be requested through the privacy contact linked below.

Microsoft describes international processing for its services, including in the United States. It identifies standard contractual clauses and, for covered transfers, the EU-U.S. Data Privacy Framework among its mechanisms. Details and contact options are provided in the Microsoft Privacy Statement.

For Instagram and Facebook in the EEA, Meta Platforms Ireland Limited is the controller named in the platform privacy policy. Meta describes the EU-U.S. Data Privacy Framework for transfers to Meta Platforms, Inc. in the United States covered by its certification. For other transfers it describes mechanisms including standard contractual clauses. The applicable information and contact options are available in Meta's privacy policy.

These statements describe the mechanisms published by the providers. They do not promise exclusively EU storage or a separate business data processing agreement with us. You can also contact info@signifer.eu with questions about processing of your data.

Purpose, case status and applicable retention obligations determine the assessment. A manual privacy request procedure adopted by the operator applies from 12 November 2026. This is a new organisational rule, not evidence of previously completed or technically tested deletions. No universal fixed period or operational automated deletion process is promised. The following categories need separate consideration.

Local cases, messages, reply drafts and histories are stored persistently. Older working copies and previous-state copies may also exist. Deactivating an earlier draft does not delete it. These records must be included in the case-specific assessment.

• Open cases: necessity for an outstanding inquiry, service, commitment or clarification. Assess any remaining need after closure.
• Business records: retain only records subject to actual commercial, tax or other legal requirements for the applicable period. These requirements do not apply indiscriminately to every social message.
• Raw social data: assess necessity for the specific service case and applicable platform terms. Loss of purpose, removal of permission and deletion requests require separate consideration.
• Working copies, matches and AI drafts: assess their independent need. Deleting a source does not automatically remove a copy.
• Backups: server data is backed up daily using Acronis through IONOS. Backup and working copies are included in the personal assessment of deletion requests. Immediate removal from every backup or a single fixed overwrite period is not promised. Restorations must take account of deletions and restrictions already implemented.

Subject to the relevant legal conditions, you have rights of access, rectification, erasure, restriction, portability and objection. Where a particular processing activity relies on consent, you may withdraw it for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation.

For access, rectification or deletion requests, contact info@signifer.eu or write to the controller at the address above. No CommerceCleaner account is required. Provide only details needed to identify the matter, such as the brand, original contact channel and approximate date. Do not send passwords or access keys. We request additional identity information only where necessary and proportionate in the individual case. The separate deletion instructions explain the procedure and its limits.

You may complain to a data protection authority, particularly where you live, work or suspect an infringement. The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg is a contact for the operator in Reutlingen.