Privacy Policy
Last updated: June 4, 2026
Who we are
ShoppingPartnerLab is operated by Langhoor Marchal Consultancy, registered in the Netherlands under KvK 88375692. We provide independent AI-readiness assessments and CSS partner comparisons for European e-commerce.
Contact: privacy@shoppingpartnerlab.com
What we do
ShoppingPartnerLab scans publicly accessible web pages of European e-commerce websites to assess their technical readiness for AI shopping agents. We also maintain the Trust Registry, a public database of AI-readiness scores, and provide CSS partner comparison services.
What data we process
Publicly available website data (no personal data):
- HTML source code of publicly accessible web pages
- HTTP response headers
- Schema.org structured data (JSON-LD)
- robots.txt and sitemap.xml files
- SSL certificate information
- Publicly visible business information (company name, address, VAT number as displayed on the website)
What we do NOT collect:
- Personal data of website visitors or customers
- Transaction data, order histories, or customer databases
- Product pricing beyond what is publicly displayed in structured data
- Login-protected or authenticated content
- Data from pages blocked by robots.txt
User-provided data (only when you register or contact us):
- Email address, name, and company name when you create an account, request a scan, or claim a Trust Badge
- We process this data to provide the requested service
Legal basis
We process publicly available website data under legitimate interest (GDPR Art. 6(1)(f)). Our legitimate interest is providing market transparency and independent verification of e-commerce AI-readiness for the benefit of consumers, AI systems, and the e-commerce ecosystem. This is analogous to how search engines index publicly available web pages, or how Trustpilot publishes reviews of businesses.
We have conducted a Legitimate Interest Assessment (LIA) and concluded that our processing does not override the rights of website operators, as:
- We only process data that is intentionally made public on the open web
- We respect robots.txt directives
- We do not process personal data of individuals
- Website operators can request correction or removal at any time
- Our processing serves the public interest of market transparency
For user-provided data (account registration, badge claims), our legal basis is contract performance (GDPR Art. 6(1)(b)).
Data retention
- Scan results: retained as long as the scanned website is active. Historical scan data is retained for trend analysis.
- Aggregated statistics: retained indefinitely in anonymized form.
- User account data: retained until account deletion is requested.
- Badge claim data: retained as long as the badge is active.
Data sharing
We publish the following data publicly:
- AI-readiness scores per website (overall and per category)
- Trust level classification (exceptional, high, moderate, low, critical)
- Technical signals (schema presence, JS shell detection, platform detection)
- Aggregated statistics per country and sector
We do NOT publish or share:
- Raw HTML source code of scanned websites
- Product pricing data
- Any personal data
Our datasets are published under the Creative Commons BY-NC-ND 4.0 license.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase (AWS eu-central-1) | Database and edge functions | EU (Frankfurt) |
| Cloudflare | CDN, DNS, Workers | EU edge nodes |
| ScrapeGraphAI | Web scraping API | EU |
| Google (Gemini API) | AI model assessment | EU/US (data not stored) |
| Anthropic (Claude API) | AI model assessment | EU/US (data not stored) |
| Perplexity API | AI model assessment | US (data not stored) |
| Resend | Transactional email | EU |
All primary data storage is within the European Economic Area.
Your rights
Under GDPR, you have the right to:
- Access: request what data we hold about your website or account
- Rectification: request correction of inaccurate scores or data
- Erasure: request removal of your website from our registry
- Object: object to the processing of your website data
- Restriction: request that we pause processing
- Portability: receive your data in a machine-readable format
To exercise any of these rights, contact: privacy@shoppingpartnerlab.com
We respond to all requests within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
robots.txt compliance
ShoppingPartnerLab respects robots.txt directives. If your robots.txt blocks our crawler (User-Agent: ShoppingPartnerLabBot), we will not scan your website. You can verify our crawler's behavior by checking your server logs for the ShoppingPartnerLabBot user-agent.
Changes to this policy
We may update this privacy policy from time to time. The "last updated" date at the top indicates the most recent revision. Continued operation of our service after changes constitutes acceptance.
Contact
Privacy inquiries: privacy@shoppingpartnerlab.com
General inquiries: info@shoppingpartnerlab.com
Langhoor Marchal Consultancy. KvK 88375692. The Netherlands
