Data Processing Agreement (DPA) & General Data Protection Regulation (GDPR)

This page helps you answer data protection (GDPR) questions about AI Search: what is stored, what is sent to the AI service, and how to switch storage off or delete it.

In short

AI Search can store the search question and the AI answer. This is on by default.
It does not store the visitor’s IP address, browser details, cookies or TYPO3 login.
You can switch storage off. Search keeps working.
The question and matching website content are sent to your AI service to write the answer.

Save Search History

Go to AI Universe → AI Chatbot/Search.
Click the Search tab.
In Settings, turn Save search history on or off.
Click Save Configuration.

This setting applies to the whole website. The AI Search plugin has no own switch for it. When it is off:

New questions and answers are not saved.
Recent Search and the thumbs up/down feedback are hidden.
AI Search still works.

Switching it off does not delete what was saved before. Delete old entries in Usage Analytics, or set up the automatic cleanup below.

History cleanup

Old search history can be deleted automatically, for example everything older than 30 or 90 days. Ask your developer to set this up as a Scheduler task (command below), or delete entries by hand in Usage Analytics.

vendor/bin/typo3 t3af:history:cleanup
vendor/bin/typo3 t3af:history:cleanup 30

The first command deletes history older than 90 days (the default). With a number (for example 30) it deletes history older than that many days.

Data Processing Agreement (DPA) Considerations

Write down in your privacy documentation:

that questions and AI answers can be stored, and what is not stored
how long you keep them and how you delete them
that recent searches are kept in the visitor’s browser
what is sent to your AI service (question, matching website content, instructions)
whether you use your own AI key or T3Planet Credits – see T3Planet Credits
your AI service’s own DPA (for example, whether it trains on your data – this is not controlled by the extension)
the microphone / voice input (handled by the visitor’s browser)

Data Processing Agreement (DPA) Questions

All questions and answers (for your data protection officer)

Question	Answer
Does T3AS process frontend visitor information?	Yes, when a visitor uses AI Search. T3AS can store the search query and AI answer. It does not store visitor IP, User-Agent, cookies, TYPO3 session ID, or frontend-user ID.
Is the complete visitor search query stored in the TYPO3 database?	Yes — when Save search history is on (the default). The full search term is saved when a search is completed (up to 255 characters; longer text is cut to fit the field). If Save search history is off, new searches are not written to the database.
Is the complete AI-generated answer stored?	Yes — when Save search history is on (the default). The full AI answer is stored as cleaned HTML. Backend lists may show a short preview; the database keeps the complete answer.
What is sent to the AI provider?	For one frontend search (BYOK): system / site instructions, relevant retrieved knowledge snippets (RAG / context), and the visitor’s search query. A separate embedding call may send the query text to the embedding endpoint. Not sent in the T3AS / AI Foundation payload: visitor IP, User-Agent, session ID, cookies, page URL as a tracking field, or unique user identifiers generated by T3AS.
Where are results stored?	Search interactions (query + answer) → `tx_nst3as_domain_model_searchhistory`. Search widget / plugin settings (not visitor logs) → `tx_nst3as_domain_model_settings`.
Can storage be disabled while AI Search keeps working?	Yes. Turn Save search history off. Search, retrieval, and AI answers continue. Only visitor history logging (and Recent Search / thumbs) is turned off. New searches are no longer stored. Already stored rows are not wiped by the switch.
How long are records retained?	Until they are deleted — manually in Usage Analytics, or by `t3af:history:cleanup` when a Scheduler task is set up. There is no hard expiry on each row by itself.
Logging via AI Foundation?	Separate from T3AS history. AI Usage stores a SHA-256 prompt fingerprint, tokens, and timing — not the full query or answer. Privacy level can reduce or stop AI Usage rows; it does not stop T3AS history. See AI Usage & Logs and AI Providers (privacy level).
Extra processors besides the LLM?	The configured AI Foundation provider (and its embedding endpoint). T3Planet is an additional processor only if Credits is enabled.
What is the difference between BYOK and T3Planet Credits?	BYOK (default): customer server → configured AI provider. T3Planet is not on this path. Credits (optional): billable calls go via T3Planet. Prompts/inputs may be stored in T3Planet billing records. Licence activation (`ns_license`) is separate from the AI search answer path. See T3Planet Credits.
Microphone / Web Speech?	The search UI may use the browser Web Speech API. The browser may process audio via third parties. There is no product off-switch today.
MCP?	If the AI Foundation MCP server is on, backend users can use MCP tools to read and change search settings (`t3as_` tools) and to manage data sources and training (`t3cs_` tools). This is backend access for editors, not processing of visitor data. Limit who may use MCP. See MCP Server.

Which data is stored for each interaction?

Table: stored data per search

Data	Stored?	Note
Search query / prompt	Yes	—
AI-generated response	Yes	Full answer
Requested page / URL	Partly	Knowledge-base / source path — not the visitor’s full browser URL
IP address	No	—
User-Agent	No	—
TYPO3 session ID	No	—
Cookie identifiers	No	—
Frontend user	No	No FE user ID on the search log
Other visitor identifier	Limited	Technical `session_id` for chatbot-mode follow-ups only when history is on

Identical queries may update count / tstamp on an existing root row instead of always inserting a new row.

Are there other places that still store the search query?

Table: other places

Place	What is stored
Browser local storage (`nsT3AsRecentSearches`)	Recent search terms (up to 5). With Save search history off, the Recent Search UI is hidden, but writes can still occur in the browser. This is not in the TYPO3 database.
T3AS `session_id`	Written on the history row only when Save search history is on. Not sent to the AI provider.
T3AS chatbot mode	Follow-ups use the same Save search history switch

Home

Get Started

AI Extensions

Templates & Themes

TYPO3 Extensions

Data Processing Agreement (DPA) & General Data Protection Regulation (GDPR)

In short

Save Search History

History cleanup

Data Processing Agreement (DPA) Considerations

Data Processing Agreement (DPA) Questions

Which data is stored for each interaction?

Are there other places that still store the search query?

​In short

​Save Search History

​History cleanup

​Data Processing Agreement (DPA) Considerations

​Data Processing Agreement (DPA) Questions

​Which data is stored for each interaction?

​Are there other places that still store the search query?

In short

Save Search History

History cleanup

Data Processing Agreement (DPA) Considerations

Data Processing Agreement (DPA) Questions

Which data is stored for each interaction?

Are there other places that still store the search query?