Data Processing Agreement (DPA) & General Data Protection Regulation (GDPR)

This page answers GDPR-related questions about visitor search data and describes technical data-management capabilities in T3AS.

Save Search History

T3AS allows administrators to control whether visitor search history is stored.

The Save search history option is available under AI Search configuration (Search tab → Settings). It is site-wide (enable_search_history, default on). There is no plugin Flexform override. For this setting, see Save search history.

Backend steps

  1. Open the T3AS / AI Search module.

  2. Click the Search tab.

  3. In Settings, enable or disable Save search history.

When enabled, T3AS can store search-related history such as visitor queries and generated answers.

When disabled:

  • New search queries and answers are not written to the TYPO3 database.

  • Recent-search suggestions are hidden.

  • Thumbs-up/down feedback is hidden.

  • AI Search continues to work (retrieval and answers).

Disabling search history affects newly generated search and feedback data. Existing records are not automatically removed. Use the history cleanup scheduler (or Usage Analytics delete) to remove previously stored records. See History cleanup.

History cleanup

vendor/bin/typo3 t3af:history:cleanup
vendor/bin/typo3 t3af:history:cleanup 30

The first command uses the default retention of 90 days. Passing a number (for example 30) deletes usage history older than that many days.

Data Processing Agreement (DPA) Considerations

Administrators should consider and document:

  • Visitor search data storage (query + AI answer)

  • Data that is not stored (IP, User-Agent, cookies, FE user)

  • Data retention and deletion (t3af:history:cleanup, Usage Analytics)

  • Browser storage (nsT3AsRecentSearches)

  • Data sent to the AI provider (query + RAG context + system instructions)

  • BYOK vs T3Planet Credits — see T3Planet Credits

  • Provider DPA / no model training (not controlled inside the extension)

  • Microphone / Web Speech as a separate processing topic

Data Processing Agreement (DPA) Questions

Question: Does T3AS process frontend visitor information?
Answer: Yes, when a visitor uses AI Search. T3AS can store the search query and AI answer. It does not store visitor IP, User-Agent, cookies, TYPO3 session ID, or frontend-user ID.
Question: Is the complete visitor search query stored in the TYPO3 database?
Answer: Yes — when Save search history is on (the default).

The full search term is saved when a search is completed (up to 255 characters; longer text is cut to fit the field). If Save search history is off, new searches are not written to the database.

Question: Is the complete AI-generated answer stored?
Answer: Yes — when Save search history is on (the default).

The full AI answer is stored as cleaned HTML. Backend lists may show a short preview; the database keeps the complete answer.

Question: What is sent to the AI provider?
Answer: For one frontend search (BYOK):

  • System / site instructions needed to run the feature

  • Relevant retrieved knowledge snippets (RAG / context)

  • The visitor’s search query

A separate embedding call may send the query text to the embedding endpoint.

Not sent in the T3AS / AI Foundation payload: visitor IP, User-Agent, session ID, cookies, page URL as a tracking field, or unique user identifiers generated by T3AS.

Question: Where are results stored?
Answer:

What

Table

Search interactions (query + answer)

tx_nst3as_domain_model_searchhistory

Search widget / plugin settings (not visitor logs)

tx_nst3as_domain_model_settings
Question: Which data is stored for each interaction?
Answer:

Data

Stored?

Note

Search query / prompt

Yes

—

AI-generated response

Yes

Full answer

Requested page / URL

Partly

Knowledge-base / source path — not the visitor’s full browser URL

IP address

No

—

User-Agent

No

—

TYPO3 session ID

No

—

Cookie identifiers

No

—

Frontend user

No

No FE user ID on the search log

Other visitor identifier

Limited

Technical session_id for chatbot-mode follow-ups only when history is on

Identical queries may update count / tstamp on an existing root row instead of always inserting a new row.

Question: Can storage be disabled while AI Search keeps working?
Answer: Yes. Turn Save search history off. Search, retrieval, and AI answers continue. Only visitor history logging (and Recent Search / thumbs) is turned off.

New searches are no longer stored. Already stored rows are not wiped by the switch.

Question: Are there other places that still store the search query?
Answer:

Place

What is stored

Browser local storage (nsT3AsRecentSearches)

Recent search terms (up to 5). With Save search history off, the Recent Search UI is hidden, but writes can still occur in the browser. This is not in the TYPO3 database.

T3AS session_id

Written on the history row only when Save search history is on. Not sent to the AI provider.

T3AS chatbot mode

Follow-ups use the same Save search history switch
Question: How long are records retained?
Answer: Until they are deleted — manually in Usage Analytics, or by t3af:history:cleanup when a Scheduler task is set up. There is no hard expiry on each row by itself.
Question: Logging via AI Foundation?
Answer: Separate from T3AS history. AI Usage stores a SHA-256 prompt fingerprint, tokens, and timing — not the full query or answer. Privacy level can reduce or stop AI Usage rows; it does not stop T3AS history.

See AI Usage & Logs and AI Providers (privacy level).

Question: Extra processors besides the LLM?
Answer: The configured AI Foundation provider (and its embedding endpoint). T3Planet is an additional processor only if Credits is enabled.
Question: What is the difference between BYOK and T3Planet Credits?
Answer:

  • BYOK (default): customer server → configured AI provider. T3Planet is not on this path.

  • Credits (optional): billable calls go via T3Planet. Prompts/inputs may be stored in T3Planet billing records.

Licence activation (ns_license) is separate from the AI search answer path.

See T3Planet Credits.

Question: Microphone / Web Speech?
Answer: The search UI may use the browser Web Speech API. The browser may process audio via third parties. There is no product off-switch today.
Question: MCP?
Answer: If AI Foundation MCP is enabled, T3AS tools can run search and indexing operations through connected clients. That is backend/editor access, not public-visitor processing. Restrict MCP as an access-control topic.

See MCP Server.