Privacy notice

Last updated 26 September 2026

This notice explains what personal data sameling.com processes, why, and for how long. “We” means the Bulgarian business named in the legal notice, which is the data controller. Write to sameling@it-specials.com about anything in this notice.

In short

Sameling sets no cookies and uses no analytics or behavioural advertising tools. No account is needed.
To stop a free service from being overused, the server counts searches per network address and per browser, for a short time.
Your search terms are sent to AliExpress and OpenAI to produce the results. We do not attach your IP address or browser identifier, but search terms themselves can contain personal data.

What we process, and why

Your network address

Every visit sends your IP address to our server to deliver the page. We also use it to count and limit searches from one network and searches running at the same time, to protect the service from abuse. For these counts we keep the full IPv4 address or the first 64 bits of an IPv6 address. The short-window counts expire about ten minutes after the last counted search; a cleanup runs every minute. The active-search count is removed when the connection closes.

Legal basis: our legitimate interest in protecting the service from abuse and keeping it available (Article 6(1)(f) GDPR).

A random browser identifier

The first time you search, the site stores a random identifier in your browser’s local storage, under the name sameling.clientToken, and sends it with each search. It lets the server count searches per browser, rather than relying only on the network address shared by many users. A separate network limit still applies. The identifier is pseudonymous, not anonymous: it distinguishes your browser even though it contains no name. We use it for search allowances, not advertising or cross-site tracking. Its short-window counts expire about ten minutes after the last counted search. Its daily count is cleared at the end of the day (UTC), checked every minute. Without a valid identifier, daily counting uses the network address instead.

You can delete it by clearing this site’s data in your browser; a new one is created at your next search. It has no automatic expiry in local storage. If your browser does not allow local storage, search still works, and the identifier lasts only until you leave or reload the page.

We use this storage to manage access to the search service and do not ask for consent to it. Our GDPR basis for processing the identifier is the legitimate interest described above. This is separate from the rules on storing information in your browser.

Server logs

When a search reaches one of the limits, the server’s log can record the browser identifier and network address, with the time and which limit it was. Diagnostic and error entries can contain search terms and technical details. We do not deliberately attach your address or identifier to search-term log lines, but entries may be correlated by time and the terms themselves may identify you. Logs rotate by size, not age: older files are deleted as new entries fill the allocation. There is no fixed maximum age for a log entry. The web server has no routine visit log; technical error logs may still contain request information.

Legal basis: our legitimate interest in running the service securely and fixing faults.

Your search terms

What you type into the search box is sent from our server to AliExpress, to find listings, and to OpenAI, whose AI language model groups and compares them. Neither your network address nor the browser identifier is added to these server-to-server requests. We do not maintain a search history, apart from the log entries described above. Please search for products only: do not include names, contact details, health information or other personal information. Search text is not automatically anonymised before it is sent.

If a search does contain personal data, the legal basis is our legitimate interest in providing the search you asked for.

You are not required by law or contract to provide search terms or contact details. We need a query to run a search, and your IP address is necessary to communicate with your browser. You can read these pages without searching. Blocking local storage does not prevent searching.

When you contact us

If you email us, we process your email address, any name you provide, your message and our replies to answer you and handle complaints. Our email service providers process the correspondence to deliver and store it. Please send only information needed for your request, not passwords or payment details.

Our basis is our legitimate interest in answering enquiries and resolving complaints. Where we must handle a data-protection request or meet another legal obligation, Article 6(1)(c) GDPR applies instead. Correspondence is kept for handling the enquiry and any follow-up dispute; any further retention must be necessary for applicable legal record-keeping duties or establishing, exercising or defending legal claims.

Product images and links to AliExpress

Product images in the results are loaded directly from the image addresses supplied with AliExpress listings. AliExpress or the relevant image-hosting provider receives your IP address and browser request information. Our legitimate interest is displaying the listings you asked to see. We tell your browser not to send the address of the Sameling page. This does not make the image request anonymous or control the recipient’s use of cookies or other identifiers.

When you follow a listing link, AliExpress processes your visit under its own privacy policy, including its cookies and any association with your AliExpress account. Sameling supplies an affiliate tracking ID for commission attribution, not a visitor-specific ID. That does not make the link or the visit anonymous. See the affiliate disclosure.

Who receives data

Hostinger hosts our server in its Lithuania data centre, within the EU, and processes server data on our behalf.
OpenAI receives search terms, and the listing details from AliExpress, to group and compare listings.
AliExpress receives search terms from our server, and your network address from your browser when it loads images hosted by AliExpress or when you follow a link. Other image hosts receive the requests for the images they serve.
Our email service providers receive correspondence when you contact us.

We do not sell personal data. We may also disclose information where required by law or necessary for legal claims.

International processing and providers’ policies

Hosting our server in Lithuania does not mean all processing stays in the European Economic Area (EEA). OpenAI and AliExpress operate internationally, and search terms and other data they receive may be processed outside the EEA, including in the United States. Omitting your IP address from a search request does not remove personal information you put in the query.

OpenAI’s published API policy provides for abuse-monitoring retention of up to 30 days by default, with exceptions for legal and safety needs. Its default is not to train models on API data unless the customer opts in. These are OpenAI’s published defaults, not a promise of zero retention. See OpenAI API data controls. AliExpress describes its processing, retention and transfers in its privacy policy. Contact sameling@it-specials.com for information about the transfer safeguards applicable to your data and how to obtain a copy. The retention periods below describe Sameling, not these providers.

How long we keep it

Short-window network and browser counts: about ten minutes after the last counted search.
Daily counts per browser (or network when no valid identifier is sent): until the UTC day changes.
The identifier in your browser: until you or your browser clear this site’s data; no automatic expiry.
Server logs: until size-based rotation removes them; low traffic can leave older entries for longer.
Correspondence: for the enquiry, follow-up and legal purposes described above.

Restarting the server clears per-caller counts in memory, not the logs. The separate daily search-budget file holds only a date and total count, without caller identifiers; it survives restarts. This is in addition to the logs described above.

Your rights

You have the right to ask for access to your personal data, and for it to be corrected or erased; to ask us to restrict its use, subject to the conditions in the GDPR. Data portability applies where processing is automated and based on consent or a contract; it does not apply to processing based only on legitimate interests. Write to sameling@it-specials.com to exercise your rights.

We respond without undue delay and within one month. For complex or numerous requests, the GDPR allows up to two further months; we will explain any extension within the first month. Requests are normally free of charge. If we cannot act on a request, we will explain why and tell you how to complain or seek a judicial remedy.

We may need limited additional information to locate your data or confirm your identity. An approximate time and, if relevant, the browser identifier may help; an IP address alone is not proof of identity. Please do not send identity documents unless we explain why they are necessary. We do not collect extra identifiers just to identify visitors for rights requests, and cannot recover data already deleted.

Your right to object

You can object at any time to processing based on legitimate interests, for reasons relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need it for legal claims. Contact sameling@it-specials.com.

You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you think the problem happened. In Bulgaria, that is the Commission for Personal Data Protection (cpdp.bg).

Automated processing

AI groups and compares products; it does not assess you. Search limits automatically count requests and can temporarily refuse further searches. We do not build advertising profiles or make solely automated decisions producing legal or similarly significant effects on you within Article 22 GDPR. Contact us if you believe a search limit has been applied incorrectly.

Changes

If what we do with data changes, we will update this notice and the date at the top.