What is personal data?
The collection, processing, and storage of personal data, or personal information, is governed by a number of different laws and regulations around the world. Notable examples include the General Data Protection Regulation (GDPR) in the EU, or the California Consumer Privacy Act (CCPA) in the US.
GDPR defines personal data as "any information relating to an identified or identifiable natural person". In other words, at a high level, it covers any data that can be used to directly or indirectly identify a person - for example, a person's name, location, or online identifiers such as IP addresses. CCPA defines personal information as any "information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household". Personal information under the CCPA includes information such as name, email address or IP address.
Does Yext Search capture any personal data?
Yext Search maintains certain records of search queries, which are used to power Analytics reporting on your Search experience. Search records contain the following information:
- Date/Time
- Search query
- Approximate, city-level location (via IP Address lookup)
- User agent
- Results returned
- Clicks and other analytics events (see Cookies and Analytics Tracking in Search)
Out of this information, IP Address and location notably fall within the definition of personal data or personal information. Yext Search has taken specific safeguards in the processing and storage of this data, which are outlined below.
How does Yext Search store IP Address?
All IP addresses are hashed before they are stored.
Hashing at a high level is the transformation of one value into another value through what is called a hash function. For example, an IP address like 192.158.1.38 may get transformed into a value that looks something like 913f7a0a6d20037da47830d30831fdd1. The original IP address cannot be determined from the new hash value.
What this ultimately means is that they may not be traced back to an individual user. Values that are computed from the IP Address - including the user's city, country, and approximate latitude / longitude - are not hashed, but are not precise, as we will discuss below.
What does Yext use IP Address for?
IP Address is captured for several different purposes in Yext Search.
First, it is used to identify bot traffic and to prevent DDOS attacks. This is largely managed by Cloudflare, which is the Content Distribution Network (CDN) used by Yext Search. You can read more about how Yext Search identifies bot traffic here.
Second, it is used to approximate the geolocation of a search. This approximate geolocation is used for analytics reporting - for example, to view the number of searches placed by city or country. It is also sometimes used for queries that require results to be ranked by proximity to the user - for example, if the user searches for "locations near me". We will go into more detail on how this geolocation data is processed below.
Does Yext Search collect precise geolocation data?
Yext Search does not collect or store precise geolocation. Instead, IP addresses are used to calculate an approximate geolocation. This approximate geolocation has a maximum precision at the city level and a typical accuracy of several kilometers at best.
However, when a query is placed that requires more precise geolocation (e.g., if the user searches for "locations near me"), Yext Search will attempt to use HTML5 geolocation, which is more precise but does require the user to explicitly choose (or have chosen) to share location with the page.
When a query like this is placed, if available in the user's browser, the user should see a request like below:
Even when HTML5 geolocation is approved by the user and their precise geolocation is used to respond to a search query, Yext Search will still only retain the approximate, city level geolocation determined by IP Address.
If HTML5 geolocation is not available or the user chooses not to approve the request, then Yext Search will revert to using the approximate geolocation derived from the IP Address. As mentioned above, this is not precise, and hence does not require explicit permission from the user.