Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Typesense is an open source, fast typo tolerant search engine designed as a simpler alternative to Elasticsearch and Algolia.
Typesense is an open source, fast and typo tolerant search engine. It is designed as a simpler alternative to Elasticsearch and a self hostable alternative to Algolia. The codebase is published under the GPLv3, and Typesense Inc. operates Typesense Cloud, a managed offering with EU and US regions.
Like every search engine Typesense indexes whatever you give it. In typical e commerce or content use, that is product names, descriptions, prices and categories: no personal data. In SaaS and CRM use the index may hold names, emails, account identifiers and tags. The Typesense server logs IP addresses, the query string and timestamps in its access log. The Search Delivery Network adds CDN level logs on top.
The IP address and the query string are personal data under the GDPR. The activity is strictly necessary for delivering search, so legitimate interest typically applies and no consent is required. Article 5(3) ePrivacy is triggered only if you set browser cookies (analytics, A/B testing) on top of Typesense, which the core product does not do by default.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Legitimate interest covers the strictly necessary search functionality. Contract performance applies when Typesense backs the search of a paid product. If you log queries for product improvement, document it as a separate purpose with shorter retention, and exclude queries that reveal sensitive intent (medical, legal, sexual).
Self hosting Typesense in EU datacenters keeps every byte in the EU. Typesense Cloud lets you choose Frankfurt, Paris, Dublin or other EU regions; pick one to keep search data in the EU at rest. Typesense Inc. is US headquartered, so support may access the cluster from the US under the EU US Data Privacy Framework. Verify the current certification status before signing.
Pick an EU region (or self host in the EU). Set short retention on access logs and query logs. Pseudonymise user identifiers in indexed records. Use the Typesense scoped API keys to prevent the public site from accessing personal data fields. Document Typesense as a sub processor in your records of processing activities.
Websites using Typesense must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when Typesense indexes large catalogues of personal data, when search queries themselves reveal sensitive intent (health, legal, sexuality), or when query logs are reused for marketing or behavioural profiling.
Sample consent text
No consent is required for the underlying search functionality. We use Typesense to provide fast search; no tracking cookies are set, only the typed query, the IP address and a fingerprint are processed for relevance and rate limiting.
Third-party domains contacted
typesense.orga1.typesense.netcloud.typesense.orgTypesense collects user analytics data — you legally need a consent banner. Try FlowConsent free.
By default no. Typesense exposes a JSON API; cookies on the user device come from your application or framework, not from Typesense.
No. The search activity is strictly necessary for the page experience, so legitimate interest applies without consent. Consent is only required if you add tracking on top of search results.
Legitimate interest for the search functionality, contract performance when Typesense backs a paid product, with a separate purpose for query logging used for improvement.
Self hosting in the EU avoids transfers. Typesense Cloud offers EU regions; data at rest stays in the EU. Typesense Inc. is US headquartered, so support access may trigger transfer rules covered by the EU US Data Privacy Framework.
Recommended when Typesense indexes large catalogues of personal data, when queries reveal sensitive intent, or when query logs feed marketing.
Pick an EU region or self host in the EU, set short retention on logs, pseudonymise identifiers, use scoped API keys for the public client, restrict admin access, and document Typesense in your records of processing activities.
Meilisearch (France, also open source), OpenSearch, Apache Solr, Algolia (managed, US), Elasticsearch and self hosted Vespa.
Typesense generally does not need to appear in the cookie policy. Cover it in the privacy policy and disclose Typesense Inc. as a sub processor if you use Typesense Cloud.