Saleor
Saleor is an open source headless e commerce platform developed in Poland by Saleor Commerce. It exposes a GraphQL API used by custom storefronts and apps. Saleor itself is privacy friendly: it stores order and customer data on the operator infrastructure and does not include third party trackers by default. The compliance footprint depends on the chosen hosting region (Saleor Cloud EU or US) and on the tracking pixels that operators add to their custom storefront.
What does Saleor do?
What is Saleor
Saleor is an open source headless e commerce platform developed by Saleor Commerce sp. z o.o., based in Wroclaw, Poland. It is written in Python (Django, GraphQL) and is used by retailers and DTC brands across Europe and the Americas. Saleor exposes a GraphQL API that can be consumed by any storefront framework: Next.js, Astro, mobile apps, point of sale terminals or marketplaces. It is available both as Saleor Core (self hosted, MIT licensed) and as Saleor Cloud, a managed offering with EU and US regions.
What data does Saleor process
Saleor processes the data a typical e commerce backend needs: customer accounts (email, name, address, phone), order history, baskets, payment statuses, refunds, vouchers and loyalty rewards. It logs IP addresses and user agents for fraud prevention and stores admin user accounts for staff. The platform does not ship with marketing analytics, advertising pixels or third party trackers; any such tracking is added by the storefront developer.
GDPR and ePrivacy implications
Saleor falls under standard GDPR rules for e commerce: lawfulness of processing, data minimisation, security, retention and data subject rights. Strictly necessary cookies for cart, login and checkout are exempt from consent under Art. 5(3) of the ePrivacy Directive. Any optional cookies added by the storefront (analytics, retargeting, A/B testing) require prior consent and must be blocked until the visitor accepts.
Consent requirements
The Saleor core platform does not require visitor consent for its own operation. Consent obligations stem from the front end stack: analytics tags, marketing pixels, third party search and personalisation widgets. Implementing a Consent Management Platform that blocks these scripts by default is the cleanest way to keep the storefront compliant with GDPR and ePrivacy across all EU member states.
Data transfers outside the EU
When Saleor is self hosted in the EU or deployed in a Saleor Cloud EU region, no transfer outside the EU is required. Saleor Cloud US regions involve a transfer to the United States, which currently relies on the EU US Data Privacy Framework or Standard Contractual Clauses. The deployment region must be documented in the Article 30 register and disclosed in the privacy notice.
Practical compliance steps
Choose an EU region for Saleor Cloud or self host inside the EU, sign the Saleor DPA, harden Saleor admin access with MFA and IP restrictions, enable detailed audit logs, and configure retention rules for inactive customers. On the storefront side, integrate a CMP that blocks every non essential tag, document each Saleor App that adds external processors, and review payment processors and shipping carriers in your privacy notice.
Saleor and the GDPR
- Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR) for order processing, account management and shipping. Legitimate interest (Art. 6(1)(f)) for fraud prevention and security. Consent (Art. 6(1)(a)) applies only to optional tracking, analytics or marketing layered on top of the storefront.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive, TDDDG, LSSI CE, Polish Personal Data Protection Act, ENISA security guidelines for e commerce
Impact assessment (DPIA)
A DPIA is not generally required for Saleor itself when used for standard order processing. A DPIA becomes appropriate when the storefront layered on Saleor implements large scale behavioural tracking, scoring or profiling, or when sensitive product categories are sold.
Sample text for your banner
This online store is powered by Saleor, an open source e commerce engine. Strictly necessary cookies are used to manage your cart, your account and your checkout. Optional cookies for analytics, advertising or personalization are only set after you give your consent.
What Saleor sets and contacts
- Tracking method
- Headless e commerce backend exposing a GraphQL API. The platform itself does not set tracking cookies on shopper browsers by default; tracking is implemented in the front end storefront that integrates with the API. Session cookies are used for the admin dashboard and for cart persistence when a server side checkout is built.
- Server location
- Self hosted on the operator infrastructure when using Saleor Core (open source). Saleor Cloud is operated by Saleor Commerce sp. z o.o. in Wroclaw, Poland, with regional deployments in the EU and in the US on cloud providers including AWS and Google Cloud.
- Cookieless mode available
- Yes
Cookies set (6)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| refreshToken | http_only_cookie | 30 days (configurable, JWT refresh token lifetime) | Strictly necessary. Stores the JWT refresh token issued by Saleor so the user stays authenticated and can request new access tokens without re entering credentials. |
| csrfToken | first_party_cookie | Session (paired with refreshToken) | Strictly necessary. CSRF protection token required by Saleor when refreshing tokens via cookie based flows. Prevents cross site request forgery on the tokenRefresh mutation. |
| accessToken | memory_or_first_party_cookie | 5 to 15 minutes (JWT access token lifetime) | Strictly necessary. Short lived JWT access token sent in the Authorization header to call the Saleor GraphQL API. Often kept in memory, optionally in a first party cookie. |
| checkoutToken | first_party_cookie_or_localStorage | Up to 30 days or until checkout completes | Strictly necessary. Stores the identifier of the current checkout / cart so the basket persists across page reloads and devices for logged in users. |
| locale | first_party_cookie | 1 year | Functional. Remembers the language and currency selected by the visitor on the Saleor storefront. Considered strictly necessary when explicitly chosen by the user. |
| saleor_app_session | first_party_cookie | Session | Strictly necessary. Used by the Saleor Dashboard and installed Saleor Apps for authenticated admin sessions. |
Third-party domains contacted (5)
saleor.iocloud.saleor.ioapi.saleor.ioeu.saleor.cloudus.saleor.cloud
Frequently asked questions about Saleor
Can't find your question? Write to us, we answer fast.
Which cookies does Saleor set by default?
Saleor Core only sets strictly necessary cookies for the admin dashboard (authentication session, CSRF token) and, when using the server side cart, a cart identifier. The platform does not include analytics or advertising cookies; any such cookies are added by the storefront layer that consumes the GraphQL API.
Is consent required to operate Saleor on a European storefront?
No consent is required for the strictly necessary cookies used by Saleor itself: cart persistence, authentication and security tokens fall under the exemption in Art. 5(3) of the ePrivacy Directive. Consent is required for any additional analytics, marketing or personalization scripts added to the storefront.
What is the legal basis for storing customer data in Saleor?
Performance of a contract (Art. 6(1)(b) GDPR) for order processing and account management, legitimate interest (Art. 6(1)(f)) for security, fraud prevention and audit, and consent (Art. 6(1)(a)) for any marketing communication or behavioural profiling layered on top of the core platform.
Does Saleor transfer data outside the European Union?
Self hosted Saleor stays in the region you deploy it to. Saleor Cloud EU regions keep data in the EU. Saleor Cloud US regions transfer data to the United States under the EU US Data Privacy Framework or Standard Contractual Clauses. Choose your region according to the data residency requirements of your business.
Is a DPIA required when launching a Saleor based shop?
A DPIA is not generally required for a standard online shop built on Saleor. It becomes necessary when the storefront introduces large scale behavioural tracking, scoring, sensitive product categories (health, political opinions) or automated decision making that significantly affects customers.
How do I implement Saleor in a GDPR compliant way?
Deploy Saleor in the EU, configure retention rules for inactive customers, restrict admin access with MFA and IP allow lists, sign a Data Processing Agreement with Saleor for Cloud deployments, document Saleor in your Article 30 register, and use a Consent Management Platform on the storefront for any optional tag.
Are there alternative open source e commerce platforms based in Europe?
Yes. Sylius (France) and CoreShop (Austria) are mature open source platforms with strong European communities. Shopware (Germany) and PrestaShop (France) are popular open source choices. Spryker (Germany) targets B2B enterprises. All of them allow EU only hosting and reduce the burden of international data transfers.
How do I update my cookie policy when launching a Saleor storefront?
List each strictly necessary cookie used by Saleor (session, CSRF, cart) along with each optional cookie added by your front end (analytics, advertising, personalization). Indicate retention, processor and purpose. Re trigger the consent banner whenever a new third party integration is added through a Saleor App.
Harness
Harness is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Harness integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Harness helps organizations maintain robust websites that meet user expectations and technical requirements.
Front-Commerce
Front-Commerce is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, Front-Commerce delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.
Gomag
Gomag is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Gomag supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Gomag ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Kueski Pay
KueskiPay is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. KueskiPay supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, KueskiPay ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Yampi Virtual store
Yampi Virtual store offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Yampi Virtual store integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for.
Shopaholic
Shopaholic is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Shopaholic supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Shopaholic ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.