Does Findify Work in China? ICP, PIPL & Offshore Shopper Data

Findify — now operated by Maropost as its Merchandising Cloud — is embedded ecommerce search that runs on offshore clouds across the US, Asia and Europe, with no mainland-China region. The ICP filing falls on the storefront, not on Findify, but every mainland shopper Findify profiles is a cross-border transfer under PIPL. A compliance-first look at both doors.

By the 21YunBox Compliance Team · Reviewed 2026-10-07 · Verified against Findify's own documentation

Does Findify work in China?

Findify — now operated by Maropost as its Merchandising Cloud — is embedded site search that runs on offshore clouds with no mainland-China region, so every mainland shopper it watches sends personal data across the border. The ICP filing lands on the storefront that embeds it, not on Findify; what Findify adds is PIPL cross-border weight.

Maropost markets Merchandising Cloud as "ecommerce site search and merchandising software, available worldwide" whose results come from "ranking and recommending from shopper behavior," and its own compliance page says customer data "is stored in state of the art data centers with co-locations through out the United States, Asia, and Europe," managed by "a 3rd-party cloud hosting services provider" — with no mainland-China location. Because Findify is backend code your storefront calls, the ICP filing stays the storefront's duty; but the mainland shopper data Findify profiles sits offshore, a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43). The table below is Maropost's own wording and the rule each door triggers.

This is a risk map, not a verdict — which obligations bite turns on your entity, your data volumes and who your shoppers are. Our China team can map your exposure with you →

What Findify's own documentation says about China

Fact	Primary source
Findify is now operated by Maropost as its Merchandising Cloud — an embedded search layer your storefront calls. Maropost's own release is headed "Maropost Acquires Findify To Power Next-Generation Ecommerce Shopping Experiences" and describes acquiring an "AI-powered search and product recommendation platform"; it ships today as "ecommerce site search and merchandising software, available worldwide," and the live product's status page still resolves to status.findify.io. Because it is backend code embedded in your site rather than the public host, the ICP filing a mainland site needs (State Council Order No. 292; MIIT Order No. 33) attaches to the storefront, not to Findify.	Maropost — "Maropost Acquires Findify" release & Merchandising Cloud product page (maropost.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33
Findify runs on offshore clouds, with no mainland-China region. Maropost's compliance page states customer data "is stored in state of the art data centers with co-locations through out the United States, Asia, and Europe," and that "Maropost's customer information is managed by a 3rd-party cloud hosting services provider." No mainland-China location is named on that page or in Maropost's subprocessor list. So the mainland shopper data Findify handles is held outside China — a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43).	Maropost Compliance page (maropost.com/compliance), retrieved 2026-10-07; PIPL Articles 38–43
The data stays inside Maropost's offshore regions — none of them in the mainland. Maropost states it "owns or controls access to the infrastructure that hosts real-time and stored personal data," and that "personal data may be shifted among data centers within a region to ensure Maropost's performance and availability." Its subprocessor table lists storage providers in the United States only. For a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore search layer cannot meet.	Maropost Subprocessors page (maropost.com/subprocessors), effective April 1 2021, retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)
What crosses the border is personal information — which is what makes this a PIPL question. Findify produces its results by "ranking and recommending from shopper behavior": the queries a shopper types and the products they click. Maropost's privacy policy describes collecting a visitor's "IP address," using cookies and log files to "create a profile of our users," and keeping their "viewing preferences." For a shopper in mainland China that behavioral profile is personal information, so handing it to Findify's offshore infrastructure is a cross-border transfer the storefront operator must account for under PIPL (Articles 38–43).	Maropost Merchandising Cloud page & Privacy Policy (maropost.com), retrieved 2026-10-07; PIPL Articles 38–43

Sources verified by the 21YunBox compliance team on 2026-10-07.

For a mainland-China storefront, the deciding question about Findify is not how quickly its search box paints — it is whose data it moves and where that data comes to rest. Findify is now operated by Maropost as its Merchandising Cloud, an embedded site-search and recommendation layer that ranks products, in the vendor’s own words, “from shopper behavior.” Maropost runs it on third-party cloud data centers across the United States, Asia and Europe, and names no region inside mainland China. Because Findify is backend code your storefront calls, the ICP filing a public mainland site needs does not fall on Findify — it falls on the storefront. What Findify does add is weight on the other door: every mainland shopper it watches sends personal data out of the country, and that is what China’s law governs.

Maropost Compliance page stating customer data is stored in data centers across the United States, Asia and Europe, managed by a third-party cloud hosting provider, not an ICP-filed presence inside mainland China — Maropost's own Compliance page, which governs the Findify technology it now ships as Merchandising Cloud: customer data “is stored in state of the art data centers with co-locations through out the United States, Asia, and Europe,” and “Maropost's customer information is managed by a 3rd-party cloud hosting services provider” — none of it an ICP-filed presence inside mainland China. Source: maropost.com/compliance

Findify in China at a glance

What decides it	In Maropost's own terms
Where it runs	Embedded search now operated by Maropost as Merchandising Cloud, “available worldwide,” hosted by “a 3rd-party cloud hosting services provider” in data centers “through out the United States, Asia, and Europe.” No region is inside mainland China.
What it handles	Results come from “ranking and recommending from shopper behavior” — the queries a shopper types, the products they click, and a per-user profile. For mainland shoppers that is personal information.
The ICP door	Findify is backend code your storefront calls, not the public host. The ICP filing attaches to the storefront and its mainland hosting, not to Findify — so it is settled one layer up, at your site.
The data door	Mainland shoppers' data handled by Findify sits offshore — a cross-border transfer PIPL governs (Articles 38–43): notice, separate consent and one approved transfer mechanism, owed by the storefront operator.
Data localization	Maropost “owns or controls access to the infrastructure” and shifts data “among data centers within a region” — none in mainland China, so a CIIO or large-volume handler's in-country storage duty (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) cannot be met.

Findify is now Maropost’s Merchandising Cloud — embedded search, hosted offshore

Findify was acquired by Maropost, which now ships the same technology as Merchandising Cloud — “ecommerce site search and merchandising software, available worldwide,” in Maropost’s words, and the live product’s own status page still resolves to status.findify.io. “Available worldwide” describes who can buy it, not where it lawfully operates: Maropost’s compliance page states customer data “is stored in state of the art data centers with co-locations through out the United States, Asia, and Europe,” managed by “a 3rd-party cloud hosting services provider,” and its subprocessor list names storage providers in the United States only. Not one of those locations is in mainland China. So wherever your storefront sits, the Findify layer embedded in it runs offshore.

The ICP door sits on your storefront, not on Findify

Here Findify differs from a host or a cloud region. An ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 attaches to the public-facing website and the mainland hosting resource that serves it. Findify is not that host — it is a script your storefront loads, a backend service behind your pages. So the filing is the storefront operator’s duty, and adding or removing Findify neither creates nor satisfies it. That is the one compliance burden Findify does not place on you. The burden it does place is on the second door, and it is easy to miss precisely because the search box keeps working.

The data door — your mainland shoppers’ behavior leaves China

Findify earns its results by reading people: it ranks and recommends “from shopper behavior,” which means the queries typed, the products clicked, and the identifiers and per-user profile that tie them together. Maropost’s own privacy policy describes collecting a visitor’s “IP address,” using cookies and log files to “create a profile of our users,” and keeping their “viewing preferences.” For a shopper in mainland China, that is personal information, and Findify holds it on infrastructure Maropost places outside the mainland. Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — the storefront operator, not Findify — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). Maropost itself states it “owns or controls access to the infrastructure that hosts real-time and stored personal data” and may shift that data “among data centers within a region” — none of which is a mainland region. If the storefront operator is a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore search layer cannot meet.

This is a risk map, not a verdict: whether separate consent, a transfer mechanism, in-country storage, or all three apply turns on what you collect, how much of it, and who your shoppers are — worth settling with counsel before you ship.

Where 21YunBox fits — a compliant overlay, not a migration

Your storefront keeps calling Findify exactly as it does today. What we add is the piece an offshore search layer cannot carry on its own: compliant, ICP-filed delivery from inside the mainland, set in front of the storefront origin your shoppers load — no rebuild, no second codebase, and no move off Findify or off your commerce platform. Our China team maps the two doors against your entity, your data volumes and your shoppers: the ICP filing the storefront owes, and the PIPL cross-border and residency exposure the shopper data Findify exports creates. Then we stand up the in-country delivery a lawful China presence needs, while Findify stays wired into your pages untouched.

Get a compliance assessment →

Related reading:

Frequently Asked Questions

Does running Findify mean our store needs its own ICP filing?

An ICP filing is required of the public-facing storefront and the mainland hosting that serves it, not of Findify. Findify is backend code your site loads — a search-and-recommendation service behind your pages — so the filing (State Council Order No. 292; MIIT Order No. 33) attaches one layer up, to the storefront. Adding or removing Findify neither creates nor satisfies it. If your storefront serves the mainland public it needs an ICP filing regardless; Findify simply is not the thing that gets filed.

Is it a problem that Findify stores our shoppers' data outside China?

Treat it as a risk to assess with counsel rather than a yes/no. Maropost hosts customer data in offshore data centers across the United States, Asia and Europe, with no mainland-China region, so the behavioral data Findify collects from your Chinese shoppers — queries, clicks, a per-user profile — leaves the country. Under PIPL that is a cross-border transfer requiring notice, separate consent and a transfer mechanism (Articles 38–43), and for a critical information infrastructure operator or large-volume handler it raises a data-localization duty (Article 40; Cybersecurity Law Article 39 (formerly Article 37)) an offshore service cannot meet.

Can 21YunBox help make our Findify-powered store work in China?

Yes. Our China team can map which obligations apply — the ICP filing your storefront owes and the PIPL cross-border and data-residency exposure the shopper data Findify exports creates — for your entity, data volumes and users, and stand up the ICP-filed, in-country delivery a compliant China presence requires, in front of the storefront that already embeds Findify, with no rebuild and no second codebase. Get in touch to work through your specific case.