GPSR Storefront Monitor

Technical visibility check for product-safety information on public product pages — desktop and mobile request profiles, field-level evidence, change detection across scheduled runs.

Technical screening only. No legal advice, no certification, no guarantee of legal conformity. OBSERVED explicitly does not mean "GPSR-compliant".

What it does

• Checks one shop origin per run: direct product URLs (up to 500) or bounded sitemap discovery.
• Observes ten fields per product and viewport: manufacturer name / postal / electronic contact, responsible-person name / postal / electronic contact, product identifier, type/description, image, safety warning text.
• Distinguishes VISIBLE, REVEALED, LINK_ONLY, HIDDEN_ONLY, NOT_DETECTED, AMBIGUOUS, NOT_ASSESSED — with text evidence excerpts, selectors and content hashes.
• Compares monitor runs against immutable snapshots in a per-customer named key-value store (REGRESSION / IMPROVEMENT / CONTENT_CHANGED / VISIBILITY_CHANGED), aggregates desktop/mobile differences.
• Writes one dataset row per technically completed product × viewport, plus REPORT.html, SUMMARY.json, ERRORS.json, UNASSESSED.json into the default key-value store. Technical errors are free records, never billable rows.

Quick start

1. Open the Actor, set shopOrigin (exact HTTPS origin, e.g. https://shop.example).
2. Add product URLs or switch to sitemap discovery with path filters.
3. Start. Results appear in the Dataset tab, the report under Key-Value Store → REPORT.html.
4. For repeat checks: set mode=monitor + stable monitorId, save as a Task, attach a Schedule (e.g. weekly). One monitor = one shop/language/config fingerprint.

Examples

Direct URLs (audit):

{
  "mode": "audit",
  "shopOrigin": "https://shop.example",
  "discoveryMode": "urls",
  "productUrls": [{ "url": "https://shop.example/products/arbeitsleuchte", "externalId": "SKU-1001" }],
  "maxProducts": 25,
  "locale": "de-DE",
  "reportLanguage": "de"
}

Sitemap discovery (audit):

{
  "mode": "audit",
  "shopOrigin": "https://shop.example",
  "discoveryMode": "sitemaps",
  "sitemapUrls": ["https://shop.example/sitemap.xml"],
  "productPathIncludes": ["/products/"],
  "maxProducts": 25,
  "locale": "de-DE",
  "reportLanguage": "de"
}

Monitor task (re-run via Schedule):

{
  "mode": "monitor",
  "monitorId": "kunde-produktseiten-de",
  "shopOrigin": "https://shop.example",
  "discoveryMode": "urls",
  "productUrls": [{ "url": "https://shop.example/products/arbeitsleuchte" }],
  "retainedSnapshots": 12,
  "maxRuntimeSecs": 900
}

Rendering engines

• static (default): fast HTTP observation of the served HTML. Cheap, low memory.
• browser: real Chromium with JavaScript rendering, bounded scrolling, safe disclosure clicks (summary/details, button[type=button], labelled tabs — never links, carts, forms or logins) and one compressed viewport screenshot per auffälligem profile (SHOT-<resultId>.jpg in the key-value store, WebP preview embedded in REPORT.html). Fields that appear only after a click are marked REVEALED with the click logged in interactions.
• Browser runs need 4096 MB run memory (memoryMbytes=4096 on the run) and take longer (up to 45 s per product × viewport). Monitor histories are kept strictly separate per engine (different comparison fingerprints).

Billing

Actor is public (mrkrokko~gpsr-storefront-monitor). Planned store price: 0.025 USD per completed product × viewport (25 USD per 1,000 profile checks; desktop + mobile = 2 checks per product). Billed via the native synthetic dataset event — errors, summaries, aliases and unassessed units are never dataset rows. To activate monetization: Apify Console → Actor → Monetize → Pay per event → price the apify-default-dataset-item event at 0.025 USD, then publish to the Store. Measured infra (Sept 2026): static ~0.00032 CU/profile, browser ~0.0016–0.003 CU/profile — re-validate the margin against the current CU rate before pricing (see BENCHMARKS.md).

Storage & retention

• Default dataset: billable profile rows only.
• Default key-value store: REPORT.html, SUMMARY.json, ERRORS.json, UNASSESSED.json, RUN_STATE.json, RESULT-<id>.json checkpoints, EV-<id>.json evidence files, PUBLISH_JOURNAL.json.
• Named monitor store gpsr-v1-<hash>: immutable SNAP-* snapshots + OWNER.json. Keeps the youngest retainedSnapshots plus the last 2 hours. Deleting the named store resets the monitor.
• No developer telemetry, no copies to other accounts. Delete run storages / the monitor store manually to erase data.

Limits

See LIMITATIONS.md (exact supported scope) and SECURITY.md (network boundaries, sandbox). Key points: two rendering engines (static HTTP / Chromium); screenshots only in browser mode; HTTPS-only same-origin checks through a pinned local egress proxy; robots.txt respected; no logins, no carts, no form submissions; linked PDFs referenced but not read.