Privacy Policy
Effective: 1.11.2026
This document explains what personal data we process as a controller, why, and what rights you have (Art. 13 and 14 GDPR). It covers Quomerce customers, members of their teams who use the application, people who visit our websites and people who write to us.
If you visit a shop that uses Quomerce, that shop is the controller of your data, and we process it on the shop’s behalf (section 9).
1. Who is the controller
Quomerce sp. z o.o., registered office in Łódź, ul. Henryka Sienkiewicza 85/87 lok. 1, 90-057 Łódź, KRS 0001251814, NIP 7252368482, REGON 545168861.
For anything about personal data, write to privacy@quomerce.com or to our registered office. We have not appointed a data protection officer, because we are not required to; we handle requests directly.
2. What data, why, and on what legal basis
Customers and application Users
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, password (as a one-way hash), role in the Account, language | Creating and maintaining access to the application, signing in | Contract (Art. 6(1)(b) GDPR) — for the person who enters into it; the Customer’s and our legitimate interest in giving the Customer’s team access (Art. 6(1)(f)) — for other Users |
| Company details: name, tax ID (NIP), address, invoicing e-mail | Billing and invoices | Legal obligation (Art. 6(1)(c)) |
| Websites, settings, notification addresses (e-mail, webhook, Slack) | Providing the Services and sending notifications | Contract (Art. 6(1)(b)) |
| History of actions in the Account (who added a Website, changed a setting or invited a person, and when), sign-in sessions, API and MCP tokens (as hashes), consents given to applications through OAuth | Security, accountability, transparency for the Account owner | Legitimate interest (Art. 6(1)(f)) |
| Number of sign-in attempts per IP address and e-mail | Protection against account takeover | Legitimate interest (Art. 6(1)(f)) |
| Correspondence and requests | Support, complaints | Contract (Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)) |
Providing data is voluntary, but without an e-mail address and password you cannot use the application, and without invoicing details we cannot bill for the Services.
Shop audit
An audit report is about a website, not a person. It may, however, incidentally contain personal data published in the shop (e.g. a name in the footer) — in screenshots and in the recording of our agent’s session. The agent does not record the shop’s customers or staff. The legal basis is the contract with the person who ordered the audit (Art. 6(1)(b)) and our legitimate interest in carrying out the audit (Art. 6(1)(f)). We obtain this data from the shop’s publicly available website (Art. 14 GDPR).
When you buy an audit on quomerce.com, we process invoicing details and payment information (the transaction ID and status from Stripe; never the card number) — to perform the contract and meet our tax obligations (Art. 6(1)(b) and (c)).
Visitors to quomerce.com, app.quomerce.com and docs.quomerce.com
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser, requested addresses (server logs, protection against attacks) | Security and operation of the websites | Legitimate interest (Art. 6(1)(f)) |
| Data on how you use the websites and the application (PostHog, Google Tag Manager) | Statistics and improving the websites | Consent (Art. 6(1)(a)) given in the banner |
| Company name identified from the IP address (Leadsy) | Sales contact with companies interested in Quomerce | Consent (Art. 6(1)(a)) given in the banner |
Details on cookies are in the Cookie Policy.
Contact, booking a demo, marketing
When you write to us or book a demo (Google calendar), we process your contact details and the content of your message to reply and prepare for the call — on the basis of legitimate interest (Art. 6(1)(f)). We send commercial information by e-mail only with your consent (Art. 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej)); you can withdraw it at any time.
3. Who we share data with
- Processors that help us provide the Services (hosting, monitoring, analytics, the audit AI model, translation). The full list, with the place of processing, is on the Subprocessors page.
- Stripe — as a separate controller, when you pay for an audit.
- The Customer in whose Account you are a User: its owner sees your data and the history of your actions in the Account.
- Services you or the Customer choose — Slack, webhooks, applications connected through OAuth or MCP.
- Public authorities, when the law requires it.
We do not sell personal data and do not share it for advertising purposes.
4. Transfers outside the EEA
Our databases are in the EU. Some providers are based in the USA or process data outside the EEA. Such transfers then rely on a European Commission decision finding an adequate level of protection (including the EU-US Data Privacy Framework) or on Standard Contractual Clauses. You can get a copy of the safeguards by writing to privacy@quomerce.com.
5. How long we keep data
| Data | Period |
|---|---|
| User and Account data | For the term of the Agreement; after it ends, 30 days to download the data, then deletion, except data needed to pursue claims — until the limitation period expires |
| Sign-in sessions | 30 days (support sessions — 1 hour) |
| API and MCP tokens | Until expiry (30 days by default, 90 at most) or revocation |
| Invitations | 7 days |
| Uptime check history | 30 days |
| Audit reports, screenshots, agent session recordings | 12 months from delivery, unless you ask for deletion earlier |
| Invoices and accounting records | 5 years from the end of the year in which the tax obligation arose |
| Correspondence | Until the matter is closed, then until the limitation period for claims expires |
| Website analytics data | According to the tool’s settings, no longer than 13 months, or until you withdraw consent |
6. Your rights
You have the right to:
- access your data and get a copy of it,
- rectification of inaccurate data,
- erasure of data, if we no longer need to keep it,
- restriction of processing,
- portability of data processed on the basis of a contract or consent,
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal — you can change your cookie consent with the “Cookie settings” button in the website footer.
Write to privacy@quomerce.com. We will reply within one month. We may ask you to confirm your identity, so that we do not disclose data to someone unauthorised.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl), or with the supervisory authority in the country where you live or work.
7. Automated decisions
We do not make decisions about people based solely on automated processing that produce legal effects concerning them or similarly significantly affect them (Art. 22 GDPR). An audit carried out by an AI agent assesses a website, not a person.
8. Security
Connections are encrypted (TLS), we store passwords as one-way hashes and tokens as hashes, access to data depends on role, and our staff’s access for support purposes is limited in time and logged.
9. If you visit a shop that uses Quomerce
Shops install the Quomerce script to learn how customers use their website, where they abandon purchases and what errors they run into. The shop is the controller of this data, and Quomerce processes it on the shop’s behalf, under a data processing agreement. The shop says so in its privacy policy, and requests about this data should go to the shop. If you write to us, we will pass your request on to the shop.
Good to know: the script does not collect what you type into forms, masks e-mail addresses and phone numbers, does not store your IP address (it is used only to determine the country), and without your consent it stores no identifier on your device and does not record the session. Details are in the documentation and in the Cookie Policy.
10. Changes
We will publish a new version here with a new effective date. We will inform Users of material changes by e-mail or in the application before they take effect.
This policy is available in Polish and English. In case of any discrepancy, the Polish version prevails.