Your details, and what we do with them

Who is responsible

Shop on Radar is run by Przemysław Rakowski, a one-person business registered in Poland at ul. Zachodnia 33 lok. 14, 53-641 Wrocław, tax number NIP 8971888854, REGON 388224842. That business is what data protection law calls the controller: the party answerable for your details. We have not appointed a data protection officer, because the law does not require one of a business like ours.

Write to hello@shoponradar.com, or to the address above, about anything on this page: a copy of what we hold, a correction, or removal. A person reads it, and there is no form to fill in first.

What we collect

When you create an account, subscribe to monitoring, or write to us:

• Your email address, which is also how you sign in.
• If you sign in with Google: your name, your Google account number and a link to your profile picture, which Google passes to us.
• What you tell us about your shop while setting up: its address and name, what it sells and the product pages that matter most, your own brand if you have one, who buys from it and why, where it ships, and a city buyers can visit.
• If you subscribe to monitoring: the country, the buyer questions, the days each is asked and when each was added, changed or removed, the assistants you chose, whether you pay monthly or yearly, when you accepted the terms (and which version of them) and asked us to start, and every check’s answers and what we read on your site. From the payment, the business name, address and email address Stripe passes on to us.
• When you signed in, and the internet address and browser you signed in from, so we can spot somebody else using your account.
• If you write to us on the contact page, with or without an account: the name, email address and message you send.

There is no password

We never ask you to invent one, so there is none for us to lose. You either sign in through Google, or we email you a link that works once and expires fifteen minutes later.

If you sign in through Google, Google tells us only what is listed above. It does not give us access to anything else in your Google account, and we do not ask for any. What Google does with your account is covered by Google’s own privacy policy.

We also look at your shop

Our server reads your shop’s public pages, the same ones any shopper or search engine can open: your home page, the product pages you give us, the pages of your shop the assistants link to, and the files that tell robots what they may read. To show you what ChatGPT’s robot is told, it asks for some of them the way that robot does, and the way an ordinary browser does. We never log in, and never see anything a visitor could not. We keep what we found (whether a page opened, what robots are told, whether a product page carries product data), not copies of the pages.

We put buyer questions about products like yours to the AI assistants your monitoring asks, of ChatGPT, Claude, Gemini and Perplexity, and keep what they answered, word for word. The questions describe the kind of product and buyer, never you, and never contain your name or your email address. No AI reads the answers for us: our own code counts them.

People named in the answers

The assistants’ answers we keep for you, and the shop pages we read, can name other people: the owner of a shop an assistant recommended, a reviewer, or the seller’s details on a shop’s page. We do not look for people, and our questions are about products, not people. We keep the answers word for word as part of the monitoring the shop owner ordered, which is our legitimate interest and theirs (GDPR article 6(1)(f)), for as long as that monitoring’s results are kept. We cannot tell everyone named that we hold an answer mentioning them (GDPR article 14(5)(b)), so we publish this instead. If you are named in an answer and want your name removed, write to hello@shoponradar.com.

Why we may hold it

Each purpose, and what in the law allows it:

• To create your account, sign you in, run your monitoring, and email you the sign-in link, your confirmation, reports, notes and alerts: the contract between us (GDPR article 6(1)(b)).
• To have Stripe take your payment and run your subscription: the contract (article 6(1)(b)). To keep our own accounting records for as long as Polish tax law requires: a legal obligation (article 6(1)(c)).
• To keep your account and our systems safe, by keeping sign-in records and server logs and limiting how often forms can be sent: our legitimate interest in security (article 6(1)(f)).
• To answer what you send from the contact page: our legitimate interest in answering (article 6(1)(f)), or, when you ask about buying, steps you asked for before a contract (article 6(1)(b)).
• To establish or defend legal claims, only if one arises: our legitimate interest (article 6(1)(f)).
• To count visits, and to measure and target our ads: your consent (article 6(1)(a)), which you can take back at any time.

Who else sees it

Nobody who does not have to. We do not sell the list, we do not share it, and we do not hand it to advertisers.

These companies are involved, because they run the machinery underneath:

• Railway (Railway Corporation, USA) hosts this website, the database your account is kept in, and our backups, on servers in Amsterdam, in the European Union. Railway may reach them from the United States to run the service. Its servers note the internet address and browser of each visit, which Railway keeps for 7 days.
• Resend (Plus Five Five, Inc., USA) sends our emails: the sign-in link, your confirmation, reports, notes and alerts. It may handle them in the United States.
• Stripe, who take the payments and run monitoring subscriptions. Through its checkout, Link, Stripe sells you monitoring as the seller of record: it charges you, works out and pays the VAT, sends the invoice and handles refunds, and for that it decides itself how it uses your payment details, under Link’s own privacy policy (link.com/privacy). You give your card and invoice details on Stripe’s own page, and we never see the card number: Stripe tells us the payment went through. Stripe may handle these details in the United States, under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• OpenAI, which makes ChatGPT. We ask its model the buyer questions your monitoring asks ChatGPT, and it helps us write: it drafts your buyer questions from your shop profile, puts questions in another language into English, and, while you set up, reads the text of your home page and delivery page to suggest answers. We never send it your name or your email address, but those two pages may show your business’s contact details if your site shows them. OpenAI Ireland Ltd handles this for us under OpenAI’s data processing addendum, does not use it to train its models, and keeps it for up to 30 days to detect abuse.
• Anthropic, which makes Claude, receives the buyer questions your monitoring asks Claude, and nothing that identifies you. Anthropic Ireland, Limited handles them for us under Anthropic’s data processing addendum, does not use them to train its models, and deletes them within 30 days unless they break its usage policy.
• Google, which makes Gemini, receives the buyer questions your monitoring asks Gemini, and nothing that identifies you, through its paid Gemini API. Google Cloud Poland sp. z o.o. handles them for us under Google’s data processing terms, keeps them for a limited time to create the answer and to detect abuse, and does not use them to train its models.
• Perplexity AI (Perplexity AI, Inc., USA), which makes Perplexity, receives the buyer questions your monitoring asks Perplexity, and nothing that identifies you, through its API. It handles them in the United States under its terms for that API, which say it does not use what customers send through it to train its models.
• Google, if you choose to sign in with it (Google Ireland Limited), which tells us what is listed under “What we collect”.
• Name.com (Name.com, Inc., USA) runs our domain name and passes on the mail sent to hello@shoponradar.com.
• Google Analytics and Meta, only if you agree: see “Counting visits and measuring ads”.

Sending your details outside Europe

Some of the companies above are American or use American service providers, so your details may be handled in the United States. The European Commission has decided that the United States protects personal data adequately when the company receiving it is certified under the EU–US Data Privacy Framework; Railway, Resend, Stripe, Google, Meta and Name.com are. OpenAI and Anthropic are not, so OpenAI Ireland and Anthropic Ireland may pass what they handle for us to OpenAI and Anthropic in the United States under the European Commission’s standard contractual clauses, which are part of their data processing terms. Perplexity AI receives the questions in the United States directly, under the safeguard its terms for its API provide. Write to us for a copy of any of these safeguards.

How long we keep it

• Your account, shop profiles and monitoring results: until you delete them, under Account, or ask us to. Removing a shop deletes its results.
• Sign-in records, with the internet address and browser: until 30 days after the sign-in ends, so at most 60 days.
• Sign-in links: until they expire, fifteen minutes after we send them.
• Counts of how often forms were sent, used to limit them: a day.
• Server logs at Railway: 7 days.
• Backups: one a night, each kept for 14 days, so something you delete is gone from them within 14 days.
• Contact-page messages: a year after they arrive.
• Our accounting records: for as long as Polish tax law says, which is five years from the end of the year they cover.
• The questions we send the assistants’ makers: up to 30 days at OpenAI and Anthropic, a limited time at Google, and at Perplexity AI as long as its terms for its API provide.
• Stripe and Link keep what they need for their own legal duties, as the seller of record, for as long as those require; see link.com/privacy and stripe.com/privacy.
• Google Analytics statistics: 2 months. Meta keeps the pixel’s data for up to two years.
• If we stop running Shop on Radar, we delete the accounts rather than keep them for something else.

What you can ask for

You can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict what we do with it while something is checked, and to give you what you provided in a form you can take elsewhere. You can object at any time to what we do on the basis of our legitimate interests, and we will stop unless we have compelling grounds or need it for a legal claim. You can take back consent at any time; that stops what comes after without making what came before unlawful. One email does any of these, and costs nothing.

If you think we have handled your details badly, you can complain to a data protection authority where you live or work, or in Poland to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

What you have to give us, and what we decide

You need an email address to have an account, because it is how you sign in, and payment details to subscribe, which you give on Stripe’s page. Without them we cannot give you an account or monitoring. Everything else in your shop profile is up to you, though the buyer questions are only as good as what you tell us.

We make no decision about you by automated means. Our code counts how often assistants mention your shop; that measures your shop, and decides nothing about you.

Cookies, and the choice you get

Signing in sets one cookie, which keeps you signed in for up to 30 days while you use the site; signing in with Google sets a second for five minutes, to protect that sign-in. Setting up another shop sets a cookie that lasts until you close the browser. These are needed for the service you asked for, so the law does not ask us to get your consent for them. Your browser also keeps your answer on the banner and, if you use the calculator on our main page and continue, its setup until the next page reads it; neither is sent to us.

The typeface is served from our own server rather than Google’s. That is deliberate: loading a font from someone else would tell them you were here before you had agreed to anything.

What is stored, by whom, and for how long:

• __Secure-better-auth.session_token, set by us: keeps you signed in. 30 days, renewed while you use the site.
• __Secure-better-auth.state, set by us: protects a sign-in with Google. 5 minutes.
• new-shop, set by us: remembers you are setting up another shop. Until you close the browser.
• sor-consent, in your browser’s storage: your answer on the banner. Until you clear it.
• sor:calculator, in your browser’s storage: carries the calculator’s setup to Start monitoring. Removed once read.
• _ga and _ga_ followed by an ID, set by Google Analytics, only if you agree to counting visits: tell visits apart. 2 years.
• _fbp and _fbc, set by Meta, only if you agree to measuring our ads: tell browsers apart, and record the ad you came from. 90 days.

Counting visits and measuring ads

We would like to count visits and to see which of our ads work. The banner asks about the two separately, and neither loads, or sets a cookie, until you agree to it. To say no, choose Settings on the banner and save your choices with both switched off. Say no to both and the site works exactly the same; you will simply not be counted. You can change your mind either way from the Cookie choice link at the bottom of the page, and taking consent back stops what comes after without undoing what came before.

Counting visits (Google Analytics). If you agree, Google Ireland Limited counts visits for us as our processor: which pages you looked at, how far you got through setting up, the price of monitoring if you order it, your browser and device, and roughly where you are, worked out from your internet address, which Google does not store. It never receives your name, your email address or your shop. Google’s advertising features are switched off. Google LLC in the United States may also handle it. How Google uses information from sites that use its services: google.com/policies/privacy/partners.

Measuring and targeting our ads (Meta). If you agree, Meta’s pixel sends Meta your internet address, your browser’s details, the pages you looked at here, and whether you created an account, finished setting up or ordered monitoring, and for how much. It never receives your name, email address or shop. For collecting this on our site and sending it to Meta, we and Meta Platforms Ireland Limited are joint controllers. We have agreed with Meta, in its Controller Addendum, that we give you this information and that Meta answers requests to see, correct, delete or object to the data it holds once it has received it. What Meta does after that it decides alone: it uses the data to measure our ads, to choose who sees them, and for purposes of its own, and may connect it to your Facebook or Instagram account. Meta’s privacy policy, with its contact details, legal bases and how to use your rights, is at facebook.com/privacy/policy. You can also manage ads based on your activity in your Facebook or Instagram settings, or at youronlinechoices.eu.

If this page changes

The date at the top changes with it. If we ever start doing something materially different with your details, we will email you rather than quietly edit this page.