Privacy Policy

01Who we are

ZUREQ Labs (“ZUREQ”, “we”, “us”) is the controller of the personal data described in this policy, except where we process data on behalf of a store, which section 11 explains.

We have not appointed a data protection officer. For anything about your personal data, write to [email protected]. We answer every request within one month.

02If you use the ZUREQ chat

When you ask the chat for something, we process:

• What you send and what the chat answers: your messages, photos you send for photo search, and voice when you talk to ZUREQ by voice. We need this to search for products and reply (legal basis: performing our contract with you, Art. 6(1)(b) GDPR).
• Your account, if you create one: email address, name if you give it, a hash of your password (never the password itself) or the identifier of your Google or GitHub sign-in, your chosen country, and the delivery addresses and parcel lockers you save. With an account we also keep your conversation history so you can come back to it (Art. 6(1)(b)).
• What you buy: the products, the store, the amount, the order status, and the contact and delivery details you enter at checkout (for example name, email, phone number, address or parcel locker). We pass these details to the store so it can take and deliver your order (Art. 6(1)(b)).
• If you use the chat without an account: a signed cookie that ties your visit to your guest session and conversation, and your IP address, which we use to apply the hourly limits for guests. Our legitimate interest is keeping the Services available and preventing abuse (Art. 6(1)(f)).
• Your approximate country, read from the country code our network provider attaches to your connection. We use it only to suggest a market in the country picker; the choice is yours.

03If you build with the ZUREQ API or MCP server

• Your developer account: email address, name if you give it, and sign-in data (Art. 6(1)(b)).
• Your API keys. We store only a one-way hash of each key and a short prefix so you can tell keys apart. We cannot recover a lost key.
• Usage records for every call: the tool used, the time, response time, the credits charged and the request parameters, such as the search queries your agent sends. We need them to charge credits, show you your usage and investigate faults (Art. 6(1)(b) and (f)).
• Billing data: your plan, invoices and payment status. Card payments are handled by our payment provider; we never receive your full card number. We keep invoices because tax law requires it (Art. 6(1)(c)).

04If you run a store that uses ZUREQ

When you create a merchant account, we process your contact details, your business and store details, the settings of your integrations, orders placed through ZUREQ and your billing data (Art. 6(1)(b) and (c)). Credentials you give us for your store or payment provider are encrypted before they are stored.

05If we index your store

ZUREQ indexes independent online stores so that shoppers and AI agents can find their products. We collect the following from the store's own public website, not from you directly (Art. 14 GDPR):

• the catalogue: product names, descriptions, prices, availability, images and links;
• public information about the business from pages such as About, Contact, Shipping, Returns and Terms, including the business name and the contact details the store publishes. For a store run by a sole trader these can be personal data, such as a name, email address, phone number or address.

We use this to make the store searchable and checkout-ready for shoppers and AI agents, and to check that a real business stands behind each store before it goes live. Our legitimate interest, and the store's, is in being found by people looking for what it sells (Art. 6(1)(f)). Our crawler follows the rules a site sets in its robots.txt.

You can object at any time. Write to [email protected] from an address connected with the store, or tell us how to verify that the store is yours, and we will remove the store from the index and stop indexing it.

06If you visit zureq.io

We keep your language choice and your cookie choices in your browser. With your consent to Functional cookies, and only then, we load an analytics tool to understand how the page is used (Art. 6(1)(a)). The cookie policy names it. You can withdraw consent at any time under “Privacy settings” in the footer; withdrawing does not affect what happened before.

07Everyone who uses the Services

• Technical logs and error reports: IP address, browser and device, time, the page or endpoint requested and the error. We use them to keep the Services secure and working (Art. 6(1)(f)).
• Service metrics. Where they refer to a person or a session, the identifier is replaced by a keyed hash before it leaves our servers.
• Emails we send you (sign-up confirmation, password reset, receipts and notices about the Services), and messages you send us. We keep correspondence as long as needed to deal with it and to defend legal claims (Art. 6(1)(b) and (f)).

08AI and automated processing

The ZUREQ chat is an AI system: you are talking to an AI agent, not a person. To produce answers, the content of your conversation is processed by AI model providers (section 9). Photos you send for photo search are turned into numerical descriptions to find visually similar products; they are not sent to a language model.

We do not sell personal data, and we do not use your conversations to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). Recommendations are suggestions; you decide whether to buy.

09Who receives your data

We share personal data only as far as each purpose requires:

• The store you buy from receives your order and the contact and delivery details it needs. It processes them as a separate controller under its own privacy policy.
• Licensed payment providers, as separate controllers for the payments they process.
• WhatsApp (Meta), if you talk to ZUREQ on WhatsApp, and Google or GitHub, if you sign in with them. Their own terms and privacy policies apply.
• Our service providers, who process data only on our instructions and under data processing agreements: hosting and database providers (our application servers are in the European Union), network delivery and security, providers of AI models (for answers, search, photo search and voice), email delivery, error monitoring and service metrics, website analytics (only with your consent) and parcel locker search (when you choose a locker). You can ask us at [email protected] for more detail about who processes your data.
• Public authorities, when the law requires it.
• A buyer or successor of our business, if ZUREQ Labs is reorganised, merged or sold, under the protections this policy gives.

10Transfers outside the European Economic Area

Some of our providers are based outside the European Economic Area or may process data there. Where a provider is certified under the EU-US Data Privacy Framework we rely on that framework; otherwise we rely on the European Commission's standard contractual clauses (Art. 46 GDPR). You can ask us for a copy of the safeguards at [email protected].

11When we act for a store

When a store connects its payments to ZUREQ or runs a ZUREQ agent on its own site, we process that store's customers' data on the store's behalf, under our Data Processing Agreement (zureq.io/powierzenie-danych). In that case the store is the controller and its privacy policy applies.

12How long we keep data

• Account data: for as long as your account exists. If you ask us to delete your account, we delete its data within 30 days, except what the law requires us to keep.
• Conversations: for as long as your account exists, unless you delete them earlier.
• Guest sessions: guest limits reset within hours, and a basket expires after 30 minutes of inactivity.
• Orders, invoices and billing records: as long as tax and accounting law requires, in Poland generally five years from the end of the year in which the tax obligation arose.
• API usage records: for as long as the key exists, and then up to 24 months for billing and disputes.
• Logs and error reports: up to 90 days.
• Data from indexed stores: while the store is in the index. It is removed when the store objects or is no longer available.
• Website analytics data: up to 13 months.
• Beyond these periods, only what we need to establish, exercise or defend legal claims, until the limitation period expires.

13Your rights

You have the right to access your data, to have it corrected, erased or restricted, to receive it in a portable format, and to object to processing based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time. To exercise any of these rights, write to [email protected].

You can also lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also complain in the EU country where you live or work.

14Do you have to give us your data?

You can use the chat without an account. An account needs an email address, and a store needs your contact and delivery details to fulfil an order. Everything else is optional; if you don't provide it, the related feature won't work.

15Children

The Services are not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to [email protected] and we will delete it.

16Security

Data travels over encrypted connections (TLS). Passwords are stored only as hashes, API keys only as one-way hashes, and store and payment credentials are encrypted at rest. Access to personal data is limited to those who need it. If a breach puts your rights at risk, we will notify the supervisory authority and, where required, you.

17Cookies and similar technologies

• Essential, always on: zureq.shopper-session (keeps you signed in to the chat), zureq.guest (ties a guest visit to its session and conversation), and your language and cookie choices stored in your browser.
• Functional, only with your consent: website analytics on zureq.io.
• We use no advertising cookies. The cookie policy (zureq.io/cookies) has the details.

18Changes to this policy

We will publish any change here and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the Services at least 14 days before it takes effect.

19Contact

ZUREQ Labs · [email protected]