Privacy Policy

The website uses Google Analytics (GA4) to count visits and understand which pages work. Google sets cookies for this and receives technical data such as pages viewed, browser and approximate location. We see aggregated statistics, not a profile of you as a person.

If you write to us through the contact page, we keep your message and email address for as long as the conversation needs, and up to 12 months after it ends.

When you register we store your email address, a hashed password, your store name and your interface language. We use them to run your account, which is a contractual basis under the GDPR.

Payments go through Stripe. Your card number never reaches our servers; we store only what Stripe reports back: plan, status and invoice references. Invoicing data is kept as long as Bulgarian tax law requires.

We send transactional email only: address verification, password resets, billing notices, and the stock alerts and weekly summaries you can switch on and off in the dashboard. We do not send marketing email without separate consent.

A store using BasketBooster sends us its catalog and events from its shopfront: which products were viewed, added to the cart, bought and searched for, together with order values and the pseudonymous identifiers the store chooses to send (a session id, a customer id). If a shopper searches by photo, the image is used to find visually similar products, not to identify the person.

From this we compute what the store sees in its dashboard: recommendations, search results, demand forecasts and customer segments. We act only on the store's instructions under a Data Processing Addendum, and we do not combine data across stores.

If you are a shopper in such a store, the store is responsible for informing you; its own privacy policy is the right place to look, and requests about your data are best sent to the store. We help stores answer them.

We use a small number of providers to run the service:

• Hetzner Online GmbH (Germany): servers and hosting. All application data lives in the EU.
• Stripe: payment processing for merchant subscriptions.
• Resend: sending transactional email.
• Vercel: hosting of this marketing website.
• Google (Google Analytics): visit statistics for this website only.
• Open-Meteo: weather data for demand forecasts, queried by city, with no personal data involved.
• OpenAI: only when a store switches on the optional AI features and provides its own OpenAI API key. That data flow runs on the store's key and the store's relationship with OpenAI.

We update this list here before adding a provider that would process personal data.

Account and store data are kept while the account is active. When an account is closed, or a store deletes its data, we erase it within 30 days, apart from invoices and records we must keep by law. Backups roll off on their own schedule shortly after.

Data is encrypted in transit, stored on EU servers, and access inside the team is limited to what running the service requires.

You can ask us for a copy of your data, ask us to correct or delete it, restrict or object to processing, and receive it in a portable format. Write to support@basketbooster.eu and we will answer within a month.

You can also complain to a supervisory authority. In Bulgaria that is the Commission for Personal Data Protection (cpdp.bg).

When this policy changes in a way that matters, we note it here and, for account holders, by email. The date at the top always tells you when it was last touched.