Privacy Policy
CIQRA OÜ · Version 2.0 · Last updated: 29 September 2026
This Privacy Policy explains how CIQRA OÜ processes personal data when it provides the CIQRA platform and its own websites. It applies worldwide and includes additional information for residents of the United States (Sections 12–13) and the United Kingdom (Section 14). For individuals in Türkiye, the Türkiye Market Terms contain the information notice required by Turkish law (KVKK). Our use of cookies is described in the Cookie Policy.
1. Who we are
Controller: CIQRA OÜ, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia ("CIQRA", "we", "us").
Privacy contact: info@ciqra.com. This address handles all data-protection requests and enquiries.
Data Protection Officer. CIQRA has assessed whether it is required to appoint a data protection officer under Article 37 of the General Data Protection Regulation (GDPR) and has concluded that it is not currently required to do so. CIQRA keeps this assessment under review as its services grow.
Representatives. CIQRA is established in the European Union, so no EU representative is required under Article 27 GDPR. Where the UK GDPR requires CIQRA to appoint a representative in the United Kingdom, CIQRA will do so and publish the representative's details in this Policy.
2. Our two roles
CIQRA as controller. We decide how and why personal data is processed for: Merchant accounts and billing; visitors to our own websites; prospective customers; support; platform security and fraud prevention; operational and aggregated analytics; and our own marketing. This Policy covers that processing.
CIQRA as processor. When a Merchant runs a Storefront on CIQRA, the Merchant is the controller of the personal data of its Shoppers (for example, orders, accounts and marketing lists), and CIQRA processes that data on the Merchant's behalf and instructions under the Data Processing Agreement. If you are a Shopper, please read the Merchant's own privacy notice and contact the Merchant to exercise your rights over that data. This Policy tells you how CIQRA operates the underlying platform.
3. Personal data we process as controller
| Category | Examples | Source |
|---|---|---|
| Identity and account | name, business name, role, username, password (stored in hashed form) | you, your team |
| Contact | email address, telephone number, address, country | you |
| Verification | business registration details, beneficial owners, identity verification carried out by Stripe, tax identification numbers | you, Stripe |
| Billing and transactions | plan, invoices, platform fees, payout information, ledger entries (we do not receive full card numbers) | you, Stripe |
| Usage and device | log data, IP address, device and browser information, pages visited, feature usage, cookies and similar identifiers | automatically |
| Support and communications | support tickets, emails, chat messages | you |
| Marketing preferences | consent status, subscriptions, campaign interactions | you |
| Security and fraud | authentication events, risk signals, abuse reports | automatically, third parties |
| Website visitors and prospects | form submissions, enquiries, analytics | you, automatically |
| Notices and complaints | name, email address and content of notices of illegal content and of complaints you submit to us | you |
We do not seek to process special categories of personal data as controller, and we do not knowingly process personal data of children as controller (see Section 11).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing and operating the Services; managing your account | Performance of a contract (Art. 6(1)(b)) |
| Billing, platform fees and payouts | Performance of a contract; legal obligation (accounting and tax) |
| Identity verification, sanctions screening, fraud prevention and trader traceability | Legal obligation; legitimate interests in security and fraud prevention |
| Security, abuse prevention, logging and backups | Legitimate interests; legal obligation |
| Support and service communications | Performance of a contract; legitimate interests |
| Product analytics and improvement, using aggregated data where possible | Legitimate interests |
| Direct marketing to Merchants and prospective customers | Consent, or legitimate interests with a right to object at any time |
| Non-essential cookies, analytics and advertising tags | Consent (see the Cookie Policy) |
| Handling notices of illegal content and complaints | Legal obligation (Digital Services Act); legitimate interests |
| Legal compliance, disputes and enforcement of our terms | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights, and you may object at any time (Section 9). Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
5. AI features
5.1 CIQRA offers optional AI-assisted features, such as generating product descriptions and search-engine content, semantic search and recommendations, and an AI assistant. These features are provided using Microsoft Azure OpenAI Service, as named in the Subprocessor List.
5.2 Safeguards. AI features run on Microsoft Azure OpenAI Service, using CIQRA's EU data-zone deployments (account in Germany West Central). We send the service only the input needed for the requested feature, and under Microsoft's terms customer inputs and outputs are not used to train the models. We add a new AI provider only after giving the notice described in the Subprocessor List.
5.3 Transparency. Where you interact with an AI system, or where content has been generated by AI, this is disclosed or marked as required by Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Further details are in the AI Features Terms.
6. Advertising, analytics and server-side tracking
6.1 CIQRA and Merchants may use analytics and advertising integrations, such as Google Analytics 4 and Google Tag Manager, Google Ads, the Meta Pixel and Conversions API, TikTok, Pinterest and Snapchat, including server-side event forwarding.
6.2 These integrations are non-essential. Where the consent requirements of EU/EEA law apply, they run only after consent has been given. Server-side forwarding is subject to the same consent: each server-side destination is dispatched only where the corresponding consent category has been granted, and if consent is refused or withdrawn, the event is not forwarded.
6.3 On a Merchant's Storefront, the Merchant decides which integrations to enable and is the controller for them. CIQRA provides the tools and the consent controls.
7. Recipients and international transfers
7.1 Recipients. We share personal data only as needed with:
- service providers acting on our behalf — including Microsoft Azure (hosting, Germany), Cloudflare (content delivery and security), Azure Communication Services (email), Microsoft Azure OpenAI Service (AI features), Google (reCAPTCHA bot protection) and our reseller in Türkiye, Reklam5 — listed in full in the Subprocessor List;
- Stripe, for payment processing, verification and payouts, which acts largely as an independent controller under its own terms;
- advertising and analytics platforms, where consent has been given (Section 6);
- third parties a Merchant selects and contracts with, such as shipping carriers, SMS providers and sales channels, in accordance with the Merchant's instructions;
- professional advisers, auditors and public authorities, where required by law or to establish, exercise or defend legal claims; and
- a buyer or successor in a merger, acquisition or reorganisation, subject to confidentiality.
We do not sell personal data.
7.2 Where your data is stored. Our platform is hosted on Microsoft Azure in Germany (Germany West Central, with geo-redundant backups in Germany North). Core hosting, compute, database, storage and key management take place in the EU.
7.3 Transfers outside the EEA. Some recipients are located, or have parent companies, outside the European Economic Area — in particular Stripe, Cloudflare, Google, CAPTCHA and advertising providers, and our reseller Reklam5 in Türkiye. Where a recipient is in a country without an adequacy decision, we use an appropriate safeguard under Article 46 GDPR, principally the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with supplementary measures where necessary. You can request a copy of the relevant safeguards at info@ciqra.com.
8. How long we keep personal data
We keep personal data only as long as necessary for the purposes described or as required by law. The main periods are:
| Data | Period |
|---|---|
| Accounting records (orders, invoices, tax and ledger records) | 7 years from the end of the financial year (Estonian Accounting Act) |
| Merchant account data after the account is closed | deleted or anonymised within 90 days after closure, except records we must keep by law |
| Payment event and chargeback records | 13 months, or longer while a dispute is open |
| Support tickets, correspondence, chat transcripts and form submissions | 24 months after the last activity |
| Marketing engagement records | 24 months after the last interaction |
| Marketing consent records | for as long as the consent is in effect, and afterwards for as long as needed to demonstrate that consent was given |
| Storefront analytics events with pseudonymous identifiers | 400 days |
| Application logs and session records | 12 months |
| Security and audit records | 12 months, or up to 24 months where needed for a security investigation |
| Backups | 30 days on a rolling basis |
For Merchants on the Enterprise CMS or Commerce Enterprise plan, the Merchant's own records (such as support tickets, correspondence, chat transcripts, form submissions, marketing engagement records and content history) are kept for the life of the account and are not deleted by automated retention schedules; platform logs and backups keep the periods above on every plan. The full schedule is in the Data Retention and Breach Notification Policy.
9. Your rights
Subject to the conditions and exceptions set by law, you have the right to: access your personal data; have it rectified; have it erased; restrict its processing; receive it in a portable format; object to processing based on legitimate interests and, at any time, to direct marketing; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you, except where the law permits it with appropriate safeguards. Where processing is based on consent, you may withdraw your consent at any time.
How to exercise your rights. Where CIQRA is the controller, email info@ciqra.com. We reply within one month, which we may extend by two further months for complex requests, in which case we tell you within the first month. Requests are free of charge unless they are manifestly unfounded or excessive. Where CIQRA processes data on behalf of a Merchant, please contact the Merchant; we will forward your request and help the Merchant respond.
Erasure requests. When we accept an erasure request, we tell you the date on which the erasure will take effect and which records, if any, we must keep and why (for example, accounting records we are required to keep by law).
Complaints. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or with the supervisory authority in the EU/EEA country where you live or work, or where the alleged infringement took place.
10. Security
We apply appropriate technical and organisational measures, including tenant isolation enforced by row-level security in the database, encryption in transit and at rest, per-tenant encryption keys managed in Azure Key Vault, access controls based on least privilege, logging and monitoring, backups, and a documented incident-response and breach-notification procedure. Card payments made through CIQRA Pay are handled on a PCI DSS SAQ A basis: full card numbers are captured by Stripe and never reach CIQRA's systems. No system is completely secure, and we cannot guarantee absolute security.
11. Children
The Services are sold to businesses and are not directed at children, and CIQRA does not knowingly collect personal data of children as controller. On Storefronts, the applicable age of digital consent depends on the Shopper's country (16 under the GDPR by default; 13 in Estonia). A Merchant that offers goods or services to children is responsible for having a lawful basis and, where required, parental consent.
12. California privacy rights
This Section applies to California residents and supplements the rest of this Policy.
Our roles. For personal information CIQRA processes on a Merchant's behalf, CIQRA acts as a "service provider" under a written contract. For personal information CIQRA processes for its own purposes, CIQRA acts as a "business".
Your rights. Subject to the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, you have the right to know about and access the personal information we collect, to delete it, to correct it, to opt out of its sale or sharing for cross-context behavioural advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.
Sale and sharing; Global Privacy Control. We do not sell personal information for money. Where advertising cookies or tags may amount to "sharing" for cross-context behavioural advertising, you may opt out through the cookie settings. CIQRA also honours the Global Privacy Control (GPC) signal: if your browser sends it, the store records an opt-out of sale and sharing for you, remembers it for later visits, and does not send your data to advertising destinations. This applies on every Storefront on the platform. The GPC signal does not switch off a store's own first-party measurement of site usage, which does not identify you; you can decline analytics separately in the cookie settings.
Sensitive personal information. We do not use sensitive personal information for purposes that would require us to offer a right to limit its use.
Categories and retention. The categories of personal information we collect, the purposes for which we use it, whether it is sold or shared, and how long we keep it are described in Sections 3, 4, 7 and 8.
Exercising your rights. Email info@ciqra.com. You may use an authorised agent. We verify requests before acting on them and respond within the time limits set by the CCPA.
13. Other US state privacy rights
If you live in a US state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, Utah, Texas or Oregon), you may have the right to access, correct and delete your personal data, to obtain a portable copy, and to opt out of targeted advertising, sale and certain profiling. CIQRA extends the rights described in Section 9 to all individuals in the United States, and honours the Global Privacy Control signal as an opt-out of sale and sharing as described in Section 12. To exercise your rights, email info@ciqra.com. If we decline your request, you may appeal by replying to our decision; we will respond to your appeal within the period required by the applicable state law.
14. United Kingdom
For individuals in the United Kingdom, processing is governed by the UK GDPR and the Data Protection Act 2018. Your rights are those described in Section 9. The UK supervisory authority is the Information Commissioner's Office (ico.org.uk). For restricted transfers out of the United Kingdom, we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
15. Changes and contact
We may update this Policy from time to time. We will notify Merchants of material changes by email or in the dashboard before they take effect, and the date at the top of this Policy shows when it was last updated.
Contact: info@ciqra.com · CIQRA OÜ, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia.