Privacy Policy
CIQRA OÜ · Version 2.8 · Last updated: 3 November 2026
This Privacy Policy explains how CIQRA OÜ processes personal data when it provides the CIQRA platform and its own websites. It is CIQRA's single privacy policy for every country. It applies worldwide, and Section 12 contains the regional supplements for the European Union, the European Economic Area and Switzerland (12.1), the United Kingdom (12.2), the United States (12.3), Canada, including Québec (12.4), Brazil (12.5) and Türkiye (12.6). Where a regional supplement conflicts with another Section for a person it covers, the supplement prevails for that person. Our use of cookies is described in the Cookie Policy.
1. Who we are
Controller: CIQRA OÜ, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia ("CIQRA", "we", "us").
Privacy contact: info@ciqra.com. This address handles all data-protection requests and enquiries, in every country, and is the contact point for the roles named in the regional supplements (Section 12).
Data Protection Officer. CIQRA has assessed whether it is required to appoint a data protection officer under Article 37 of the General Data Protection Regulation (GDPR) and has concluded that it is not currently required to do so. CIQRA keeps this assessment under review, at least once a year, as its services grow.
Contact in every country. CIQRA is established in the European Union, so no EU representative is required under Article 27 GDPR. Individuals everywhere contact CIQRA directly at info@ciqra.com about any data-protection matter; the regional supplements (Section 12) describe the rights and complaint routes that apply to them.
2. Our two roles
CIQRA as controller. We decide how and why personal data is processed for: Merchant accounts and billing; visitors to our own websites; prospective customers; support; platform security and fraud prevention; operational and aggregated analytics; and our own marketing. This Policy covers that processing.
CIQRA as processor. When a Merchant runs a Storefront on CIQRA, the Merchant is the controller of the personal data of its Shoppers (for example, orders, accounts and marketing lists), and CIQRA processes that data on the Merchant's behalf and instructions under the Data Processing Agreement. If you are a Shopper, please read the Merchant's own privacy notice and contact the Merchant to exercise your rights over that data. This Policy tells you how CIQRA operates the underlying platform.
3. Personal data we process as controller
| Category | Examples | Source |
|---|---|---|
| Identity and account | name, business name, role, username, password (stored in hashed form) | you, your team |
| Contact | email address, telephone number, address, country | you |
| Verification | business registration details, beneficial owners, identity verification carried out by Stripe, tax identification numbers | you, Stripe |
| Billing and transactions | plan, invoices, platform fees, payout information, ledger entries (we do not receive full card numbers) | you, Stripe |
| Usage and device | log data, IP address, device and browser information, pages visited, feature usage, cookies and similar identifiers | automatically |
| Support and communications | support tickets, emails, chat messages | you |
| Marketing preferences | consent status, subscriptions, campaign interactions | you |
| Security and fraud | authentication events, risk signals, abuse reports | automatically, third parties |
| Website visitors and prospects | form submissions, enquiries, analytics | you, automatically |
| Notices and complaints | name, email address and content of notices of illegal content and of complaints you submit to us | you |
We do not seek to process special categories of personal data as controller, and we do not knowingly process personal data of children as controller (see Section 11).
Whether you must give us data. To open and keep a Merchant account you must give us the identity, contact, verification and billing data that the account and the law require; without it we cannot provide the Services. All other data is optional, and we tell you when it is.
Automated decisions. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects for you. Automated fraud and abuse signals may restrict an account temporarily; a person reviews any decision to refuse, suspend or close an account, and you can ask for that review (Section 9).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing and operating the Services; managing your account | Performance of a contract (Art. 6(1)(b)) |
| Billing, platform fees and payouts | Performance of a contract; legal obligation (accounting and tax) |
| Identity verification, sanctions screening, fraud prevention and trader traceability | Legal obligation; legitimate interests in security and fraud prevention |
| Security, abuse prevention, logging and backups | Legitimate interests; legal obligation |
| Support and service communications | Performance of a contract; legitimate interests |
| Product analytics and improvement, using aggregated data where possible | Legitimate interests |
| Direct marketing to Merchants and prospective customers | Consent, or legitimate interests with a right to object at any time |
| Non-essential cookies, analytics and advertising tags | Consent (see the Cookie Policy) |
| Handling notices of illegal content and complaints | Legal obligation (Digital Services Act); legitimate interests |
| Legal compliance, disputes and enforcement of our terms | Legal obligation; legitimate interests |
Where we rely on legitimate interests, the interests are those named in the table (security and fraud prevention, running and improving the Services, support, marketing our own services to businesses, and defending our rights); we have balanced them against your rights, and you may object at any time (Section 9). Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. The regional supplements state the corresponding legal bases under other laws.
5. AI features
5.1 CIQRA offers AI-assisted features, such as generating product descriptions and search-engine content, translation, image generation, semantic search and recommendations, a chat assistant for Storefronts and an AI assistant for Merchants. These features are provided using Microsoft Azure AI Foundry (the Azure OpenAI models), as named in the Subprocessor List, and no other AI provider.
5.2 Safeguards. AI features run only on CIQRA's EU Data Zone deployments, so requests are processed within the European Union: text and embeddings on CIQRA's Azure account in Germany West Central and image generation on its Azure account in Sweden Central. We send the service only the input needed for the requested feature. By default, e-mail addresses, telephone numbers, payment card numbers and IBANs are replaced with placeholders before a request is sent, and the AI assistant's tools pass customer names and contact details from a store's records only in masked form. Under Microsoft's terms, customer inputs and outputs are not used to train the models; Microsoft may retain them for a limited period for abuse monitoring, as those terms permit. We add a new AI provider only after giving the notice described in the Subprocessor List.
5.3 Transparency. Where you interact with an AI system, or where content has been generated by AI, this is disclosed or marked as required by Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) and by the laws named in the regional supplements. Further details are in the AI Features Terms.
6. Advertising, analytics and server-side tracking
6.1 CIQRA and Merchants may use analytics and advertising integrations, such as Google Analytics 4 and Google Tag Manager, Google Ads, the Meta Pixel and Conversions API, TikTok, Pinterest, Snapchat and Microsoft Advertising, including server-side event forwarding, and session-replay and heat-map tools such as Microsoft Clarity where a Merchant enables them for its Storefront.
6.2 These integrations are non-essential. Where the law that applies to you requires consent before they run (including EU/EEA law, UK law and Québec law), they run only after consent has been given. Server-side forwarding is subject to the same consent: each server-side destination is dispatched only where the corresponding consent category has been granted, and if consent is refused or withdrawn, the event is not forwarded. Where the law that applies to you gives a right to opt out instead, Section 12.3 describes how to exercise it, and the Global Privacy Control signal is honoured as described in the Cookie Policy.
6.3 On a Merchant's Storefront, the Merchant decides which integrations to enable and is the controller for them. CIQRA provides the tools and the consent controls.
7. Recipients and international transfers
7.1 Recipients. We share personal data only as needed with:
- service providers acting on our behalf — including Microsoft Azure (hosting, Germany), Cloudflare (content delivery and security), Azure Communication Services (email), Microsoft Azure AI Foundry with the Azure OpenAI models (AI features, EU Data Zone), Google (reCAPTCHA bot protection), Openprovider (registration of domain names bought through CIQRA) and Reklam5 in Türkiye (operation of the Microsoft 365 tenant that hosts our business email) — listed in full in the Subprocessor List;
- Stripe, for payment processing, verification and payouts, which acts largely as an independent controller under its own terms;
- advertising and analytics platforms, where consent has been given or you have not opted out, as the law that applies to you provides (Section 6);
- third parties a Merchant selects and contracts with, such as shipping carriers, SMS providers and sales channels, in accordance with the Merchant's instructions;
- professional advisers, auditors and public authorities, where required by law or to establish, exercise or defend legal claims; and
- a buyer or successor in a merger, acquisition or reorganisation, subject to confidentiality.
We do not sell personal data for money. For residents of the United States, Section 12.3 explains when advertising cookies and tags on our own websites may be a "sale" or "sharing" under US state law and how to opt out.
7.2 Where your data is stored. Our platform is hosted on Microsoft Azure in Germany (Germany West Central, with geo-redundant backups in Germany North). Core hosting, compute, database, storage and key management take place in the EU. Two services run in another EU region, Sweden Central: AI image generation, and the service that redirects visitors from a store's bare domain (for example, example.com to www.example.com), which processes the visitor's request data for that purpose.
7.3 Transfers outside the EEA. Some recipients are located, or have parent companies, outside the European Economic Area — in particular Stripe, Cloudflare, Google, CAPTCHA and advertising providers, and Reklam5 in Türkiye, which operates our business email. Transfers to recipients in the United States that are certified under the EU-U.S. Data Privacy Framework rely on the adequacy decision in Commission Implementing Decision (EU) 2023/1795. Where a recipient is in a country without an adequacy decision, or is not certified, we use an appropriate safeguard under Article 46 GDPR, principally the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with supplementary measures where necessary after an assessment of the destination country's laws and practices. You can request a copy of the relevant safeguards, and a summary of our transfer assessment, at info@ciqra.com. The regional supplements state the transfer mechanisms that apply under other laws.
8. How long we keep personal data
We keep personal data only as long as necessary for the purposes described or as required by law.
8.1 Data we keep as controller. The main periods are:
| Data | Period |
|---|---|
| Merchant account, staff and store-settings data, including the Merchant's correspondence with CIQRA support | for the life of the account; deleted 2 years after the store is closed, except records we must keep by law |
| CIQRA's own billing and accounting records (subscription and commission invoices, ledger) | at least 7 years from the end of the financial year (Estonian Accounting Act); financial records held on the platform are kept 10 years after a store is closed |
| Security and audit records (staff and operator audit trail, sign-in, session and device records, payment security records) | 2 years |
| Application and delivery logs (e-mail, SMS and webhook delivery logs, import diagnostics) | 12 months |
| Reports of illegal content made through the report form (reporter's name, e-mail address, description and evidence copies) | 12 months after the case is closed; the decision record is kept without the reporter's identity |
| Marketing consent records (newsletter consent, cookie-consent log) | while the consent is valid. A record of a withdrawal (an unsubscribe or opt-out) is kept by default, because it is the proof that the withdrawal is honoured; a cookie consent is valid for at most 365 days, so a cookie-consent record is kept for 365 days plus 3 years |
| Records of retention deletions and maskings (which table and category, what was done, how many records, the cut-off date; they contain no personal data) | at least 3 years; never deleted automatically. They are CIQRA's accountability record and give a Merchant what it needs for its own destruction records under the law that applies to it |
| Backups | database point-in-time backups up to 35 days on a rolling basis; recoverable copies of deleted files 30 days; where kept, protected long-term copies up to 8 weeks (weekly copies) and up to 6 months (one copy a month). Individual records are not removed from backup copies, so deleted data leaves them when they expire, at the latest 6 months after its deletion; until then it is used only to restore the Services, and a restore re-applies the deletions CIQRA has recorded since the backup was taken. See Section A.6.3 of the Data Retention and Breach Notification Policy |
8.2 Data we process for Merchants. When we process personal data as a processor, the Merchant is the controller and decides how long the data is kept. The platform defaults, set out in Section 9 of the Data Processing Agreement, are:
| Data | Period |
|---|---|
| Orders, invoices, payment and accounting records | while the store is active, and 10 years after it is closed, the longest commercial record-keeping period CIQRA has identified among the laws of its Merchants' markets (for example 10 years under Türkiye's Commercial Code art. 82; Estonia's Accounting Act requires 7 years); a Merchant may instruct a shorter period where its law allows. An erasure request removes or anonymises the person in these records and keeps the transaction (Article 17(3)(b) GDPR) |
| Customer accounts and customer personal data, including support tickets, live chat with shoppers, reviews and wishlists | while the store is active; erased or anonymised on a data-subject request; deleted 2 years after the store is closed |
| Contact and enquiry form submissions | while the store is active, unless the Merchant chooses a shorter period of 6, 12, 24 or 36 months in its store settings |
| Identity and financial numbers entered in a form (national ID / Turkish ID number, driving licence, passport, tax number, IBAN, social security number) | kept as submitted by default; the Merchant may switch on an option, off by default, to have them replaced with "[masked]" 7, 30, 90, 180 or 365 days after the submission. The rest of the enquiry is not changed |
| Migrated logs from a Merchant's previous system (they contain IP addresses) | while the store is active, unless the Merchant chooses 24 or 36 months in its store settings; CIQRA keeps them for at least 2 years unless the Merchant instructs a shorter period, because a Merchant may have to keep them under the law of its own country |
| Newsletter consent and unsubscribe records of a store's subscribers | an unsubscribe record is kept by default, as proof that the withdrawal is honoured. The Merchant may switch on an option, off by default, to delete withdrawn consents 3 years after withdrawal, and a second option, also off by default, to count those 3 years from the import date where an imported unsubscribe has no withdrawal date. As an alternative to deletion, the Merchant may instead switch on a third option, also off by default and not combinable with deletion, under which 3 years after withdrawal the address in the unsubscribe record is replaced by a one-way hash and the shopper's IP hash is dropped, so that the withdrawal continues to be honoured without the address itself being kept |
| Storefront analytics events with pseudonymous identifiers (processed for the Merchant) | 400 days |
| Abandoned carts (carts and checkouts that did not become an order) and cart-recovery e-mails | 1 year |
| All other data of a closed store | deleted 2 years after closure; financial records are kept for 10 years |
8.3 Enterprise plans. For Merchants on the Enterprise CMS or Commerce Enterprise plan, retention of the Merchant's own data is governed by the Merchant's contract: while the contract is in force, that data is kept without a time limit and is not deleted by automated retention schedules, and CIQRA reminds the Merchant of this once a year. Security and audit records, delivery logs and backups keep the periods above on every plan.
8.4 Introduction of new periods. Some of the deletion periods above are new (abandoned carts, the cookie-consent log, periods and options chosen by a Merchant, including masking and deletion of withdrawn consents, and deletion 2 years after a store is closed). They are being switched on in stages. Until a period is switched on, the data concerned is kept for longer; it is not deleted earlier than stated. The full schedule is in the Data Retention and Breach Notification Policy.
9. Your rights
Subject to the conditions and exceptions set by law, you have the right to: access your personal data; have it rectified; have it erased; restrict its processing; receive it in a portable format; object to processing based on legitimate interests and, at any time and free of charge, to direct marketing; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you, except where the law permits it with appropriate safeguards. Where processing is based on consent, you may withdraw your consent at any time.
How to exercise your rights. Where CIQRA is the controller, email info@ciqra.com. We may ask you to verify your identity. We reply within one month, which we may extend by two further months for complex or numerous requests, in which case we tell you within the first month; the regional supplements state shorter periods where the law that applies to you sets them. Requests are free of charge unless they are manifestly unfounded or excessive. Where CIQRA processes data on behalf of a Merchant, please contact the Merchant; we will forward your request and help the Merchant respond.
Erasure requests. When we accept an erasure request, we tell you the date on which the erasure will take effect and which records, if any, we must keep and why (for example, accounting records we are required to keep by law).
Complaints. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), with the supervisory authority in the EU/EEA country where you live or work, or where the alleged infringement took place, or with the authority named for your region in Section 12.
10. Security
We apply appropriate technical and organisational measures, including tenant isolation enforced by row-level security in the database, encryption in transit and at rest, per-tenant encryption keys managed in Azure Key Vault, access controls based on least privilege, logging and monitoring, backups, and a documented incident-response and breach-notification procedure. Card payments made through CIQRA Pay are handled on a PCI DSS SAQ A basis: full card numbers are captured by Stripe and never reach CIQRA's systems. No system is completely secure, and we cannot guarantee absolute security.
11. Children
The Services are sold to businesses and are not directed at children, and CIQRA does not knowingly collect personal data of children as controller. On Storefronts, the applicable age of digital consent depends on the Shopper's country (16 under the GDPR by default; 13 in Estonia and in the United Kingdom; 14 in Québec, where the consent of the holder of parental authority is required below that age; in Brazil, the LGPD requires that the processing of the data of children and adolescents be in their best interest and, where it rests on consent, that a parent or guardian gives it). A Merchant that offers goods or services to children is responsible for having a lawful basis and, where required, parental consent.
12. Regional supplements
CIQRA publishes one privacy policy for every country. The supplements below add the information that the law of a region requires, for the people that law protects. They do not reduce the protections in Sections 1 to 11.
12.1 European Union, European Economic Area and Switzerland
12.1.1 Who this supplement applies to. It applies to you if you are in the European Union, in Iceland, Liechtenstein or Norway (together with the European Union, the "EEA"), or in Switzerland. References to the GDPR include the GDPR as incorporated in the EEA Agreement.
12.1.2 Who is responsible. CIQRA OÜ (Section 1) is the controller. CIQRA is established in the European Union and therefore needs no representative under Article 27 GDPR. Whether CIQRA must appoint a data protection officer is assessed as described in Section 1.
12.1.3 When we act as processor. When a Merchant runs a Storefront on CIQRA, the Merchant is the controller of its Shoppers' personal data and CIQRA is its processor under the Data Processing Agreement. A Merchant that is established outside the EEA and offers goods or services to people in the EEA must itself appoint a representative where Article 27 GDPR requires it.
12.1.4 Legal bases and your choices. The legal bases are those in Section 4. Whether you must give us data, and what follows if you do not, and the automated decisions we make, are stated in Section 3.
12.1.5 Your rights. You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), the right to object (Article 21) and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (Article 22). You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interests, and the right to object at any time, free of charge, to direct marketing. Section 9 describes how to exercise your rights and the time we take to reply.
12.1.6 Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the EEA State where you habitually reside, where you work or where the alleged infringement took place. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tallinn, Estonia, www.aki.ee.
12.1.7 Transfers outside the EEA. Section 7 describes where your data is stored and the safeguards we use. Transfers to Türkiye, which has no adequacy decision, take place under the EU Standard Contractual Clauses with the supplementary measures described in the Subprocessor List.
12.1.8 Cookies and direct marketing. Under Article 5(3) of Directive 2002/58/EC, we store or read information on your device only with your consent, except where it is strictly necessary for a service you requested; see the Cookie Policy. We send marketing email to businesses on the basis described in Section 4; every message contains a way to unsubscribe, and you can object at any time.
12.1.9 Switzerland. For individuals in Switzerland, processing is also governed by the Swiss Federal Act on Data Protection (FADP). Your rights under it are the rights of access, rectification, deletion, objection and data portability and the right to be informed of automated individual decisions, which we handle as described in Section 9. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC), Bern. We transfer personal data from Switzerland to the EEA, which Switzerland recognises as providing adequate protection, and elsewhere only as the FADP allows, using the Standard Contractual Clauses adapted to Swiss law or the Swiss-U.S. Data Privacy Framework for certified US recipients.
12.2 United Kingdom
12.2.1 Who is responsible. CIQRA OÜ is the controller for the personal data it processes for its own purposes (Section 2). On a Storefront, the Merchant is the controller and CIQRA processes the data on the Merchant's behalf; contact the Merchant first about a Storefront. The UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") apply to this processing to the extent the law says so. Write to info@ciqra.com.
12.2.2 Legal bases. The legal bases in Section 4 are the bases under Article 6 of the UK GDPR. Where we rely on legitimate interests, we have balanced them against your interests and rights. Where we rely on consent (for example for non-essential cookies or electronic marketing), you can withdraw it at any time.
12.2.3 Your rights and complaints. You have the rights in Section 9 under the UK GDPR. We answer a request within one month, which we may extend by up to two further months where the request is complex or we have received several requests from you. If you are not satisfied, contact us first at info@ciqra.com; we acknowledge a complaint about our handling of your personal data within 30 days and respond without undue delay. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk/make-a-complaint.
12.2.4 Where your data is processed and transfers. Our platform is hosted in the European Economic Area (Germany). The United Kingdom treats the EEA as providing adequate protection, so a transfer of your data from the United Kingdom to us in Estonia does not need a further safeguard. Where we or our service providers transfer personal data of individuals in the United Kingdom to a country that the United Kingdom does not treat as adequate, we use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or, for recipients in the United States certified under the Data Privacy Framework and its UK Extension, the UK-US data bridge. You can ask us for a copy of the safeguard at info@ciqra.com.
12.2.5 Cookies and electronic marketing. PECR requires your consent before we store or read information on your device unless the storage or access is strictly necessary or falls within an exception the law allows. The consent banner on our own websites applies to visitors in the United Kingdom; see the Cookie Policy. We send electronic marketing to individuals in the United Kingdom only with consent or, for existing customers, under the "soft opt-in", and every message has an unsubscribe link.
12.2.6 Children and Merchants. The age of digital consent in the United Kingdom is 13. Merchants established in the United Kingdom remain responsible for the information they give to their own customers about the processing of their personal data.
12.3 United States
12.3.1 Scope and our roles. This supplement applies to residents of the United States. It gives the information required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together the "CCPA"), the California Online Privacy Protection Act, and the comprehensive consumer-privacy laws of other states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island (together with the CCPA, "US State Privacy Laws"). Words such as "personal information", "sale", "sharing", "sensitive personal information", "targeted advertising", "business", "service provider", "controller" and "processor" have the meaning the applicable law gives them. CIQRA is the business or controller for Merchant accounts, staff users, billing, support, visitors to CIQRA's own websites (including ciqra.com), prospective customers and CIQRA's own marketing. CIQRA is a service provider or processor for personal information of a Merchant's Shoppers and Storefront visitors: the Merchant is the business or controller for that information, and CIQRA processes it under the Data Processing Agreement. If you are a Shopper, please send your request to the Merchant whose Storefront you used; if you send it to us, we forward it to the Merchant and help the Merchant respond. Several US State Privacy Laws other than the CCPA do not apply to individuals acting in a commercial or employment context, such as a Merchant's owner or staff; CIQRA nevertheless offers the rights in this supplement to every individual in the United States.
12.3.2 Personal information we collect, why, who receives it, and how long we keep it. In the past 12 months we collected the following categories of personal information. This table is also our notice at collection: we give it, or a link to it, wherever we collect personal information on our own websites and at signup.
| CCPA category | Examples | Sources | Business purposes | Disclosed for a business purpose to | Sold or shared? | Retention |
|---|---|---|---|---|---|---|
| Identifiers | name, business name, email address, telephone number, postal address, account username, IP address, cookie and device identifiers | you; your team; automatically | providing and operating the Services; account management; security and fraud prevention; support; billing; our own marketing | hosting, delivery, email, security and AI service providers (Subprocessor List); Stripe; professional advisers and authorities where required | cookie and device identifiers and IP address may be shared with advertising partners on our websites, unless you opt out (12.3.6) | account data: life of the account, deleted 2 years after the store is closed; marketing contacts: until you unsubscribe or object, then a suppression record |
| Customer records (Cal. Civ. Code §1798.80(e)) | name, address, telephone number, billing and payout information (no full card numbers) | you; Stripe | billing; payouts; legal compliance | Stripe; accounting and tax advisers; authorities where required | No | billing and accounting records: at least 7 years from the end of the financial year |
| Commercial information | plan, invoices, purchase history of CIQRA services, AI credit use | you; automatically | billing; providing the Services; product improvement | service providers; Stripe | No | as for customer records |
| Internet or other electronic network activity | pages visited, feature usage, log data, authentication events | automatically | operating, securing and improving the Services; analytics | hosting, delivery and analytics service providers | website activity may be shared with advertising partners, unless you opt out | application and delivery logs 12 months; security and audit records 2 years; analytics events with pseudonymous identifiers 400 days |
| Geolocation data (approximate only, derived from IP address) | country or region | automatically | security; fraud prevention; showing local information | service providers | No | as for logs |
| Audio, electronic or similar information | support tickets, emails and chat messages | you | support; quality; disputes | support-tool and email service providers | No | life of the account, deleted 2 years after the store is closed |
| Professional or employment-related information | job title or role in the Merchant's business | you; your team | account management; permissions | service providers | No | life of the account |
| Sensitive personal information (see 12.3.4) | account log-in with password (stored hashed); tax identification number; identity verification status (documents are held by Stripe) | you; Stripe | only the purposes in 12.3.4 | Stripe; service providers | No | life of the account; tax records as for customer records |
| Notices and complaints | name, email address and content of reports of illegal or infringing content | you | handling notices; legal compliance | the affected Merchant only where the law requires; authorities | No | 12 months after the case is closed |
We do not collect biometric information, precise geolocation, or information about health, sex life, racial or ethnic origin, religious beliefs or union membership for our own purposes. We do not create profiles that produce legal or similarly significant effects about you.
12.3.3 Sale and sharing. We do not sell personal information for money. Where advertising and measurement tags of partners such as Google, Meta and Microsoft are enabled on CIQRA's own websites, they receive identifiers and website-activity information about you only after you have accepted them in the cookie settings or, where the law that applies to you provides a right to opt out instead of consent, unless you have opted out; US State Privacy Laws may treat that disclosure as a "sale", as "sharing" for cross-context behavioural advertising, or as "targeted advertising". In the past 12 months this applied to the categories "Identifiers" and "Internet or other electronic network activity" in 12.3.2, disclosed to advertising and analytics partners. You can opt out at any time as described in 12.3.6. We do not knowingly sell or share the personal information of consumers under 16 years of age.
12.3.4 Sensitive personal information. We collect the sensitive personal information listed in 12.3.2 and use it only to provide the Services you request, to verify your identity and business, to secure your account, to prevent fraud and illegal activity, and to meet legal and tax obligations. These are uses the CCPA permits without offering a right to limit (Cal. Code Regs. tit. 11, §7027(m)). We do not use sensitive personal information to infer characteristics about you. Where another state's law requires consent to process sensitive data, we ask for it.
12.3.5 Your rights. Subject to the conditions and exceptions in the law that applies to you, you have the right to: know what personal information we have collected about you, including the categories, the sources, the purposes and the categories of third parties to whom we disclosed it, and receive a copy of the specific pieces of personal information, in a portable format where technically feasible; correct inaccurate personal information; delete personal information we collected from you; opt out of the sale and sharing of your personal information, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects; limit the use of sensitive personal information where the law gives that right (see 12.3.4); where your state's law provides it (for example Oregon and Minnesota), obtain a list of the specific third parties, or categories of third parties, to whom we disclosed your personal information; and not be discriminated or retaliated against for exercising these rights.
12.3.6 How to exercise your rights. You or your authorised agent can submit a request by email to info@ciqra.com with the subject "Privacy request". To opt out of sale, sharing or targeted advertising, use the cookie settings link in the footer of our websites, or send a Global Privacy Control signal (12.3.9). An opt-out request does not need verification.
12.3.7 Verification, authorised agents and response times. To protect your information, we verify a request to know, correct or delete by matching the information you give us with the information we hold, usually by confirming control of the email address on your account. We do not ask for more information than we need. An authorised agent must provide your signed permission, and we may ask you to verify your identity directly or to confirm that you gave the agent permission, unless the agent holds a valid power of attorney. We confirm receipt of a request to know, correct or delete within 10 business days and respond within 45 calendar days. Where reasonably necessary, we extend that period once by up to 45 further days and tell you why within the first 45 days. We act on a request to opt out or to limit as soon as feasibly possible and within 15 business days. Requests are free of charge, except that we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, and we explain why.
12.3.8 Appeals. If we decline to act on your request, in whole or in part, we tell you why. You can appeal by replying to our decision or by writing to info@ciqra.com with the subject "Privacy appeal". A person who did not make the original decision reviews the appeal. We tell you the outcome in writing, with our reasons, within 45 days of receiving it. If we deny your appeal, you may contact the Attorney General of your state; California residents may also contact the California Privacy Protection Agency (cppa.ca.gov).
12.3.9 Global Privacy Control and other opt-out preference signals. CIQRA's own websites and every Storefront on the platform treat a Global Privacy Control signal (Sec-GPC: 1) as a valid request to opt out of sale, sharing and targeted advertising for that browser, and remember it for later visits. Honouring the signal does not stop the first-party measurement of site usage that does not identify you.
12.3.10 Non-discrimination and financial incentives. We do not deny services, charge different prices or provide a different quality of service because you exercise your rights. We do not offer financial incentives, or price or service differences, in exchange for the collection, retention, sale or sharing of personal information.
12.3.11 Children. The Services are offered to businesses and are not directed at children under 13. We do not knowingly collect personal information of children under 13 as a business, and we do not knowingly sell or share personal information of consumers under 16. A Merchant whose Storefront is directed to children, or that knows it collects personal information of children, is responsible for complying with the Children's Online Privacy Protection Act and with the laws on minors that apply to it.
12.3.12 California-specific notices. Do Not Track: our websites do not respond to "Do Not Track" browser signals, but they honour the Global Privacy Control signal as described in 12.3.9. Third-party advertising partners may collect information about your online activities over time and across websites when you visit our websites, unless you opt out. Shine the Light: we do not disclose personal information to third parties for their own direct-marketing purposes.
12.3.13 Deidentified data and data brokers. Where we use deidentified information, we keep it in deidentified form, do not attempt to reidentify it except as the law permits, and require any recipient to do the same. CIQRA is not a data broker: it does not sell personal information of individuals with whom it has no direct relationship.
12.3.14 Consumer health data. CIQRA does not collect consumer health data, within the meaning of the Washington My Health My Data Act and comparable laws of Nevada and Connecticut, for its own purposes. A Merchant that collects such data on its Storefront is the regulated entity and must publish its own consumer health data privacy policy. CIQRA processes the data for the Merchant as its processor.
12.3.15 Merchants selling to US consumers. A Merchant that sells to consumers in the United States is the business or controller for its Shoppers' personal information. It is responsible for its own privacy notice, notice at collection, opt-out links and consent, for answering its Shoppers' requests and for any consents its marketing requires. CIQRA acts as its service provider or processor under the Data Processing Agreement, honours the Global Privacy Control signal on every Storefront and provides tools to help the Merchant respond.
12.3.16 Updates. We review this supplement at least once every 12 months. It was last updated on the date at the top of this Policy.
12.4 Canada, including Québec
12.4.1 Who is responsible. For the personal information described in Section 3, CIQRA OÜ is the organisation responsible. For the personal information of a Merchant's Shoppers, the Merchant is responsible and CIQRA is its service provider under the Data Processing Agreement. CIQRA's person in charge of the protection of personal information (privacy officer) for the purposes of Canadian law is reachable at info@ciqra.com (subject line "Privacy, Canada"), CIQRA OÜ, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia; that person is responsible for CIQRA's compliance with Canadian privacy law. A Shopper should contact the Merchant that sold to them first.
12.4.2 Where your information goes. Your personal information is stored on Microsoft Azure in Germany and is accessed by CIQRA's staff and service providers as described in the Subprocessor List. It may also be communicated to the service providers listed in the Subprocessor List, some of which are in the United States and other countries outside Canada and, in the case of Québec, outside Québec. In those countries your information is subject to local law and may be accessed by courts, law-enforcement and national-security authorities under it. Before personal information of individuals in Québec is communicated outside Québec, an assessment of the privacy risks is made, and the communication takes place only if the information would receive adequate protection and under a written agreement. For Alberta: CIQRA is a service provider outside Canada, and info@ciqra.com can answer questions about how our service providers outside Canada handle personal information.
12.4.3 Why we collect it and your consent. We collect personal information for the purposes in Section 4, and we ask for your consent for them as Canadian law requires. In Québec, consent must be given for specific purposes, requested separately from other information and in clear and simple language, and we request it separately for each purpose. We do not make the supply of a service conditional on a consent that is not needed to supply it. You may withdraw your consent at any time, subject to legal and contractual limits, by writing to info@ciqra.com or through your cookie settings; we will tell you what the withdrawal means for you. For individuals under 14, the consent of the person with parental authority is required.
12.4.4 Tracking and profiling technologies. Our websites and dashboards use technologies that may identify you, locate you or profile you (for example analytics and advertising technologies, see the Cookie Policy). Where the law that applies to you, including Québec law, requires that these functions be switched off until you turn them on, they run only after your consent, and we tell you in advance about the technology and how to turn it on. You can turn them off again at any time through the cookie settings link.
12.4.5 Your rights. Subject to the exceptions in the law, you have the right to: be told whether we hold personal information about you and receive access to it; have it corrected if it is inaccurate, incomplete or equivocal; withdraw your consent; ask that we stop disseminating your personal information, or de-index or re-index a link to it, where the law gives you that right; receive your computerised personal information in a structured, commonly used technological format, or have it transferred to another organisation designated by you; and, where a decision about you is based exclusively on automated processing, be informed of that, be told on request what personal information was used and the reasons and principal factors behind the decision, and ask that a person review it. We respond in writing within 30 days of receiving your request; if we need more time we tell you before the 30 days end, and we extend the period only where the law allows. Access is free of charge, except that we may charge reasonable costs for transcribing, reproducing or transmitting and will tell you the amount in advance. Contact the person in charge in 12.4.1.
12.4.6 Marketing and e-mail. We send commercial electronic messages to individuals in Canada only with consent that satisfies Canada's Anti-Spam Legislation (CASL) or where CASL allows it without express consent, for example under an existing business relationship or to a business address published without a statement that the person does not wish to be contacted, where our message is relevant to that person's role. Every message identifies CIQRA OÜ, gives its mailing address and contact details and a free, working way to unsubscribe, which we act on without delay and in any case within 10 business days. We keep records of consent.
12.4.7 Confidentiality incidents. We keep a register of confidentiality incidents. If an incident involving personal information we are responsible for presents a real risk of significant harm (federal and Alberta law) or a risk of serious injury (Québec), we notify the competent authority and the individuals concerned, and we keep a record of every breach of security safeguards as the law requires.
12.4.8 Retention. We keep personal information only as long as needed for the purposes for which it was collected, then destroy it or anonymise it for serious and legitimate purposes in line with Québec's anonymisation rules, subject to the periods in Section 8.
12.4.9 Complaints. If you are not satisfied, first write to the person in charge in 12.4.1. You may then complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); in Québec, to the Commission d'accès à l'information (www.cai.gouv.qc.ca), where, if we refuse or do not respond, you may also ask the Commission to examine the disagreement within the time limit the law sets; or, in Alberta and British Columbia, to the Office of the Information and Privacy Commissioner of that province. If Canadian law gives you a right to damages, this Section does not affect it.
12.4.10 French. A French version of this Policy is published at /fr/privacy-policy, together with the French versions of CIQRA's other legal documents under /fr/; it is also available to everyone in Canada at info@ciqra.com. The English version prevails to the extent the law allows.
12.5 Brazil
12.5.1 Our roles. For personal data about Merchants and their staff, visitors to our websites, prospects and people who contact us, CIQRA OÜ is the controller (controlador) under the Brazilian General Data Protection Law (Lei 13.709/2018, the "LGPD"). For personal data of Shoppers that CIQRA processes for a Merchant's Storefront, the Merchant is the controller and CIQRA is the operator (operador) under the Data Processing Agreement, Section 15.4. If you are a Shopper, please contact the Merchant to exercise your rights over that data.
12.5.2 Contact for the LGPD (encarregado). CIQRA's contact channel for the purposes of the LGPD is info@ciqra.com (subject line "LGPD"); this channel receives requests from data subjects and communications from the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados, "ANPD"). CIQRA is an Estonian company and has no establishment or legal representative in Brazil.
12.5.3 Legal bases (Article 7 LGPD). The purposes in Section 4 rest on the following LGPD bases: providing the Services, managing your account, billing, payouts and support — performance of a contract or preliminary procedures related to a contract to which you are a party (Art. 7, V); accounting, tax, identity verification, sanctions screening and handling notices of illegal content — compliance with a legal or regulatory obligation (Art. 7, II); security, fraud and abuse prevention, logging, backups, product analytics and direct marketing to businesses where not based on consent — legitimate interests of CIQRA or of third parties (Art. 7, IX), balanced under Article 10 LGPD; non-essential cookies, analytics and advertising tags, and marketing based on consent — consent (Art. 7, I), given in accordance with Article 8 LGPD; disputes, enforcement of our terms and defence of legal claims — regular exercise of rights in judicial, administrative or arbitral proceedings (Art. 7, VI). We do not intentionally process sensitive personal data (Art. 11 LGPD) as controller.
12.5.4 Your rights (Article 18 LGPD). You may request from CIQRA, as controller: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of unnecessary or excessive data or of data processed in breach of the LGPD; portability to another provider, under ANPD regulation; deletion of data processed on the basis of consent; information about the public and private entities with which we have shared your data; information about the possibility of refusing consent and the consequences of refusal; withdrawal of consent; and review of decisions made solely by automated processing that affect your interests, with information on the criteria used. You may also object to processing carried out without your consent where it breaches the LGPD. To exercise these rights, email info@ciqra.com (subject line "LGPD"). We confirm that we process your data, or provide access to it, immediately in a simplified format or, if you ask for a complete declaration stating the origin of the data, the criteria used and the purpose of the processing, within 15 days of your request. We respond to your other requests as soon as possible and within the period set by ANPD regulation. Requests are free of charge. We may need to verify your identity first.
12.5.5 International transfers (Article 33 LGPD). CIQRA is established in Estonia and hosts data in Germany. Personal data collected from you directly by CIQRA is processed in the European Union. When CIQRA transfers personal data of individuals in Brazil to recipients in other countries (see Section 7.3), it does so under a mechanism listed in Article 33 LGPD, such as the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024), an adequacy decision of the ANPD or, in the cases the LGPD allows, your specific and prominent consent. You may request information on the mechanism used, and a copy of the clauses, at info@ciqra.com.
12.5.6 Children and adolescents (Article 14 LGPD). CIQRA's Services are for businesses. CIQRA does not knowingly process personal data of children or adolescents as controller. Where a Merchant's Storefront processes such data, the Merchant is the controller and is responsible for the consent of a parent or guardian where the LGPD requires it, and for acting in the best interest of the child or adolescent.
12.5.7 Records of access and legal requests. CIQRA keeps records of access to its applications (date, time and source IP address) for at least six months, under restricted access and in a secure environment, which is consistent with the retention that Article 15 of the Brazilian Civil Rights Framework for the Internet (Lei 12.965/2014) requires of the providers to which it applies; this is not an acknowledgement that it applies to CIQRA. CIQRA discloses such records, or content, only in response to a valid legal request and informs the Merchant concerned where the law allows.
12.5.8 Security incidents. If a security incident that may cause relevant risk or damage to you affects data of which CIQRA is the controller, CIQRA notifies the ANPD and the affected data subjects within the period set by ANPD regulation (Resolution CD/ANPD No. 15/2024). Where CIQRA is the operator, it informs the Merchant as set out in the Data Processing Agreement.
12.5.9 Complaints. You may petition the ANPD (www.gov.br/anpd) against CIQRA as controller after lodging a request with us that was not answered within the legal period, and you may also contact the Estonian Data Protection Inspectorate (Section 9).
12.6 Türkiye
12.6.1 CIQRA OÜ is a company established in Estonia. CIQRA hosts the personal data it processes for Merchants on infrastructure in the European Union (Microsoft Azure, Germany); some of CIQRA's service providers process data elsewhere, as set out in the Subprocessor List. CIQRA's data-protection documents are based on the GDPR: the Data Processing Agreement and, for transfers outside the European Economic Area, the EU Standard Contractual Clauses. CIQRA offers no Türkiye-specific data-protection document.
12.6.2 A Merchant established in Türkiye, or that processes personal data of individuals in Türkiye, is the controller of its Shoppers' personal data. It is responsible for its own obligations under Law No. 6698 on the Protection of Personal Data (KVKK) and other Turkish law, including: the legal basis and any contract, consent or notification that Article 9 KVKK requires for transferring personal data abroad; information notices under Article 10 KVKK; registration in VERBİS where required; answering data subjects' applications; notifying data breaches to the Personal Data Protection Board and to data subjects; and consents and İYS registration for commercial electronic messages under Law No. 6563. CIQRA does not sign the standard contract announced by the Personal Data Protection Board and does not make notifications to the Board on a Merchant's behalf. CIQRA's templates are general tools and not legal advice.
12.6.3 An individual in Türkiye whose personal data CIQRA processes as controller (for example a Merchant's account contact) can exercise the rights described in Section 9 by writing to info@ciqra.com. This supplement is not an acknowledgment that KVKK applies to CIQRA directly.
12.6.4 Türkçe. CIQRA OÜ, Estonya'da kurulmuş bir şirkettir. CIQRA, Satıcılar adına işlediği kişisel verileri Avrupa Birliği'ndeki altyapıda (Microsoft Azure, Almanya) barındırır; CIQRA'nın bazı hizmet sağlayıcıları, Alt İşleyen Listesi'nde belirtildiği üzere verileri başka yerlerde işleyebilir. CIQRA'nın veri koruma belgeleri GDPR'a dayanır: Veri İşleme Sözleşmesi ve Avrupa Ekonomik Alanı dışına aktarımlar bakımından AB Standart Sözleşme Hükümleri; CIQRA Türkiye'ye özgü bir veri koruma belgesi sunmaz. Türkiye'de yerleşik olan veya Türkiye'deki kişilerin kişisel verilerini işleyen Satıcı, Alıcılarının kişisel verileri bakımından veri sorumlusudur ve 6698 sayılı Kişisel Verilerin Korunması Kanunu (KVKK) ile diğer Türk hukuku kapsamındaki kendi yükümlülüklerinden (KVKK m. 9 uyarınca yurt dışına aktarım için gerekli hukuki dayanak ile sözleşme, rıza veya bildirim; m. 10 aydınlatma; gerekli hâllerde VERBİS kaydı; ilgili kişi başvuruları; ihlallerin Kurul'a ve ilgili kişilere bildirilmesi; 6563 sayılı Kanun kapsamında ticari ileti onayları ve İYS kaydı) kendisi sorumludur. CIQRA, Kişisel Verileri Koruma Kurulu'nun ilan ettiği standart sözleşmeyi imzalamaz ve Satıcı adına Kurul'a bildirim yapmaz. CIQRA'nın şablonları genel araçlardır, hukuki danışmanlık değildir. CIQRA'nın veri sorumlusu olarak kişisel verilerini işlediği Türkiye'deki bir kişi, 9. Bölüm'de açıklanan haklarını info@ciqra.com adresine yazarak kullanabilir. Bu bölüm, KVKK'nın CIQRA'ya doğrudan uygulandığının kabulü anlamına gelmez. Bağlayıcı metin İngilizcedir.
13. Changes and contact
We may update this Policy from time to time. We will notify Merchants of material changes by email or in the dashboard before they take effect, and the date at the top of this Policy shows when it was last updated.
Contact: info@ciqra.com · CIQRA OÜ, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia.