Privacy Policy

1. Introduction

This policy describes how the Custela service processes users' personal data, and the personal data of people that appears on web pages we read or in answers from AI assistants (section 13). We comply with the GDPR (EU 2016/679) and Act No. 110/2019 Coll., on personal data processing.

2. Data controller

Data controller: Michael Cetl, IČO 08992207, DIČ CZ9911224664, registered office at Polní 131, 693 01 Strachotín. Contact: info@custela.com (hereinafter the “Provider”).

3. What personal data we process

• Registration data: name, email and password (stored as a hash), or details from your Google account when you sign in (name, email, profile picture).
• Billing data: processed by the payment gateway provider; the Provider works only with the limited data needed to issue an invoice (the Provider does not store card numbers).
• Data from connected services: when you connect Google Search Console and Google Analytics 4, authorization tokens (stored encrypted) and website performance data (queries, clicks, impressions, positions, traffic), plus connected domains and projects.
• Data from your Upgates store: if you activate the Custela add-on in your store administration on the Upgates platform, we read the store operator's contact email, first name, last name and country, the store address and default language, and the names of product categories. The contact email is used to create or connect your Account, the name to name the Account, the store address and language identify the website we measure and the language of the prompts, the country is used to set up the measuring, and the category names are used to build the AI prompts. We do not store other operator details that Upgates sends (company, company ID, address, phone, bank details). Store API credentials are stored encrypted, are never displayed or returned by any endpoint, and are deleted when the add-on is uninstalled. The add-on only reads your store data – it changes and creates nothing in your store and never touches products, prices, stock, orders or customers.
• Data from your Eshop-rychle store: if you activate the Custela add-on in your store administration on the Eshop-rychle platform, we read the store operator's contact email, first and last name, the country, the store address and the names of the main visible product categories. The contact email is used to create or connect your Account, to send you a sign-in link and to verify that the store operator has not changed; the operator email that the platform includes in its activation notice is used only to find your installation. The store address identifies the website we measure, and the category names are used to build the AI prompts. We do not process or store categories that are hidden or locked with a password. We do not read orders, customers, products, prices or stock levels; the add-on only reads data and changes nothing in your store.
• Data about your websites: details about your brand, industry, products and competitors (name, category, region) that we use to build the AI prompts, prompts you add or edit yourself, the AI assistants' answers to these prompts and the results of AI visibility measurements. Also the text of pages on your website that we read: the homepage when you add the website and after measurements, and pages you have us analyze, edit or suggest prompts from. This is primarily company and technical data, but it may contain personal data published on the website or appearing in the answers (section 13).
• Conversations with the Assistant: messages you write to the Assistant or in the “Ask the assistant” window, the replies, and for the Assistant also the actions it proposed and their results, including data from your account that it read to answer. The Assistant is an AI: its replies are written by a language model, not a person. We store conversations with the website in your account so you can return to them in the Assistant's history.
• Automatically collected data: IP address, browser and device type, logs, analytics data and cookies.
• Data from the free tools: when you run an AI visibility check on the website without signing up, we store the email address you enter, the domain being checked and the IP address the request came from. For the check we read the homepage of the domain and store the AI assistant's answers with the report. We also keep whether and when you confirmed your email address. The email is used to send you the report; the IP address is used only for the daily limit, so the tool cannot be drained automatically. We never display the IP address or pass it on.

4. Purposes and legal bases for processing

• Providing and running the Service: performance of the contract.
• Measurements and analyses in which personal data of other people appears: legitimate interest (section 13).
• Billing and accounting: performance of the contract and a legal obligation (retained for 10 years).
• Customer support: legitimate interest.
• Security and abuse prevention: legitimate interest.
• Improving the Service: legitimate interest (usually in anonymized form).
• Marketing and newsletter: consent, which you can withdraw at any time.

As part of customer support, the Provider may view your account in read-only mode, including your conversations with the Assistant; every such view is logged.

5. Recipients and processors

We use vetted processors to run the Service. We pass personal data to them only to the extent necessary:

• Database and authentication provider (USA): storing your Account and Service data, verifying sign-in.
• Hosting provider (USA): running the website and the application.
• Payment gateway provider (EU and USA): processing payments and subscriptions.
• Operators of AI assistants and language models (USA): AI visibility measurement, the Assistant and the “Ask the assistant” window, page analysis, content suggestions and text for tasks, keyword and article topic suggestions, and evaluating the answers from measurements. We send: prompts for measurement (built from details about the brand, industry, products, competitors and region, plus prompts you add or edit yourself); messages to the Assistant and in the “Ask the assistant” window, together with the data from your account they need to answer (such as website settings, measurement results, tasks and data from Search Console and Analytics); the text of pages AI works with and your writing instructions; keywords and Search Console queries; and the answers from measurements.
• Google services you connect yourself (USA): sign-in with Google and data from Search Console and Analytics 4.
• Search data provider (EU): search data (such as rankings and keyword search volume) and part of the AI visibility measurement. We send keywords, domains and measurement prompts (with the language and country of the measurement), not the email or name from your account.
• Email delivery provider (USA): transactional emails (reports, notifications, news, and tasks or articles you send or forward by email); we send the recipient's email address and the content of the message.

Any transfer of data outside the EU/EEA is covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses (SCC). A list of the specific processors and a copy of these safeguards are available on request at info@custela.com. We do not share data with other parties, except with your consent, where necessary to provide the Service, or where required by law.

In relation to the Custela add-on, the Upgates platform (operated by EVici webdesign s.r.o., company ID 28598661) is a source of data, not a recipient: the add-on only reads data from your store and we send no personal data back to the Upgates platform. Custela is an independent service and is not affiliated with the operator of the Upgates platform. You confirm the processing of data read from your store by giving consent when you first open the add-on.

The same applies to the Eshop-rychle platform (operated by Golemos s.r.o., company ID 05208777): the add-on only reads data from your store and we send no personal data back to the platform. Custela is an independent service and is not affiliated with the operator of the Eshop-rychle platform. You confirm the processing of data read from your store by giving consent when you connect the store to your Account.

6. Retention periods

• Active account data: for as long as the Account exists.
• Conversations with the Assistant: until you delete them, and at the latest until the website or the Account is deleted. For each website we keep at most the 30 most recent conversations (older ones are deleted automatically) and only the latest part of a long conversation. You can delete a website's whole history on the Assistant screen under History with “Delete all”, or ask the Assistant to do it. When your subscription ends, the Assistant screen is locked; you can then delete the history together with your Account in Settings, or email us at info@custela.com to have it deleted.
• After the Account is closed: 90 days, then erasure.
• Accounting records: 10 years (legal obligation).
• Google Search Console authorization tokens: until the integration is disconnected or the Account is closed.
• Logs and analytics data: up to 2 years, then anonymization.
• Checks from the free tools — 12 months, then deleted. Sooner on request.

7. Your rights

As a data subject you have the right to:

• access your personal data;
• have inaccurate data corrected;
• erasure (the "right to be forgotten");
• restriction of processing;
• data portability;
• object to the processing;
• withdraw your consent;
• lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

8. How to exercise your rights

Send your request to info@custela.com. We normally handle it within 30 days; in more complex cases this period can be extended by another 60 days. To protect your data, we may ask you to verify your identity.

9. Cookies and tracking technologies

We use essential cookies (sessions, sign-in), analytics cookies (usage measurement) and functional cookies (remembering your settings). You can manage cookies in your browser settings. Blocking some of them may affect how the Service works.

10. Security

We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS), password hashing, encryption of authorization tokens, access control, regular backups and incident monitoring.

11. Processing children's data

The Service is intended for people over 16. If we find that we have inadvertently processed data of a child under 16 without the consent of a legal guardian, we will delete such data.

12. Automated processing

The Service uses automated processing to measure AI visibility, evaluate the answers from measurements, analyze web pages and website performance, prepare content and task suggestions, and answer you in the Assistant. The Assistant is an AI, not a person: its replies are written by a language model and can be wrong. It carries out an action that changes something only after you confirm it in the app. This processing has no legal effect on the user and does not similarly significantly affect them; the suggestions, replies and measurement results are informational only and the user decides how to use them.

13. Personal data of other people on pages we read and in AI answers

When measuring and analyzing, we read publicly available web pages and store AI assistants' answers to measurement prompts. Pages and answers may contain personal data of people who do not use the Service, for example a name, job title or contact published on a website, the name of a sole trader who does business under their own name, or a signature under a review. We are not interested in specific people: we measure how AI assistants mention and cite brands, companies and websites.

• Where the data comes from: publicly available web pages that we read for measurements and analyses (mainly the website entered by a user or by a visitor of the free tools), and answers from AI assistants.
• Why and on what basis: AI visibility measurement, page analysis and content suggestions for users of the Service. The legal basis is the legitimate interest of users and the Provider in finding out how AI assistants mention and recommend their brand and improving their website accordingly (Art. 6(1)(f) GDPR).
• Who receives it: the categories of recipients in section 5, in particular operators of language models in the USA, which process the page text and the answers.
• How long: like the other website data in the user's account; for the free tools, like the checks from the free tools (section 6).

No automated decision-making with legal effects takes place in relation to these people. Informing each person mentioned individually would involve disproportionate effort (Art. 14(5)(b) GDPR), so we publish this information here. If this concerns you, you can exercise the rights in section 7, including the right to object, at info@custela.com. We do not store this data by people's names, so please tell us which website or page it concerns.

14. Changes to this policy

We may update this policy. We will inform you of significant changes by email or by a notice in the app. By continuing to use the Service after the changes take effect, you agree to the updated version.

15. Contact and supervisory authority

For matters concerning personal data, contact us at info@custela.com. The supervisory authority is the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.