Legal documents

Privacy Policy

Effective from 21 August 2026

Terms of Service Privacy Policy

1. Introduction

This policy describes how the Custela service processes users' personal data. We comply with the GDPR (EU 2016/679) and Act No. 110/2019 Coll., on personal data processing.

2. Data controller

Data controller: Michael Cetl, IČO 08992207, DIČ CZ9911224664, registered office at Polní 131, 693 01 Strachotín. Contact: info@custela.com (hereinafter the “Provider”).

3. What personal data we process

  • Registration data: name, email and password (stored as a hash), or details from your Google account when you sign in (name, email, profile picture).
  • Billing data: processed by the Stripe payment gateway; the Provider works only with the limited data needed to issue an invoice (the Provider does not store card numbers).
  • Data from connected services: when you connect Google Search Console and Google Analytics 4, authorization tokens (stored encrypted) and website performance data (queries, clicks, impressions, positions, traffic), plus connected domains and projects.
  • Data from your Upgates store: if you activate the Custela add-on in your store administration on the Upgates platform, we read the store operator's contact email and name, the company name, the store address and the names of product categories. The contact email is used to create or connect your Account, the store address identifies the website we measure, and the category names are used to build the AI prompts. Store API credentials are stored encrypted, are never displayed or returned by any endpoint, and are deleted when the add-on is uninstalled. The add-on never changes your store data — it does not touch products, prices, stock, orders or customers. The one thing it creates is a notification subscription (webhook) for category and language changes, so it does not have to download data repeatedly; Upgates deletes it when the add-on is deactivated.
  • Data from your Eshop-rychle store: if you activate the Custela add-on in your store administration on the Eshop-rychle platform, we read the store operator's contact email, first and last name, the company name, the country, the store address and the names of the main visible product categories. The contact email is used to connect your Account and to verify that the store operator has not changed; the store address identifies the website we measure, and the category names are used to build the AI prompts. We do not read or store categories that are hidden or locked with a password. We do not read orders, customers, products, prices or stock levels, and we change none of them. The only thing the add-on creates in your store is a notification subscription (webhook) for category and language changes, so it does not have to download them repeatedly; Upgates deletes it when the add-on is deactivated.
  • Data about your websites: details about your brand, industry and products (name, category, region) that we use to build the AI prompts, and the results of AI visibility measurements. This is primarily company and technical data, but it may occasionally contain personal data published on the website.
  • Automatically collected data: IP address, browser and device type, logs, analytics data and cookies.

4. Purposes and legal bases for processing

  • Providing and running the Service: performance of the contract.
  • Billing and accounting: performance of the contract and a legal obligation (retained for 10 years).
  • Customer support: legitimate interest.
  • Security and abuse prevention: legitimate interest.
  • Improving the Service: legitimate interest (usually in anonymized form).
  • Marketing and newsletter: consent, which you can withdraw at any time.

5. Recipients and processors

We use vetted processors to run the Service. We pass personal data to them only to the extent necessary:

  • Supabase Inc. (USA): authentication and database.
  • Vercel Inc. (USA): hosting and running the application.
  • Stripe (Stripe Payments Europe / Stripe, Inc.): payment processing.
  • OpenAI, L.L.C. (USA): visibility measurement in ChatGPT (we send prompts built from the brand name, industry and region).
  • Anthropic, PBC (USA): visibility measurement in Claude, sentiment evaluation and AI content suggestions.
  • Google LLC (USA): measurement in Gemini, the Search Console and Analytics 4 APIs, and sign-in with Google.
  • Perplexity AI, Inc. (USA): visibility measurement in Perplexity (we send prompts built from the brand name, industry and region).
  • DataForSEO: ranking data (we send keywords and domains, not users' personal data).
  • Postmark (ActiveCampaign, LLC, USA): sending transactional emails (weekly reports, notifications, news); we send the email address and the report content.

Any transfer of data outside the EU/EEA is covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses (SCC). We do not share data with other parties, except with your consent, where necessary to provide the Service, or where required by law.

In relation to the Custela add-on, the Upgates platform (operated by EVici webdesign s.r.o., company ID 28598661) is a source of data, not a recipient: the add-on only reads data from your store and we send no personal data back to the Upgates platform. Custela is an independent service and is not affiliated with the operator of the Upgates platform. You confirm the processing of data read from your store by giving consent when you first open the add-on.

The same applies to the Eshop-rychle platform (operated by Golemos s.r.o., company ID 05208777): the add-on only reads data from your store and we send no personal data back to the platform. Custela is an independent service and is not affiliated with the operator of the Eshop-rychle platform. You confirm the processing of data read from your store by giving consent when you connect the store to your Account.

6. Retention periods

  • Active account data: for as long as the Account exists.
  • After the Account is closed: 90 days, then erasure.
  • Accounting records: 10 years (legal obligation).
  • Google Search Console authorization tokens: until the integration is disconnected or the Account is closed.
  • Logs and analytics data: up to 2 years, then anonymization.

7. Your rights

As a data subject you have the right to:

  • access your personal data;
  • have inaccurate data corrected;
  • erasure (the "right to be forgotten");
  • restriction of processing;
  • data portability;
  • object to the processing;
  • withdraw your consent;
  • lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

8. How to exercise your rights

Send your request to info@custela.com. We normally handle it within 30 days; in more complex cases this period can be extended by another 60 days. To protect your data, we may ask you to verify your identity.

9. Cookies and tracking technologies

We use essential cookies (sessions, sign-in), analytics cookies (usage measurement) and functional cookies (remembering your settings). You can manage cookies in your browser settings. Blocking some of them may affect how the Service works.

10. Security

We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS), password hashing, encryption of authorization tokens, access control, regular backups and incident monitoring.

11. Processing children's data

The Service is intended for people over 16. If we find that we have inadvertently processed data of a child under 16 without the consent of a legal guardian, we will delete such data.

12. Automated processing

The Service uses automated processing to measure AI visibility, evaluate sentiment, analyze website performance and prepare content suggestions. This processing has no legal effect on the user and does not similarly significantly affect them; the suggestions and measurement results are informational only and the user decides how to use them.

13. Changes to this policy

We may update this policy. We will inform you of significant changes by email or by a notice in the app. By continuing to use the Service after the changes take effect, you agree to the updated version.

14. Contact and supervisory authority

For matters concerning personal data, contact us at info@custela.com. The supervisory authority is the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.