Privacy Policy

1. Introduction

This policy describes how the Custela service processes users' personal data. We comply with the GDPR (EU 2016/679) and Act No. 110/2019 Coll., on personal data processing.

2. Data controller

Data controller: Michael Cetl, IČO 08992207, DIČ CZ9911224664, registered office at Polní 131, 693 01 Strachotín. Contact: info@custela.com (hereinafter the “Provider”).

3. What personal data we process

• Registration data: name, email and password (stored as a hash), or details from your Google account when you sign in (name, email, profile picture).
• Billing data: processed by the Stripe payment gateway; the Provider works only with the limited data needed to issue an invoice (the Provider does not store card numbers).
• Data from connected services: when you connect Google Search Console and Google Analytics 4, authorization tokens (stored encrypted) and website performance data (queries, clicks, impressions, positions, traffic), plus connected domains and projects.
• Data about your websites: details about your brand, industry and products (name, category, region) that we use to build the AI prompts, and the results of AI visibility measurements. This is primarily company and technical data, but it may occasionally contain personal data published on the website.
• Automatically collected data: IP address, browser and device type, logs, analytics data and cookies.

4. Purposes and legal bases for processing

• Providing and running the Service: performance of the contract.
• Billing and accounting: performance of the contract and a legal obligation (retained for 10 years).
• Customer support: legitimate interest.
• Security and abuse prevention: legitimate interest.
• Improving the Service: legitimate interest (usually in anonymized form).
• Marketing and newsletter: consent, which you can withdraw at any time.

5. Recipients and processors

We use vetted processors to run the Service. We pass personal data to them only to the extent necessary:

• Supabase Inc. (USA): authentication and database.
• Vercel Inc. (USA): hosting and running the application.
• Stripe (Stripe Payments Europe / Stripe, Inc.): payment processing.
• OpenAI, L.L.C. (USA): visibility measurement in ChatGPT (we send prompts built from the brand name, industry and region).
• Anthropic, PBC (USA): visibility measurement in Claude, sentiment evaluation and AI content suggestions.
• Google LLC (USA): measurement in Gemini, the Search Console and Analytics 4 APIs, and sign-in with Google.
• Perplexity AI, Inc. (USA): visibility measurement in Perplexity (we send prompts built from the brand name, industry and region).
• DataForSEO: ranking data (we send keywords and domains, not users' personal data).
• Postmark (ActiveCampaign, LLC, USA): sending transactional emails (weekly reports, notifications, news); we send the email address and the report content.

Any transfer of data outside the EU/EEA is covered by the EU-U.S. Data Privacy Framework and/or standard contractual clauses (SCC). We do not share data with other parties, except with your consent, where necessary to provide the Service, or where required by law.

6. Retention periods

• Active account data: for as long as the Account exists.
• After the Account is closed: 90 days, then erasure.
• Accounting records: 10 years (legal obligation).
• Google Search Console authorization tokens: until the integration is disconnected or the Account is closed.
• Logs and analytics data: up to 2 years, then anonymization.

7. Your rights

As a data subject you have the right to:

• access your personal data;
• have inaccurate data corrected;
• erasure (the "right to be forgotten");
• restriction of processing;
• data portability;
• object to the processing;
• withdraw your consent;
• lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

8. How to exercise your rights

Send your request to info@custela.com. We normally handle it within 30 days; in more complex cases this period can be extended by another 60 days. To protect your data, we may ask you to verify your identity.

9. Cookies and tracking technologies

We use essential cookies (sessions, sign-in), analytics cookies (usage measurement) and functional cookies (remembering your settings). You can manage cookies in your browser settings. Blocking some of them may affect how the Service works.

10. Security

We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS), password hashing, encryption of authorization tokens, access control, regular backups and incident monitoring.

11. Processing children's data

The Service is intended for people over 16. If we find that we have inadvertently processed data of a child under 16 without the consent of a legal guardian, we will delete such data.

12. Automated processing

The Service uses automated processing to measure AI visibility, evaluate sentiment, analyze website performance and prepare content suggestions. This processing has no legal effect on the user and does not similarly significantly affect them; the suggestions and measurement results are informational only and the user decides how to use them.

13. Changes to this policy

We may update this policy. We will inform you of significant changes by email or by a notice in the app. By continuing to use the Service after the changes take effect, you agree to the updated version.

14. Contact and supervisory authority

For matters concerning personal data, contact us at info@custela.com. The supervisory authority is the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.