Legal
Privacy policy
This policy explains which personal data we process when you use our website, free scan and app, and which rights you have under the GDPR. Placeholder: to be reviewed by counsel before launch.
1. Controller
The controller is the operator named in the imprint.
Contact for data protection questions: support@huntr-app.com
2. Data we process
- Account data: name, email, company name, hashed password (we never store plain passwords), role and membership.
- Usage and security data: session identifiers (stored only as hashes), IP-derived hashes for rate limiting and abuse prevention, audit log entries.
- Store data you connect: public catalog data of the store URL you enter; if you connect Shopify, product data and orders (order totals, referring site, landing page, UTM parameters). We do not need or store customer names or addresses from orders for attribution.
- Free scan: store URL, category and optional email address. With your consent (checkbox, confirmed with the link in the report email: double opt-in) we send up to three follow-up emails about the scan; every email has a one-click unsubscribe link.
- Billing data: purchases are processed by Paddle.com Market Limited (Paddle), our reseller and Merchant of Record. Paddle is an independent controller for the payment, tax and invoice data it collects at checkout; we store only Paddle customer and subscription identifiers, plan and status, never card numbers.
3. Purposes and legal bases
- Providing the service and your account — Art. 6 (1) (b) GDPR (contract).
- Security, fraud and abuse prevention, rate limiting — Art. 6 (1) (f) GDPR (legitimate interest in a secure service).
- Sending the free scan result or product emails you asked for — Art. 6 (1) (b) or (a) GDPR.
- Accounting and tax retention — Art. 6 (1) (c) GDPR (legal obligation).
5. Processors and recipients
Some processors are located outside the EU/EEA (notably the USA). Transfers rely on the EU-US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses.
- Cloudflare (hosting, database, storage, bot protection).
- Paddle.com Market Limited (reseller and Merchant of Record: checkout, payments, tax, invoices, subscriptions). Paddle processes checkout data under its own privacy policy.
- Resend (email delivery: transactional emails and, only with your consent, free-scan follow-up emails).
- Data providers for collecting AI answers (DataForSEO, cloro). We send them your prompts, country and language, not your account data.
- Anthropic (AI model). Used to analyse collected AI answers (prompts, answer text, public store and product information) and, if you use the data chat, to answer your questions: then your question and the results of the read-only data lookups for your store are sent, which can include aggregates such as visibility metrics and AI-referred order counts and revenue from your connected Shopify store. We do not send passwords, API keys or payment data.
- Shopify, if you connect your store.
6. Retention
We keep account data while your account exists. Free scan reports expire after 30 days. When you delete your account, we delete tenant data and stored raw answers; records we must keep for tax law are retained for the statutory period, and the audit log keeps a deletion entry without personal data.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time. You can delete your account yourself in the settings. You may also lodge a complaint with a data protection supervisory authority.
8. Changes
We update this policy when our processing changes. The date below shows the latest version.