Privacy Policy

1. Data Controller

The data controller is Szymon Bubała, operating StoreKite, an AI-powered e-commerce development service. Registered in Poland. Contact for privacy matters: [email protected]. Websites: storekite.ai and storekite.com.

2. What Data I Collect

I collect personal data in the following situations:

Data you provide directly:

• Name, email address, company name, and any other information you submit via my contact form
• Name, email address, company details, and scheduling preferences when you book a discovery call via Cal.com
• Any information you voluntarily share in email correspondence or during calls

Data collected automatically:

• IP address, browser type, operating system, and device type
• Pages visited. After you accept statistics, also time on page, scroll depth and clicks
• Campaign parameters from the page address (utm_*, gclid, fbclid and similar) and the referring site, read when you send the contact form

Statistics (Google Analytics 4 and, if enabled, Microsoft Clarity) and ad measurement (Google Ads, Meta) run only after you accept the matching category in the consent card. Section 5 explains what is set and when.

3. Legal Basis for Processing

I process your personal data on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): statistics cookies (Google Analytics 4 and Microsoft Clarity if enabled), ad measurement (Meta, Google Ads), including reporting a signed contract as an offline conversion (see Section 6), and any optional marketing communication
• Contract performance (Art. 6(1)(b)): processing necessary to deliver services you have engaged me for
• Legitimate interest (Art. 6(1)(f)): website security and prevention of abuse
• Legitimate interest (Art. 6(1)(f)): attaching campaign parameters from the page address to an inquiry you send, so that I know which ad brought it. You can object at any time (Art. 21), see Section 5
• Legal obligation (Art. 6(1)(c)): accounting records, invoicing, and tax compliance required by Polish law

4. Purposes of Processing

I use your personal data to:

• Respond to your inquiries, messages, and contact form submissions
• Schedule and conduct discovery calls and project consultations
• Deliver and manage my e-commerce development services
• Issue invoices and maintain required accounting records
• Analyse website traffic and measure ad results (after you accept tracking), and attribute each inquiry to the ad that brought it
• Comply with applicable legal obligations

5. Cookies and Analytics

The website uses cookies and similar technologies. Cookies are small text files stored on your device. Below I describe what is set, when, and why.

Technical Cookies

Technical cookies keep the website working. I do not use them for advertising or tracking. Three of them are set without consent: sk_consent with your cookie decision, the A/B test cookie sk-ab and sk-lang with the language you picked (see the list below).

Cookies: what is set and when

Below are the cookies and similar identifiers the website uses, grouped by consent category. The “Choose” window of the consent card shows the same list (“Show files”).

• sk_consent (essential, 12 months): your cookie decision, when you made it and the policy version it applies to. Without it the consent card would appear on every visit.
• sk-ab (essential, A/B test, 90 days): set by the site's edge middleware before you give consent. It holds a single letter, A or B, so that you see the same version of the /start page when you come back. The variant is attached to an inquiry only after you accept statistics.
• sk-lang (essential, 12 months): set when you switch the language in the menu. It holds en or pl, so that on your next visit the site opens in the language you chose. Without it, a browser set to Polish as its first language is sent to the Polish version of the page.
• _ga and _ga_<ID> (statistics, Google Analytics 4, up to 2 years): set only after you accept statistics. They tell visits apart. The analytics data itself is kept for 14 months.
• _gcl_au and _gcl_aw (ads, Google Ads, 90 days): set only after you accept ads. They store the identifier of an ad click, so that a conversion can be matched to it.
• _fbp and _fbc (ads, Meta, 90 days): set only after you accept ads. The Meta Pixel uses them to recognise your browser (_fbp) and an ad click (_fbc).

Two consent categories

The consent card on your first visit has three controls: “Accept” switches both categories on, “Reject” keeps essential cookies only, and “Choose” opens a window with a separate switch per category. Statistics means Google Analytics 4 (and Microsoft Clarity, if enabled). Ads means the Meta Pixel with the Conversions API and Google Ads conversion measurement. Until you decide, none of these tools runs. I store the decision in the sk_consent cookie; when I change this policy in a way that needs a fresh decision, the card appears again.

Google Analytics 4 (GA4)

I use Google Analytics 4 with IP address anonymisation, and Google Signals are switched off. Once you accept statistics, GA4 measures page views, clicks on calls to action, scroll depth, views of page sections, and contact form events (started, sent, error). No event contains your email address, name, phone number, or message text. Data is processed by Google LLC (USA), see Section 9. Analytics data is kept for 14 months. You can also opt out with the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).

Cloudflare Web Analytics (no cookies)

Traffic to the website passes through the Cloudflare network, which counts visits in Cloudflare Web Analytics. It works without cookies and without storing anything on your device, so it runs even without your consent. It records technical data only: the address of the page you viewed, the referring page, the browser type, your country and page load times. Cloudflare states that it does not identify individuals by IP address or browser and does not link visits across websites. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR) in knowing how many people visit the site and whether it loads fast. You can object to this (see section 8).

Campaign attribution of your inquiry

When you send the contact form, I read the campaign parameters in the page address (utm_*, gclid, gbraid, wbraid, fbclid, msclkid) and the referring site, and attach them to that inquiry only. Without consent, nothing is stored in your browser for this purpose. The legal basis is my legitimate interest in knowing which ad brought the inquiry (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR). After you accept ads, I also keep your first and last campaign touch in your browser (localStorage, keys sk_attr_f and sk_attr_l) for 90 days (older entries are deleted on your next visit), and I attach the number of pages you viewed and your time on site to the inquiry. Withdrawing the ads category deletes the stored values.

You can change your decision at any time. The “Cookie settings” link in the footer opens a window with a switch per category, and withdrawing consent is as easy as giving it: when you switch a category off, I delete its cookies and reload the page. You can also delete cookies in your browser settings. Blocking technical cookies may affect how the website works.

6. Third-Party Services and Recipients of Data

The following third-party services receive or process your personal data:

Cal.com (Meeting Scheduling)

When you book a discovery call, you use the Cal.com platform, a US company. Cal.com processes your name, email address and time preferences to book and handle the meeting. Data is transferred to the USA under standard contractual clauses (see Section 9). After booking, Cal.com may redirect you to my thank-you page. If you accept statistics, I record the booking there as a conversion in GA4; if you accept ads, also in Google Ads and Meta. The address of that page contains no personal data. Cal.com privacy policy: cal.com/privacy.

Google Analytics 4 / Google LLC

Google LLC (USA) processes data for Google Analytics 4 (traffic measurement after you accept statistics, 14-month retention, IP anonymisation, Google Signals switched off) and for Google Ads (conversion measurement after you accept ads, see below). For more information, see Google's Privacy Policy at policies.google.com/privacy.

Google Ads (conversion tracking)

After you accept ads, I send conversions to Google Ads: a sent contact form, a booked discovery call and a click on the booking link. A conversion carries the conversion identifier, its value in PLN and the inquiry identifier. Google Consent Mode v2 signals tell Google whether it may use the data for advertising. Unless Enhanced Conversions is enabled, a conversion contains no name, email address or phone number.

Meta Platforms (Ads Measurement)

After you accept ads, I send events to Meta Platforms Ireland Ltd. through the Meta Pixel and the Conversions API (sent from my server) to measure ad performance: PageView, Contact (click on the booking link), Schedule (call booked), and Lead (contact form sent). For Lead, your email address, phone number, first name, and last name are hashed (SHA-256) on my server before they are sent. Technical data (IP address, browser user agent, and the Meta cookies _fbp and _fbc) is sent as Meta requires. Without your consent to ads, no data is sent to Meta. The website itself does not store form submissions; they go to my automation (see Section 6). For more information, see Meta's Privacy Policy at facebook.com/privacy/policy.

Offline conversions: matching a signed contract to an ad (Google Ads and Meta)

If you accepted ads and your inquiry ends in a signed contract, I report that contract to Google Ads and Meta, so that the platforms know which ad brought a client, not just an inquiry. I then send: the ad click identifier read when you sent the form (gclid, gbraid, wbraid or fbclid), the inquiry identifier, the contract date, its value in PLN, and SHA-256 hashes of your email address and phone number, which Google and Meta compare with the data of their signed-in users. A SHA-256 hash is pseudonymisation, not anonymisation: the data remains personal data. I do not send your name, company name or message text. This happens no later than 90 days after the ad click and only if your consent to the ads category was in force when you sent the form (Art. 6(1)(a) GDPR); without that consent, no information about the contract reaches the ad platforms. You can withdraw consent and object to this transfer (Art. 21 GDPR) by writing to [email protected]; changing cookie settings in your browser is not linked to your inquiry, which is why I need a message. After withdrawal or objection I send nothing further. Data already sent to Google and Meta cannot be recalled individually, as they hold it hashed and aggregated. I keep contract data in my records for the periods in Section 7.

Lead processing: n8n, Gmail, and Google Sheets

A contact form submission goes to my automation tool, n8n. From there an email arrives in my mailbox ([email protected], Gmail in Google Workspace), and a new row is added to a Google Sheet (Google Workspace). The row contains the form data, the campaign parameters from the page address, the lead ID, an estimated lead value and, only if you accepted statistics, the A/B variant of the page. I keep lead rows until the inquiry is handled, and no longer than 24 months.

Cloudflare, Inc. (content delivery network and traffic statistics)

Traffic to the website passes through the network of Cloudflare, Inc. (USA), which protects the site against attacks, speeds up loading and provides the Cloudflare Web Analytics traffic statistics (see section 5). For this purpose Cloudflare processes technical request data, including your IP address, for the short time needed to serve the connection and keep the site secure. Transfers to the USA: see section 9. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

Vercel Inc. (Hosting)

The website is hosted on Vercel's infrastructure. Vercel may process server logs and technical request data as part of providing hosting services. For more information, see Vercel's Privacy Policy at vercel.com/legal/privacy-policy.

7. Data Retention

I retain personal data only for as long as necessary for the purpose for which it was collected:

• Contact form inquiries (lead rows): until the inquiry is handled, and no longer than 24 months
• Service agreement and project data: 5 years (required by Polish accounting and tax law)
• Analytics data: 14 months (as configured in Google Analytics 4)
• You may request deletion of your data at any time (subject to legally required retention periods)

8. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation and a copy of your personal data I process
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Right to restrict processing (Art. 18): request that I limit how I use your data
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)): withdraw any consent given at any time without affecting previous processing

To exercise any of these rights, contact me at [email protected]. I will respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority. In Poland: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. International Data Transfers

Some of the services listed above are operated by companies based in the United States: Google LLC (Google Analytics 4, Google Ads, Gmail, and Google Sheets), Meta Platforms (Meta Pixel and Conversions API), Cal.com, Vercel, Cloudflare and, if session recordings are enabled, Microsoft Corporation. When data leaves the European Economic Area, I rely on the standard contractual clauses approved by the European Commission and, where the recipient is certified, on the EU-US Data Privacy Framework.

10. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my practices or in applicable law. The date of the most recent update is shown at the top of this page. I encourage you to review it periodically.

11. Contact

For any questions, concerns, or requests about this Privacy Policy or the processing of your personal data, write to:

Email: [email protected]

Website: storekite.ai / storekite.com