CanItBuy Privacy Policy

1. Controller

Your personal data is controlled by Łukasz Mucek, correspondence address: pl. Piastów 3/5, 59-100 Polkowice, Poland. For anything about your data, write to hello@canitbuy.com.

2. What we process, why, and on what basis

• The email address you give when starting an agent test. We use it to run the test and to send the report link when that feature is enabled. Basis: performing the service you asked for (Art. 6(1)(b) GDPR). If you do not opt in to tips and offers, we do not store this address in any database.
• Email, store domain, language and scan score, only with consent. If you opt in, we store these in Brevo to send you CanItBuy tips and offers. Basis: your consent (Art. 6(1)(a) GDPR), given under electronic communications law. You can withdraw it at any time with the unsubscribe link or by writing to us. Withdrawal does not affect the lawfulness of earlier messages.
• Store domain, scan result and test report. The report contains screenshots of the tested store’s public pages and the agent’s steps. It does not contain your email. We also keep a per-domain test counter to enforce the one-free-test limit. Basis: performing the service (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
• IP address and technical request data. The server logs them, and we briefly use the IP address to limit the number of tests per address. Purpose: security, abuse prevention and fixing errors. Basis: legitimate interest (Art. 6(1)(f) GDPR).
• Correspondence. If you write to us, we process your address and message to reply or handle a complaint. Basis: legitimate interest (Art. 6(1)(f) GDPR).

3. Who receives data

We use providers that process data on our behalf and on our instructions:

• Vercel Inc. (USA): hosting, report storage, server logs.
• Sendinblue SAS (Brevo) (France): report emails and the contact list of people who opted in.
• Cloudflare, Inc. (USA): domain services and forwarding of messages sent to hello@canitbuy.com.
• AI model providers (e.g. OpenAI, Anthropic, Google) used by the agent through Vercel AI Gateway. They receive screenshots and content of the tested store’s public pages. We do not send them your email.

We may also disclose data to public authorities where the law requires it.

4. Transfers outside the European Economic Area

Vercel and Cloudflare are based in the USA, so data may be transferred outside the EEA. Transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified companies or on standard contractual clauses approved by the European Commission. We will share details of the safeguards on request.

5. How long we keep data

• Email given without marketing consent: not stored by us. Brevo keeps the delivery log of the report email for the period set by its own rules.
• Data of people who opted in: until consent is withdrawn.
• Reports and screenshots: up to 12 months after the test, then deleted automatically. We will delete a report sooner on request.
• Server logs: for a short period set by the hosting provider.
• Correspondence: until the matter is resolved, then until any claims become time-barred.

6. Your rights

You have the right to:

• access your data and get a copy,
• rectify it,
• erase it,
• restrict processing,
• data portability for data processed on the basis of consent or contract,
• object to processing based on legitimate interest,
• withdraw consent at any time.

To use these rights, write to hello@canitbuy.com. You can also complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority in your EU country.

7. Do you have to give data

Giving your email is voluntary, but you cannot start an agent test without it. The store scan needs no personal data. Consent to tips and offers is optional and does not affect the test.

8. Automated decisions

The test score is produced automatically, but it rates the store, not you, and has no legal effect on you. We do not profile users.

9. Cookies

The Service uses no cookies and no analytics or advertising tools. Fonts are served from our own server, not from third parties. If this changes, we will update this policy and ask for consent where the law requires it.

10. Changes

The current version is always on this page. We will email people subscribed to tips and offers about material changes.