Privacy Policy

The controller responsible for your personal data is:

For the personal data of buyers that we receive with a seller's orders, the seller is the controller and we process it on the seller's behalf (section 3).

2.1 Account and Sign-In Data

When you or your team create an account, we collect:

• Name and email address
• Your organisation's name, your role in it, and your settings
• Your two-factor authentication secret, stored encrypted
• If you sign in with Google, the name and email address Google shares with us
• Sign-in events, with their time and IP address

There are no passwords. You sign in with a single-use link that we email to you, valid for 15 minutes, or with your Google account, and every account must then complete two-factor authentication with a code from an authenticator app.

2.2 Billing Data

Your billing contact and the customer reference of our payment provider, Stripe. You enter your card details with Stripe; we do not store them.

2.3 Store and Marketplace Data

When you connect your stores and marketplace accounts, we process:

• Store and marketplace account identifiers, and the access tokens and credentials you authorise, stored encrypted
• Your product catalogue: titles, descriptions, images, prices, SKUs, categories, attributes, variants and stock
• Your listings and their status on each marketplace
• Your orders: order numbers, amounts, products, status and shipping country, and the buyer data described in section 3

2.4 Usage, Error and Security Data

When you use the application, we collect:

• Which pages and features you use, and what you click (section 11)
• Technical details of errors and of the requests that caused them
• Security events, such as sign-ins, two-factor checks, marketplace connections and data exports, with their time and IP address

2.5 Website Visitors

When you visit marqetir.com, our analytics tools receive your IP address, browser and device type, the pages you visit, the site that referred you, and how you interact with our pages (section 11).

2.6 Communication Data

When you email us, we keep your message, your contact details and our reply.

When a seller connects a marketplace such as Amazon, we receive the personal data of the seller's buyers that the marketplace provides with each order: name, shipping address, phone number, the marketplace's relay email address and, where provided, billing address. Where a seller handles buyer messages in the Service, we also process those conversations. For this data the seller is the controller, and Kyuroku d.o.o. processes it on the seller's behalf under our data processing agreement with the seller.

• We use buyer data only to fulfil and ship the seller's orders and to meet tax and legal requirements, such as the seller's invoices.
• Apart from the service providers that host and run the Service (section 6), we send it only to the systems the seller connects for that purpose, such as the seller's own store, ERP, webhooks or API clients, and we include the buyer's name in new-order emails to the seller.
• We never use buyer data for marketing, never sell it, never send it to an AI provider, and never use Amazon data to train AI models.
• We delete buyer personal data from orders automatically no later than 30 days after the order is delivered. For marketplaces that do not report delivery, such as Amazon, we count from the latest delivery date the marketplace promised the buyer. We keep only the shipping country, which the seller needs for VAT reporting.

If you bought from one of our sellers and want to exercise your rights, see section 10.

We use personal data for the following purposes:

4.1 Providing the Service

• Creating and managing your account and team, and signing you in
• Importing your product data, and creating, translating and publishing your listings on the marketplaces you choose
• Keeping stock and prices in step across your channels
• Importing your orders and sending them to the systems you connect for fulfilment
• Billing your subscription

4.2 AI Features

The Service uses AI providers to draft, optimise and translate listing content, map products to marketplace categories and attributes, and edit product images. AI providers receive product and listing content and product images only, never buyer data. Section 6.2 names them.

4.3 Communication

• Sending service emails: sign-in links, new-order notifications and billing messages
• Answering your support requests

4.4 Improving the Service

• Understanding which features are used, so we can improve them
• Finding and fixing errors

4.5 Security & Compliance

• Detecting and preventing fraud, abuse and security threats
• Complying with legal obligations, such as keeping tax records
• Enforcing our Terms of Service

We process your personal data on the following legal grounds:

You may object at any time to processing based on legitimate interest (section 10).

We do not sell personal data. We share it only with the service providers below, with the marketplaces and systems you connect, and where the law requires it.

6.1 Hosting, Email and Payments

• Hetzner Online GmbH (Germany): hosts the application and its database.
• Cloudflare, Inc.: protects and delivers web traffic to the application and the website; it may process data outside the EEA.
• Ploi (WebBuilds B.V., Netherlands): manages our server; hosted in Europe.
• Backblaze, Inc. (Backblaze B2, EU region in Amsterdam, Netherlands): stores our nightly database backups, encrypted with a key that only we hold.
• Brevo (Sendinblue SAS, France and Belgium): sends our emails to sellers.
• Stripe Payments Europe, Limited (Ireland): processes subscription payments, with transfers to Stripe, LLC in the United States.
• Google LLC (United States): Sign in with Google, if you choose it.

6.2 AI Providers

AI providers receive product and listing content and product images only, never buyer data.

• Google Cloud EMEA Limited (Gemini API): listing content and product images. Every AI request for an organisation that has ever connected Amazon goes only to Gemini. Google may store or cache requests transiently in any country where Google or its agents maintain facilities.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): listing content, only for organisations that have never connected Amazon. DeepSeek offers no data processing agreement or Standard Contractual Clauses, and its privacy policy says it stores data in China and uses it to train and improve its models.
• Replicate, LLC (United States): product image upscaling, only for organisations that have never connected Amazon. Replicate publishes no data processing agreement.
• OpenAI (United States) and xAI: configured as alternative providers for organisations that have never connected Amazon.

6.3 Analytics and Monitoring

• Sentry (Functional Software, Inc.): error monitoring for the application; error events are stored in Sentry's EU data region in Germany.
• PostHog, Inc.: product analytics for the application, and our central log platform for security and server logs (sign-ins, IP addresses and requests to the application), on PostHog's EU cloud in Frankfurt; PostHog's sub-processors handle some data in the United States.
• Google (Google Analytics and Google Tag Manager): website analytics.
• DataFast: website analytics.

6.4 Marketplaces and Your Own Systems

When you publish listings, we send your product data to your connected marketplaces through their APIs. On your instruction, we send orders, including buyer data, to the stores, ERP systems (such as Shopify, WooCommerce or MetaKocka), webhooks and API clients you connect. Each marketplace's and system's own terms govern what it does with the data.

6.5 Legal Requirements

We may disclose data when required by law, regulation, legal process, or governmental request, or to protect rights, property, or safety.

6.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

Our application and its database are hosted in Germany. Where a recipient processes personal data outside the European Economic Area (EEA), the transfer relies on:

• Cloudflare and Stripe: the EU Standard Contractual Clauses and the EU-US Data Privacy Framework
• Sentry and PostHog: the EU-US Data Privacy Framework
• Brevo's sub-processors in the United States: the EU Standard Contractual Clauses and the EU-US Data Privacy Framework
• OpenAI: the EU Standard Contractual Clauses in its data processing agreement
• Sign in with Google: Google's Controller-Controller Data Protection Terms

Two AI providers have no transfer safeguard: DeepSeek in China offers neither Standard Contractual Clauses nor a data processing agreement, and Replicate in the United States publishes no data processing agreement. That is why they receive product content only, never buyer data, and never for an organisation that has connected Amazon.

You may ask us for details of these safeguards at [email protected].

We keep personal data only as long as we need it for the purposes in this policy:

• Account data: while your account is active, and deleted within 30 days after you ask us to close it
• Data from Amazon: when you disconnect Amazon, we delete your Amazon access tokens at once and all other data we received from Amazon within 30 days
• Data from other marketplaces: when you close your account or revoke our access in a marketplace, we delete the data we received from that marketplace within 30 days of your request
• Buyer personal data in orders: deleted automatically no later than 30 days after the order is delivered (section 3)
• Billing records: up to 7 years, as tax and accounting law requires
• Logs: application logs for 7 days; the security event log for 13 months; security and server logs in our central log platform for 360 days
• Backups: data in our backups is deleted as the backups expire: we keep only the 14 most recent nightly encrypted database copies

You can ask us to delete your data earlier at any time, unless the law requires us to keep it.

We protect personal data with technical and organisational measures, including:

• Encryption of data in transit (HTTPS)
• Encrypted storage of marketplace access tokens and credentials
• Passwordless sign-in with mandatory two-factor authentication for every account; repeated wrong codes lock the account temporarily
• A web application firewall in front of the application
• A security event log of sign-ins and sensitive actions
• Incident response procedures for data breaches

While we take reasonable precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

As a data subject under the GDPR, you have the following rights:

Sellers and their team members can do most of this in the application, or by emailing [email protected].

Buyers of our sellers: because the seller controls your order data, we pass your request to that seller on the day we receive it and help them answer it. You may also write to us directly at [email protected]; please include your order number and the marketplace you bought on.

We answer within one month of receiving your request. Where the law allows us to extend this by up to two further months, we tell you why within the first month.

11.1 Essential Cookies

The website and the application use cookies that keep you signed in, protect forms against cross-site request forgery and remember your display settings. They cannot be switched off.

11.2 On Our Website (marqetir.com)

• Google Analytics, loaded through Google Tag Manager: page views and how visitors use the site
• DataFast: visitor analytics

These tools set cookies or similar identifiers and receive your IP address, browser and device details, the pages you visit and the site that referred you. Our pages also load fonts from Google Fonts and a badge image from indie.deals, so your browser sends your IP address to them.

11.3 In the Application (app.marqetir.com)

• PostHog (EU cloud): which pages and features are used, and clicks, without the text or attributes of what you click; page addresses are recorded without their query string
• Sentry: technical details of errors, for finding and fixing them

Until 14 October 2026 we also used Microsoft Clarity for session recordings and heatmaps in the application and on this website.

You can block or delete cookies through your browser settings. For more details, see our Cookies Policy.

The Service is designed for business use and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

We publish changes to this policy on this page, with the date of the update at the top.

For any question or request about your personal data, contact us:

We have not appointed a data protection officer. We answer within one month; if you are not satisfied with our answer, you can complain to the Information Commissioner of the Republic of Slovenia or to the data protection authority where you live or work.