Privacy Policy

Last updated 30 September 2026.

This policy explains what Async.Shop does with personal data collected through async.shop, its live demo at demo.async.shop and the demo admin at demoadmin.async.shop — why, on what legal basis, and what you can require of us. It is written to satisfy Articles 13 and 14 of the General Data Protection Regulation (GDPR). If anything here is unclear, ask us.

Who is responsible

The controller of your personal data is IHAR FINCHUK, operating Async.Shop (VAT/tax no. PL5223211274), a sole trader registered in Poland, at ul. Floriańska 6/02, 03-707 Warszawa, Poland. You can reach us about anything in this policy at [email protected] — it reaches a person.

We have not appointed a Data Protection Officer. Our processing does not meet the thresholds in Article 37 that require one: we do not carry out large-scale systematic monitoring, and we do not process special categories of data.

What we collect

Quote requests. Your work email address, and — if you give them — your name, your company, and what you told us about your business and what should get better.
Assistant conversations. The messages you send to the chat assistant on this site and its replies. If you ask to talk to a person, the name and email address you give us for that.
What you type into the demo. The demo is public: other visitors can open the demo admin and read what was sent. So on the demo, names, email addresses and phone numbers are replaced with placeholders before anything is stored. Free text is kept as you wrote it — please don't put personal data in it. All demo data is reset every night.
Visit statistics. Pages viewed, the site that referred you, browser, operating system and device type, country, and named actions such as "a quote was sent" or "the guided tour was completed". See how statistics work below — no cookies, no profile of you.
Technical data. Your IP address, browser type and timestamps, recorded when your browser talks to our servers. Ordinary server logging, kept short, used to keep the service running and secure.

Why we process it, and on what legal basis

To answer your quote request and prepare an offer — steps taken at your request before a contract, Article 6(1)(b). An AI model reads the request to summarise it, classify it and draft a first reply; a person reads every reply before it is sent.
To answer the questions you ask the assistant — our legitimate interest in answering visitors' questions about our services, Article 6(1)(f). Handing you over to a person when you ask for one is a step at your request, Article 6(1)(b).
To understand which pages and features are useful — visit statistics, our legitimate interest under Article 6(1)(f). The data is aggregate and cannot identify you; you can object at any time.
To keep the service secure and working — rate limiting, abuse prevention, diagnosing faults. Legitimate interest, Article 6(1)(f). The data is technical, short-lived, and not used to build any profile of you.

We do not use your data for advertising, we do not sell it, and we do not send marketing email unless you have asked for it.

The AI assistant and AI processing

The chat on this site is an AI system, not a human. We state this here and in the chat itself, as Article 50 of the EU AI Act requires. It answers from content we have published and shows the sources it used; it can still be wrong. When it is not sure, or whenever you ask, it hands the conversation to a person.

To answer you, your messages and the relevant parts of our content are sent to Ollama, which runs the language model on our behalf as a processor under a data processing agreement. The same model summarises and classifies quote requests. OVHcloud AI Endpoints (in the EU) compute the search index of our content and check incoming messages for abuse. Your conversations are not used to train anyone's model.

The assistant and the quote triage produce suggestions. Neither makes a decision that produces legal effects for you or similarly significantly affects you, so Article 22 GDPR — automated individual decision-making — does not apply.

How statistics work

We count visits with Plausible Analytics, which we run on our own server — the data never goes to an analytics company. It sets no cookies and stores nothing on your device. To tell one visitor from another within a day, it combines your IP address and browser identifier with a random value that is replaced every 24 hours, and keeps only the resulting code; the IP address itself is not stored, and yesterday's visitor cannot be matched to today's. Your country is looked up from the IP address at the time of the visit.

Who else sees your data

We disclose personal data only to processors acting on our instructions under Article 28 contracts, and only as much as each needs:

Our hosting, database and storage providers, which run and store the service in the European Economic Area.
Cloudflare, which delivers this site and protects it from attacks — it handles your IP address and requests on our behalf.
Ollama, for assistant replies and quote summaries, as described above.
OVHcloud, for the AI search index and abuse checks, as described above.

Email is sent and received on our own mail server. We do not sell personal data, we do not share it with data brokers, and we run no advertising trackers. We may disclose data where the law compels us to, and will tell you unless legally forbidden.

Transfers outside the EEA

We keep data in the European Economic Area wherever we can. Where a processor operates outside it, the transfer is covered by the European Commission's Standard Contractual Clauses together with an assessment of the destination country's law, or by an adequacy decision. Ask us at [email protected] for the current list of processors and the safeguard each one relies on.

How long we keep it

Quote requests — deleted automatically three months after the last message about them. Ask us and we delete them sooner.
Assistant conversations — deleted automatically after 30 days.
Requests to talk to a person — while we deal with them and any follow-up; ask us and we delete them.
Demo data — reset every night.
Visit statistics — kept only as aggregate counts, which contain no personal data.
Server logs — a short operational window, then discarded.
Records we must keep by law — for the period the law specifies, and no longer.

Cookies and local storage

This site sets no advertising or analytics cookies and shows no cookie banner, because it stores nothing that requires your consent. Article 5(3) of the ePrivacy Directive allows storage that is strictly necessary for a service you asked for, and that is all there is:

Chat session — once you start a conversation, the assistant keeps its ID in your browser's local storage, so the conversation continues from page to page.
Demo preferences — the demo remembers whether you have seen its guided tour, and the demo admin keeps your demo sign-in while you use it.
Security — Cloudflare may set a short-lived cookie to tell people from bots. It is not used to track you.

Your browser settings can clear all of it at any time; the only effect is that an open chat starts over.

Your rights

Under the GDPR you may:

Access your data and get a copy of it.
Correct anything inaccurate.
Delete your data — the "right to be forgotten".
Restrict or object to processing, including any based on legitimate interest.
Port your data — receive it in a structured, machine-readable format.
Withdraw consent at any time, without affecting what was lawful before.

Write to [email protected]. We answer within one month, as Article 12(3) requires, and exercising these rights is free.

If you think we have got this wrong, you can complain to a data protection authority — in Poland the President of the Personal Data Protection Office (UODO), or the authority in your own country. You do not need to contact us first, though we can usually fix it faster.

Children

This site is for businesses and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has given us data, tell us and we will delete it.

Security

Data is encrypted in transit, and access to production systems is limited to the people who need it. No system is perfectly secure; if a breach puts your rights at risk we will notify you and the supervisory authority as Articles 33 and 34 require.

Changes

When this policy changes, this page and its date change with it. If a change materially affects data you have already given us, we will tell you by email before it takes effect.