Cenopis.pl Privacy Policy

1. Introduction

This Privacy Policy describes how data is processed when you use cenopis.pl, the app.cenopis.pl application and the Cenopis Copilot extension. It also explains what information is shared with infrastructure, AI, payment, analytics and customer-support providers.

2. Personal Data Administrator

The administrator of personal data is:

• Servil Viktor Vilchynskyi
• ul. Lawendowa 68c/2, 32-087 Zielonki
• contact@cenopis.pl

3. Data We Process

The scope depends on the features you use:

• Account and sign-in data: user ID, email address, display name, profile photo, sign-in provider, role, account creation date and last sign-in date.
• Profile and settings: language, theme, preferences, company and phone number if provided voluntarily, plus coin balance, plan and subscription status.
• Listing data: product name, source description, EAN or SKU, marketplace, condition, language, style, pricing, shipping details and other facts you provide.
• Generated content and history: titles, descriptions, categories, recommendations, quality-check results, manual edits and operation records.
• Images: uploaded product photos, their URLs, and variants generated or enhanced with Cenopis. Images used in history may be stored in Firebase Storage.
• Payment and billing data: Stripe customer, payment or subscription IDs, selected package, amount, currency and transaction status. Card details and BLIK authorization are handled by Stripe and are not stored by Cenopis.
• Technical and analytics data: IP address, device and browser type, visited pages, application events, errors, session identifiers, consent choice and approximate feature-usage data.
• Communications: newsletter email address, support messages and the content of conversations with support through Crisp.

4. Purposes of Processing

We process your data to:

• create and authenticate an account and retain user settings
• generate a title, description, price analysis, parcel suggestion, negotiation response or image variant
• save, edit and delete work history
• settle coins, payments and subscriptions and prevent abuse
• provide support, security, diagnostics and service stability
• measure feature usage and improve Cenopis
• send newsletters or marketing information when the user has consented

5. Legal Bases

Depending on the purpose, processing is based on:

• performance of a contract or steps before entering into a contract — Art. 6(1)(b) GDPR, particularly for accounts, generation, history and payments
• a legal obligation — Art. 6(1)(c) GDPR, particularly for accounting and billing records
• legitimate interests — Art. 6(1)(f) GDPR, such as security, fraud prevention, diagnostics and the establishment or defence of claims
• consent — Art. 6(1)(a) GDPR, for newsletters, marketing and optional analytics technologies that require consent

6. Providers and Data Recipients

We use providers only to the extent needed to operate the service:

• Google Firebase and Google Cloud — authentication, database, cloud functions, image storage, logs and Firebase Analytics
• Google Gemini — generation and analysis of text, prices, conversations and images
• OpenAI — selected assistant and content-generation features
• Stripe — card and BLIK payments, billing and subscriptions
• PostHog and Google Analytics — product and website analytics
• Crisp — chat and customer support
• Resend — transactional email and newsletter delivery
• Amazon Web Services, including Amplify and CloudFront — website and application hosting and delivery

7. AI Processing

Product data, instructions, conversation content and images are sent to the relevant AI provider only to perform the selected feature. Cenopis does not sell this content or use it to build advertising profiles. AI output is a draft and may contain mistakes, so users should verify the title, description, condition, price, images and marketplace compliance before publishing.

8. Cookies, Local Storage and Analytics

Cenopis uses necessary local storage and similar technologies for sign-in, language, theme and privacy choices. PostHog, Google Analytics, Firebase Analytics and Crisp may process device or session identifiers and service-usage information. Where required by law, optional technologies are activated on the basis of consent. Consent can be withdrawn for the future through available privacy settings or by clearing site data in the browser.

9. Infrastructure Location and Transfers Outside the EEA

Cenopis uses European regions for its primary database, production API and PostHog analytics. The location still depends on the type of data and service. If data is processed outside the European Economic Area, the transfer relies on an appropriate legal mechanism, such as an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses, depending on the provider and processing location. Current locations of the core services:

• primary Cloud Firestore database — Warsaw, Poland (europe-central2)
• production API backend — Belgium (europe-west1)
• PostHog analytics — European Union region
• user-uploaded files, including product photos — currently South Carolina, USA (us-east1)
• AI, payment, email, customer-support and global website-delivery providers may process data in other locations under their applicable terms and transfer safeguards

10. Retention

Account data, settings, history and stored images are kept while the account is used and then until deletion or the end of the period required for claims and backups. Billing records are retained for the period required by tax and accounting law. Newsletter data is processed until consent is withdrawn. Security and diagnostic logs are retained only as long as necessary for their purpose.

11. Your Rights

You have the right to:

• access your data
• rectify inaccurate data
• erase your data
• restrict processing
• receive or transfer data where applicable
• object to processing based on legitimate interests
• withdraw consent at any time without affecting earlier lawful processing
• lodge a complaint with the Polish supervisory authority, the President of UODO

To exercise your rights or request deletion of your account and history, email contact@cenopis.pl.

12. Data Security

We use access controls, authentication, encryption in transit, restricted permissions and monitoring tools. No online service can guarantee complete security, so use a unique password and do not include personal data in product fields unless it is necessary to prepare the listing.

13. Automated Decision-Making

Cenopis automatically creates drafts, recommendations and quality-check results, but it does not make decisions about users that produce legal or similarly significant effects. Users decide whether and how to publish a result.

14. Cenopis Copilot Extension

15. Changes to this Policy

We publish the current version on this page with the last-updated date. Where required, we will notify users in the application or by email about material changes affecting data already collected.

16. Contact

If you have questions regarding personal data processing, contact us:

• Email: contact@cenopis.pl
• Address: ul. Lawendowa 68c/2, 32-087 Zielonki, Poland