Privacy Policy

1. Who is responsible

The data controller is Online Mega Stores, Pagorkowa 26, 83-331 Przyjazn, Pomorskie, Poland, VAT PL9571022554, operating GMCBot as part of GMCFix.com. Contact: support@gmcfix.com.

2. What we collect

• The store address you submit, and whether you told us the account is suspended and how many reviews you have already requested. This is what the scan runs on.
• Publicly available content from that store: pages our crawler fetches, the same pages any visitor or search engine can reach.
• Your email address, when you ask to see results or make a purchase.
• The scan result itself: the score and the issues found.
• Merchant Center data, only if you connect an account: account status, product disapprovals, feed errors, shipping and return settings. Read only. We never write to your account.
• Basic technical data: IP address and request timing, used to enforce rate limits and prevent abuse.

We do not ask for, and do not want, your Google account password. We do not run a questionnaire about your business, and we do not collect identity documents.

3. Why we process it, and on what basis

• To run the scan and deliver the report: performance of a contract with you (GDPR Art. 6(1)(b)).
• To protect the service from abuse and control cost: our legitimate interest (Art. 6(1)(f)).
• To read your Merchant Center account: your explicit consent, given through Google's own authorisation screen and withdrawable at any time.
• To keep records of purchases: legal obligation (Art. 6(1)(c)).
• To measure how people find the site: your consent, given in the cookie banner and withdrawable at any time (Art. 6(1)(a)). Declining changes nothing about the scan.

4. How long we keep it

• Raw fetched page content: deleted within 48 hours of the scan completing. We keep the findings, not the copy of your website.
• Scan results and the associated email: kept while your account or report access exists, and deleted on request.
• Merchant Center access: revoked immediately when you disconnect.
• Payment records: kept as long as tax and accounting law requires.

5. Who else processes it

We use a small number of processors, each for one job:

• Google Cloud / Firebase: hosting, database, authentication.
• Anthropic: the AI model that reads fetched page content and returns findings.
• Stripe: payment processing. We never see or store your card details.
• Brevo: transactional email, including sign-in links.
• Cloudflare: bot protection on the scan form.
• Google (Tag Manager, Analytics, Ads): website analytics and advertising measurement. Loaded only if you agree in the cookie banner; see section 8.

Some of these operate outside the European Economic Area. Transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

We do not sell your data. Your store address, scan results, email and Merchant Center data are never shared for advertising, they go only to the processors above, each for the one job listed. If you agree to advertising cookies, Google receives browsing signals about your visit for ad measurement; that is separate from your scan data, and declining it changes nothing about the scan.

6. Content sent to the AI model

Analysis works by sending fetched page content to the model as data to be examined. It is never given the ability to act on your behalf, and it never receives your Merchant Center credentials or access token. Content is sent for the purpose of producing your report and is not used to train models.

7. Your rights

If the GDPR applies to you, you can request access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what was done before.

Write to support@gmcfix.com. You also have the right to complain to a supervisory authority, in Poland, the President of the Personal Data Protection Office (UODO).

If you are a California resident, you have comparable rights to know, delete and opt out of sale. We do not sell personal information.

8. Cookies and analytics

Always on, because the site cannot work without them: a session cookie for sign-in, and local browser storage that remembers a store address you typed before the scan ran and the cookie choice you made here.

Only after you agree: analytics and advertising tags loaded through Google Tag Manager, which we use to understand how people find us and which of our ads bring visitors who go on to scan a store.

These are switched off by default. Nothing analytics- or advertising-related runs until you choose it in the cookie banner, the site sets Google's consent signals to "denied" before any Google tag loads, and only changes them if you agree. You can decline everything except the essential cookies and the scan still works exactly the same. There is no <noscript> tracking fallback: with JavaScript off there is no way to ask for or honour your choice, so we load nothing.

To withdraw consent, clear this site's cookies and site data in your browser; the banner will ask again on your next visit.

9. Scanning a website

When you submit a store address, our crawler requests publicly available pages from it, identifying itself as GMCBot. Please only scan sites you own or are authorised to test.

10. Changes

We update this policy when the service changes. The date at the top shows the last revision. Website: https://gmcbot.com/contact