Privacy Policy

1. Controller and contact

Zbigniew Orłowski, trading as Online Mega Stores, is the controller of personal data processed for GMCBot.com. GMCBot and GMCFix.com have the same owner. Our address and registration details are at the end of this policy. For privacy requests, email privacy@gmcfix.com.

2. Information and its sources

Account data: your Firebase account identifier, email address, verification and sign-in information; Google sign-in may also provide your basic profile name and picture. We do not receive your Google password. Google sign-in does not grant Merchant Center access, and direct Merchant Center integration is not currently available.

Scan questionnaire: store URL, suspension and review history, operator type, legal and trading names, proprietor name where relevant, address, country, phone, contact emails, business identifiers and declared address use. You provide this information so we can compare the website with the declared operator. Sign-in and the required questionnaire fields are necessary to run a scan.

Website and lookup evidence: publicly accessible page content, product information, business contact details and social links obtained from the store you submit, plus relevant address information returned by Google Places. This may include personal details of sole traders or other people published on the website. Scan results contain findings, scores, URLs, selected evidence and suggested corrections.

Payments and support: order and payment references, amount, currency, payment status and associated email; contact-form name, email, subject and message; support correspondence and, where relevant, referral or affiliate attribution and commission records. Stripe handles card entry; we do not receive full card numbers or security codes.

Technical information: request times, network and browser information, security and error logs, and information used for rate limiting and abuse prevention. Optional analytics and advertising measurement depend on your cookie choices. Do not submit passwords, identity documents, customer lists or unrelated sensitive information.

3. Purposes and legal bases

We use account details, questionnaire answers and scan evidence to provide the requested scan, report, re-scan and purchase support: performance of a contract or steps at your request before a contract (GDPR Article 6(1)(b)).

Where public business information or information supplied by a representative concerns another person, our basis is the legitimate interest in assessing the requested store’s transparency and accuracy (Article 6(1)(f)). Our legitimate interests also support security, abuse prevention, responding to general enquiries, resolving disputes and administering referral arrangements. You may object where this basis applies.

We retain required tax and accounting records to comply with legal obligations (Article 6(1)(c)). Optional analytics, advertising and related browser storage rely on consent (Article 6(1)(a)); you can refuse or withdraw it without losing access to the scan.

4. Automated analysis and access

Our scripts and AI generate the report without individual human review. The report is advisory: GMCBot does not make Google approval decisions, change your store or act on your Merchant Center account. You can report incorrect information and ask us to investigate.

Authorised staff may access account, scan and order information when needed for operation, support, security or complaints. Paid report access and private questionnaire data are restricted by access controls. Avoid sharing private report links or access credentials.

5. Service providers and international processing

Google Cloud and Firebase: hosting, database, authentication and email sign-in links. Google Places: address lookups; the declared address is sent to assess possible shared or virtual-office locations, not to obtain the history of Merchant Center accounts at that address.

Anthropic: AI analysis of selected website content and relevant declared operator information. Stripe: checkout, payment and refund processing. Brevo: delivery of contact-form messages. Cloudflare Turnstile: abuse protection for the contact form.

Google Tag Manager, Analytics and Ads: optional measurement according to your cookie choices. We do not sell personal data. We do not intentionally send questionnaire fields, report content or account emails to advertising tools. Where measurement is enabled, Google can receive browsing and interaction signals; URLs and referrers may also be processed by those tools.

Providers may process information outside the European Economic Area, including in the United States. Applicable safeguards depend on the provider and service, such as European Commission standard contractual clauses or an applicable adequacy decision. Contact us for information about the safeguards for a particular processing activity and how to obtain a copy. Payment and security providers may also process certain information for their own legal or fraud-prevention purposes under their own privacy notices.

6. AI data use and retention

Selected page content and relevant questionnaire information are sent to Anthropic’s commercial API to generate findings. The AI is not given your Google password, payment credentials or authority to change external accounts. GMCBot does not submit scan content as training feedback.

Anthropic’s commercial policy states that API data is not used for model training by default; explicit opt-ins and feedback are exceptions. Provider retention and safety review are governed by its commercial terms and data policies, including exceptions for safety and legal requirements. This service does not promise zero retention or that provider personnel can never review data. See Anthropic’s training policy and retention policy.

7. How long information is kept

Raw pages are processed during the scan; GMCBot does not routinely save a complete HTML archive. Selected excerpts, URLs, findings and operator details can remain in the stored report and questionnaire. Provider-side retention is separate, as explained above.

Account, questionnaire and report records are retained to provide your account and report access and handle related support. You may request account or report deletion. We may retain records still needed for a legal obligation, an active dispute or the establishment or defence of legal claims, and will explain any applicable restriction when handling your request.

Payment and accounting records are retained for the applicable statutory period. Security and operational records are kept according to their purpose and provider retention settings. Retention depends on continuing access, outstanding support or disputes and legal obligations; this policy does not promise automatic deletion of reports after a fixed number of days.

8. Cookies and browser storage

Authentication uses Firebase browser storage. We also store information needed to complete email sign-in, retain report access, remember your cookie choices and apply your chosen display theme. These mechanisms may use local storage or IndexedDB as well as cookies.

Optional analytics and advertising consent is denied by default. We load the Google Tag Manager container only after you allow analytics or advertising. Individual tags must respect the corresponding category consent. Events from before consent are not queued by GMCBot for later measurement.

You can choose Essential Only and still use the scanner. Use Cookie settings here or in the footer to review or withdraw consent. Withdrawing consent may reload the page to stop previously loaded tags. Browser settings also let you remove stored cookies and site data; removing authentication data may sign you out.

9. Your rights and complaints

Where GDPR applies, you can request access, correction, erasure, restriction and portability as applicable, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. We may need to verify your identity proportionately before disclosing or deleting information.

Email privacy@gmcfix.com to exercise your rights, including if your information appears on a scanned website. You can complain to the President of Poland’s Personal Data Protection Office (UODO), uodo.gov.pl, or another competent supervisory authority. Additional local privacy rights apply where the relevant law covers you and our processing.

10. Website scans and policy updates

Our crawler requests public pages and identifies itself as GMCBot. Submit only stores you own or are authorised to test. Providing business details does not authorise unrelated use of another person’s information.

We update this notice when processing changes and show the revision date above. Contact us if you need clarification about a particular scan or a previous version.

Operator and contact details