Privacy Policy

Last updated: October 12, 2026

This Privacy Policy (this “Policy”) describes how Open Mercato sp. z o.o., a company duly incorporated and existing under the laws of the Republic of Poland, with its principal place of business in Wroclaw (address: ul. Wyspa Słodowa 7, 50-266 Wroclaw, Poland; registered by the District Court for Wrocław-Fabryczna in Wroclaw, KRS no.: 0001253104; TIN (EU VAT) no.: PL8982336029; share capital: PLN 80,000.00; “we”) collects, uses, stores, and protects personal data for which we act as controller in connection with the services provided through our platform at https://openmercatocloud.com and its service subdomains (the “Services” and “Platform”, respectively), the browsing of our corporate website at https://openmercato.com (the “Site”), as well as our sales and marketing activities relating to the Services, (including responding to inquiries, maintaining business relationships, and sending product or company updates where permitted by law).

This Policy applies to the Platform and Site described above, including related Account, Dashboard, Sandbox, Support, sales, and marketing interactions.

It applies to the personal data of:

“Individual Customers”, meaning individuals who enter into a direct contractual relationship with us, including consumers and sole traders,
“Customer Representatives,” meaning individuals acting on behalf of a Customer,
“Authorized Users,” meaning, e.g., a Customer’s employees, contractors, or other personnel who access the Services under the Customer’s Account,
“Site Visitors,” meaning individuals who access or browse the Site without creating an Account,
“Prospects” and “Marketing Recipients,” meaning individuals who contact us, subscribe to updates, attend our events/webinars, download materials, or otherwise receive or may receive information about our Services.

This Policy does not apply to personal data that we process solely on a Customer’s behalf; information about such processing is provided by the relevant Customer.

We are committed to safeguarding your privacy in accordance with applicable data-protection laws, including the General Data Protection Regulation (the “GDPR”) and the California Consumer Privacy Act (the “CCPA”).

Capitalized terms used in this Policy, to the extent not defined herein, have the meanings assigned to them in our Terms of Service, which govern access to and use of the Platform and Services.

1. Information We Collect

We obtain personal data directly from you; from the Customer or Account administrator through whom you access the Services; automatically from your device, browser and use of the Services; from payment, analytics and other service providers; and, in relation to sales and marketing, from referrals, event organizers and publicly available professional sources.

Account Registration & Management (Individual Customers, Customer Representatives, and Authorized Users)

Contact and Identification Details: Name, email address, password hash, authentication identifier, SSO information and MFA status, role within the Customer’s organization.
Usage Data: Login history, IP address, device information, browser type, and access logs.
Subscription and Billing Data: subscription plan, billing contact details, billing address, invoice and tax information, transaction identifiers, payment status, and limited payment-method information received from the payment provider.

Site Browsing (Site Visitors)

Technical and Usage Data: IP address, cookies or similar technologies, browser information, pages viewed, and interactions on the Site, collected for analytics and security. We may also collect information about interactions with marketing content (e.g., campaign parameters) via cookies or similar technologies, subject to applicable consent requirements.

Communications and Support (All Categories)

Communications and Support: contact details, correspondence, support-ticket information, attachments, diagnostic information and other information provided in connection with an inquiry or support request.

AI Usage Data (Individual Customers and Authorized Users)

AI Usage Data: Account and Sandbox identifiers, selected Model, timestamps, token and AI Credit consumption, and technical request metadata processed for Account administration, billing, Service security, enforcement of usage limits and measurement of Service usage.

Marketing and Sales Communications (Prospects, Individual Customers, Customer Representatives)

Contact Details: name, business email, company name, job title, country, and related correspondence.
Lead Source Data: how you came into contact with us (e.g., website form, event/webinar registration, referral, business card, inbound inquiry).
Marketing Preferences: subscription status, communication preferences, and opt-out history.

Product Analytics

Product Analytics Data: predefined interaction events, URL paths without query strings or fragments, and any Account, user, device, session or network identifiers actually transmitted to PostHog, including the Account identifier of a signed-in user. Form contents are not intentionally sent to PostHog.
Site Analytics Data: on the public pages of the Platform, pages viewed, interactions, approximate location derived from the IP address, device and browser information, and the cookie identifiers set by Google Analytics.

Service Telemetry (All Categories)

Service Telemetry Data: we operate our own telemetry tool, hosted on our infrastructure, to keep the Services running and to detect and diagnose failures. It receives predefined events (page views recorded as route patterns without identifiers, sign-up and login together with the method used, Sandbox creation together with the selected template, Sandbox deletion, start and pause, checkout steps, and AI request routing performance), and error reports (error type, message, stack trace, application version and component), from which email addresses and URL query strings are removed before storage. Each event or report is associated with a randomly generated installation identifier or, where none is available, with the Account identifier. This data is pseudonymous, not anonymous.
Service Telemetry does not include the contents of a Sandbox: we do not collect source code, files, terminal input or output, prompts, or other User Data through this tool.

Cookies and Similar Technologies

We set analytics cookies and similar technologies only after you allow them in the cookie banner. You can change your choice at any time through “Cookie settings” at the bottom of the public pages or “Cookies” in the Dashboard. Without your consent, only the cookies needed to run the Platform are set.

Needed to run the Platform:

Session and security cookies: cookies required to sign in, keep a session, and control access to Sandbox applications.
Consent choice: the cookie “sandboxes_consent”, set on the Platform domain and its service subdomains for 180 days. It records whether you allowed analytics cookies, so that we do not ask on every visit.
Template choice: the cookie “sandbox_template”, set on the public pages for up to 30 days when you open a page that presents a specific Sandbox template, and the cookie “sandbox-template-intent”, set in the Dashboard for up to 7 days. They hold only the name of the template, so that the Sandbox you create after signing up starts from it.

Set only with your consent:

Installation identifier: the cookie “sandboxes_sid”, set on the Platform domain and its service subdomains for up to 400 days and mirrored in the browser’s local storage under “sandboxes:sid”. It holds a random identifier that links Service Telemetry events from the public pages, the Dashboard and our API to one browser. Without your consent, the identifier lasts only for the page you are on and is not stored on your device.
PostHog: cookies and local-storage entries set by the PostHog library to recognize a browser across visits.
Google Analytics: the “_ga” and “_ga_[ID]” cookies, set on the public pages of the Platform for up to two years.

If you take your consent back, we remove these analytics cookies and local-storage entries from your browser. You can also delete or block cookies and local-storage entries in your browser settings; blocking session and security cookies will prevent signing in.

Other Voluntarily Provided Data

Other Information You Provide: information voluntarily provided in connection with an Account, contractual relationship, survey, inquiry, support interaction or another activity described in this Policy.

2. Purposes of Processing

We process personal data for the following purposes:

Provision of Services: creating and managing Accounts, authenticating users, and administering subscriptions and payments, enabling access to the Services, measuring usage, applying usage limits, and administering AI Credits.
Authorized User Access: enabling the Customer’s designated personnel to use the Platform.
Platform Functionality and Improvement: ensuring the Platform and Site operate properly, maintaining continuity of the Services, detecting and diagnosing errors and outages, performing usage analytics, optimizing experience, and improving our offerings.
Marketing of Our Services and Relationship Management: sending information about our Services (such as product updates, releases, events, webinars, and educational materials), managing leads and business relationships, and measuring the effectiveness of our communications, in each case where permitted by applicable law and subject to your choices (including opt-out).
Security and Fraud Prevention: monitoring access logs, detecting unauthorized activity, and protecting system integrity.
Legal Compliance: meeting obligations under applicable laws or enforcing our Terms of Service.

3. Legal Bases for Processing

Our processing relies on one or more of the following legal bases under the GDPR:

Contractual Necessity: where the data subject is an Individual Customer, processing objectively necessary to enter into or perform the contract with that person, including Account administration, payment processing and provision of the requested Services.
Legitimate Interests: administering relationships with corporate Customers; enabling and securing access for Customer Representatives and Authorized Users; maintaining, troubleshooting and improving the Services using appropriate technical and usage data; preventing fraud and abuse; responding to inquiries; and marketing our Services to business contacts, provided that those interests are not overridden by the individual’s rights and interests.
Legal Obligation: compliance with laws and regulations (e.g., accounting or lawful requests).
Consent: for certain electronic marketing communications, cookies or tracking technologies that require it under law.

Contractual Necessity applies to Account and Service Administration and AI Usage Administration where the data subject is an Individual Customer. Legitimate Interests applies to administering access for Customer Representatives and Authorized Users, operating and improving the Site and Platform, maintaining security, preventing fraud and misuse, responding to inquiries, and conducting B2B marketing. Legal Obligation applies where processing is required by tax, accounting, regulatory or other applicable law. Consent applies where it is requested for non-essential analytics or marketing.

Where personal data is required to create an Account, enter into or perform a contract, authenticate access or process payment, providing that data is a contractual requirement. Without it, we may be unable to create or secure the Account, process payment or provide access to the Services. Where personal data is required by applicable law, providing it is a statutory requirement. Otherwise, providing personal data is voluntary.

4. Data Recipients and Transfers

(a) Internal Access. Personal data is accessed only by authorized personnel (e.g., support, finance, administration).

(b) Third-Party Service Providers. We share personal data covered by this Policy with trusted vendors who are contractually bound to protect it. These providers may include Hetzner, Amazon Web Services (“AWS”), and Daytona for infrastructure and Sandbox services; infrastructure selected by us for backups; Resend for email delivery; Cloudflare for bot protection at sign-up and sign-in; Stripe for payments; PostHog for product analytics; Google for analytics of the public pages of the Platform; OpenRouter and the relevant Model providers for AI Features; and providers of CRM, support, legal, accounting, webinar or event registration, marketing automation, advertising, or measurement services, subject to applicable consent requirements.

Hetzner is Hetzner Online GmbH, a German limited liability company with its registered office at Industriestr. 25, 91710 Gunzenhausen, Germany, registered with the Ansbach Registration Office under HRB 6089, VAT registration number DE 812871812. Hetzner provides infrastructure and related services and may be contacted at info@hetzner.com; its data-protection contact is data-protection@hetzner.com. Further information is available in Hetzner’s Legal Notice and Hetzner’s Privacy Policy.
AWS is provided by Amazon Web Services EMEA SARL, with its registered office at 38 Avenue John F. Kennedy, L-1855 Luxembourg, registered with the Luxembourg Trade and Companies Register under number B186284 and registered for VAT in Poland under NIP 1080022032, acting through its Polish branch, Amazon Web Services EMEA SARL spółka z ograniczoną odpowiedzialnością Oddział w Polsce, at Generation Park Z, 9th Floor, ul. Towarowa 28, 00-839 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under KRS number 0000700448. AWS provides infrastructure and related services. Further information is available in the AWS Europe FAQ, AWS Privacy Notice, and AWS Sub-processors list.
Daytona is Daytona Platforms Inc., a Delaware corporation with its address at 224 W 35th St, Ste 500 #297, New York, NY 10001, United States. Daytona provides Sandbox infrastructure and related services and may be contacted at support@daytona.io; its data-protection contact is privacy@daytona.io. Further information is available in Daytona’s Privacy Policy and Daytona’s DPA.
PostHog is PostHog Inc., with its address at 2261 Market Street #4008, San Francisco, CA 94114, United States. PostHog provides product analytics services and may be contacted about privacy matters at privacy@posthog.com. Further information is available in PostHog’s Privacy Policy, Terms of Service, and Data Processing Agreement.
Google is Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Google provides the Google Analytics service used on the public pages of the Platform. Further information is available in Google’s Privacy Policy and How Google uses information from sites that use its services.
OpenRouter is OpenRouter, Inc., a Delaware corporation with offices at 169 Madison Avenue, New York, NY 10016, United States. OpenRouter provides AI request routing and aggregation and may be contacted at support@openrouter.ai. Further information is available in OpenRouter’s Terms and OpenRouter’s Privacy Policy.
Cloudflare is Cloudflare, Inc., United States. Cloudflare provides the Turnstile bot protection used at sign-up and sign-in. Further information is available in Cloudflare’s Privacy Policy.

(d) International Transfers. Some recipients of personal data covered by this Policy are located outside the European Economic Area or may access the data from there. For each of them we rely on the following safeguards under Chapter V of the GDPR:

PostHog Inc. (United States): the EU-U.S. Data Privacy Framework, under which PostHog is certified, and the European Commission’s Standard Contractual Clauses in PostHog’s data processing agreement. Product analytics data is stored in PostHog’s EU cloud in Frankfurt, Germany.
Google LLC (United States), for Google Analytics provided by Google Ireland Limited: the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and the Standard Contractual Clauses in Google’s data processing terms.
Cloudflare, Inc. (United States): the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and the Standard Contractual Clauses in Cloudflare’s data processing addendum.
Plus Five Five, Inc., which operates Resend (United States): the EU-U.S. Data Privacy Framework, under which it is certified, and the Standard Contractual Clauses in Resend’s data processing agreement.
Stripe, LLC (United States), where payment data is transferred outside the European Economic Area: the EU-U.S. Data Privacy Framework, under which Stripe, LLC is certified, and the Standard Contractual Clauses in Stripe’s data processing agreement.
Daytona Platforms Inc. (United States): the Standard Contractual Clauses in Daytona’s data processing agreement.
OpenRouter, Inc. (United States): the Standard Contractual Clauses in OpenRouter’s data processing agreement.

Further information about these safeguards, including how to obtain a copy, may be requested using the contact details below.

5. Data Retention

(a) Standard Retention Periods. We retain personal data only for as long as necessary to fulfill the purposes above or as required by law, namely:

Individual Customer, Account, and Authorized User data: for the duration of the relevant Account or contractual relationship and thereafter for the applicable limitation, accounting and legal-retention periods.
Site Visitors: for the duration of the browsing session and analytics retention periods.
Communications Records: for a reasonable time to address inquiries or legal requirements.
Request and security logs, including failed sign-in attempts: 15 days.
Billing and tax records: for the periods required by Polish accounting and tax law, as a rule five years from the end of the calendar year in which the related tax became due.
Consent to marketing communications given at sign-up: until you withdraw it.
Marketing and Sales Records: until you opt out/withdraw consent, or for as long as we maintain an active business relationship, and thereafter for a limited period consistent with our retention practices and any applicable limitation periods.

(b) AI Usage Data is retained for the duration of the relevant Account or contractual relationship and thereafter only for applicable limitation, accounting, and legal-retention periods, after which it is deleted or anonymized, subject to applicable backup periods.

(c) Service Telemetry Data is retained for as long as it is needed to monitor the operation of the Services and to diagnose and resolve failures, after which it is deleted or aggregated so that it no longer relates to an identifiable person. The installation identifier cookie expires after up to 400 days.

(d) Deletion and Anonymization. After retention expires, data is securely deleted or anonymized.

6. Automated Decision-Making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Sign-up and sign-in are protected by an automated bot check (Cloudflare Turnstile), and our payment provider may screen payments for fraud. If such a check stops you, contact us and a person will review it.

7. Data Security

We implement appropriate technical and organizational measures to safeguard personal data from unauthorized access or destruction. These include encryption (where applicable), role-based access controls, secure storage, and regular security assessments.

9. Your Rights Under CCPA

If you are a California resident, you have the following rights:

Right to Know: request disclosure of categories and sources of personal information collected.
Right to Delete: ask us to delete personal information, subject to legal exceptions.
Right to Opt Out of Sale or Sharing: where applicable, direct us not to sell your personal information or share it for cross-context behavioral advertising.
Right to Non-Discrimination: you will not receive different pricing or service levels for exercising your rights.
Right to Correct: request correction of inaccurate personal information that we maintain about you.
Right to Limit: where applicable, limit certain uses and disclosures of sensitive personal information.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

10. How to Exercise Your Rights and Contact Us

For requests or questions about this Policy or our data practices, contact us at:

Open Mercato sp. z o.o., ul. Wyspa Słodowa 7, 50-266 Wrocław, Poland.
Email: info@openmercato.com

We have appointed a data protection officer, whom you can contact about any question concerning the processing of your personal data and the exercise of your rights:

Krzysztof Jankowski, ul. Wojciecha Chrzanowskiego 16 lok. 176, 04-392 Warszawa, Poland.
Email: krzysztof@rodo-wyjasnione.pl

We will respond within the periods required by applicable law and may request identity verification where appropriate.

You may opt out of marketing communications at any time by using the unsubscribe link included in our messages (where available) or by contacting us at the email address above. Opting out of marketing does not affect service-related or administrative communications (e.g., security, billing, or contractual notices).

11. Updates to Privacy Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. When updated, the “Last Updated” date will change, and we may notify you by email or on the Site where appropriate.