Privacy policy

The controller of personal data collected on the Website querora.com and in the Panel is Michał Fox, doing business under the Querora brand, in Kraków, Poland ("Querora", "we", "us").

For anything related to personal data, write to hello@querora.com. We have not appointed a data protection officer.

This policy describes the data we process as a controller. Data we can access in a Client's accounts and on a Client's website is processed on behalf of the Client under the Data Processing Agreement.

The form collects your name, email address, website address, country, the Plan you chose if any, the language of the page and the time it was sent.

We process the form data to reply to your request and prepare a proposal, which means taking steps before entering into a contract (Article 6(1)(b) GDPR).

We keep it for up to 12 months from the last contact, and if we enter into a Contract, under the rules in Section 3.

To protect the form from abuse, the server keeps the IP address and the times of submissions in memory and limits how many can be sent within 10 minutes. This data is not written to disk or into the submission (Article 6(1)(f) GDPR).

In the Panel we process:

1. 1)account data: name, email address, password hash (we do not store the password itself), the User's role and the date they were added;
2. 2)business data: name and invoicing details, including address, tax ID and invoicing email address;
3. 3)Client Website data: domain, country, service area, languages, Phrases, Questions and Competitors;
4. 4)Tickets: subject, content, priority, attachments and message history;
5. 5)email and browser notification settings;
6. 6)connection data for Google Search Console, Bing Webmaster Tools and Google Analytics 4 needed to read data;
7. 7)invoices, payments, Plan changes, pauses and cancellations;
8. 8)the date the Terms were accepted, their version and any request to start work before the withdrawal period ends.

The legal basis is performance of the Contract (Article 6(1)(b) GDPR), and for Users acting on behalf of a Client our legitimate interest in running the Client's account (Article 6(1)(f) GDPR). We process invoices and billing data to meet tax obligations (Article 6(1)(c) GDPR).

A User's session is kept by a cookie valid for 12 hours. A password reset link works for 30 minutes and expires once used.

A User turns on push notifications in the Panel, under Settings, Notifications, after allowing them in the browser. We then store the browser subscription: the push service address, encryption keys, language, selected notification types, the User identifier and the dates it was saved.

Notifications are delivered by the push service of the browser maker: Google (Chrome and other Chromium-based browsers), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). The service receives the encrypted notification content, for example news of a reply in a Ticket, a new Report or an invoice.

The legal basis is the User's consent given by turning notifications on (Article 6(1)(a) GDPR). It can be withdrawn at any time by turning notifications off in the Panel or in the browser settings. We delete the subscription when notifications are turned off, and also when the push service reports that the subscription has expired.

The server records technical request logs: IP address, date and time, page address, response code and browser type. We need them to run and protect the Website and the Panel (Article 6(1)(f) GDPR).

We keep logs for no longer than 30 days, unless they are needed to investigate a specific security incident.

The Website and the Panel store in your browser only what they need to work: the Panel session, language, theme and sidebar state. We do not use analytics, advertising or tracking scripts, and we do not load resources from third-party servers, including fonts.

The full list is in the Cookie Policy.

We keep account, business, Client Website, Measurement and Ticket data for as long as the Contract runs and for 30 days after it ends, while the Panel is read-only. We delete it within the following 30 days.

We keep invoices and billing records for 5 years from the end of the calendar year in which the tax payment deadline passed, as Polish tax law requires.

We keep data needed to establish, pursue or defend claims until those claims become time-barred.

Form data, push subscriptions and logs are kept for the periods given in Sections 2, 4 and 5.

We do not sell personal data or share it for marketing purposes.

Only the following categories of recipients may receive data:

1. 1)the server provider in Poland on whose servers the Website, the Panel and Querora's email run;
2. 2)the push services of browser makers (Google, Mozilla, Apple, Microsoft), only when a User turns notifications on;
3. 3)a payment provider, if the Client chooses to pay by card once that method is available in the Panel; we will name it in this policy before card payments go live;
4. 4)public authorities, where the law requires it.

Email is handled by our own server, without a third-party email service.

When Google Search Console, Bing Webmaster Tools or Google Analytics 4 is connected, sign-in and consent are handled by Google and Microsoft under their own terms. We read data about the website from those services and do not send them data from the Panel.

We send AI Engines only the Questions from the Measurement list, without personal data.

The Website, the Panel and their data are stored in Poland.

Browser push services may process data outside the European Economic Area, in particular in the United States. This is based on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses, depending on the provider.

You have the right to:

1. 1)access your data and receive a copy;
2. 2)have your data corrected;
3. 3)have your data erased;
4. 4)restrict processing;
5. 5)data portability for data we process under a contract or consent;
6. 6)object to processing based on legitimate interest;
7. 7)withdraw consent at any time, without affecting the lawfulness of processing before it was withdrawn.

To use these rights, write to hello@querora.com. We reply within one month. We may ask for information needed to confirm your identity.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in the country where you live or work, such as the Information Commissioner's Office (ICO) in the United Kingdom.

For people in the United Kingdom, references to the GDPR also mean the UK GDPR.

Providing data is voluntary, but without the form data we cannot reply to your request, and without account and business data we cannot enter into or perform the Contract.

We do not make decisions based solely on automated processing, including profiling, that have legal effects for you.

We apply measures appropriate to the risk: encrypted connections, passwords stored as hashes, access to data only for people who need it, and session cookies that page scripts cannot read.

If a personal data breach is likely to result in a high risk to your rights, we will tell you without undue delay.

We update this policy when the way we process data or the law changes. We inform Clients of material changes by email and in the Panel.

This Privacy Policy is effective from 24 October 2026.