Privacy policy

This policy explains what personal data WooMate collects, why we need it, who else processes it and what you can do about it. It covers getwoomate.com, app.getwoomate.com and the Polish versions of both (woomate.pl, app.woomate.pl).

The policy is also published in Polish. If the two versions differ, the Polish version prevails.

1. Who we are

The controller of your personal data is Miłosz Wein Smart Marketing, ul. Warszawka 72, 82-300 Elbląg, Poland, tax ID (NIP): 8762473623.

We are based in the European Union, so we process your data under the EU General Data Protection Regulation (GDPR). The rights in section 10 apply to you wherever you live.

Contact: hello@getwoomate.com

2. What we collect

• Your account: email address, name (optional), password (stored only as a bcrypt hash), app language, sign-up date and whether you have confirmed your email.
• Your stores: store URL, WooCommerce Consumer Key and Consumer Secret and, if you add them, a WordPress username and application password. Store settings you save in the app, such as your Brand Kit, costs and margins, and notifications.
• Your AI keys: Anthropic, OpenAI and Google Gemini API keys, if you add them.
• Connected accounts: access tokens for Google (Analytics, Search Console, Google Ads, Merchant Center, Google Sheets) and Meta ad accounts — only for the accounts you connect yourself.
• What you create in the app: chat history, generated text and images, changes you prepare and save to your store, uploaded import files and supplier price lists.
• Billing: handled by Stripe. We never see or store your card details. We store your plan, subscription status and your Stripe customer and subscription IDs.
• Usage: how much of the free trial you have used (AI messages, products, import rows, images), AI usage and estimated cost, feature events (for example opening a module, sending a message, starting an import) and an account activity log (for example sign-up and sign-in) with IP address.
• Technical data: IP address in server logs and browser type, collected automatically for security.
• Onboarding and contact forms: your name, email, store URL (optional) and your message or task description. The message is sent to us by email and is not stored in the app database.
• Website analytics: only after you accept cookies — data collected by Google Analytics and Meta Pixel (section 6).

3. How we use it and why we are allowed to

• To provide the service (contract, Art. 6(1)(b) GDPR): running your account, confirming your email, giving you access to features, connecting the store and accounts you choose, account emails (welcome, password reset, expiring connections) and payments. Free onboarding you request before signing up is handled on the same basis.
• With your consent (Art. 6(1)(a) GDPR): replying to onboarding and contact form messages, and using Google Analytics, Meta Pixel and Meta Conversions API (section 6).
• Our legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure, preventing abuse (for example limiting sign-in attempts), feature usage statistics that help us improve the app, and internal alerts about new accounts and payments.
• Legal obligations (Art. 6(1)(c) GDPR): issuing invoices and keeping accounting records required by tax law. You get your invoice by email.

We do not sell personal data.

4. AI providers and your API keys

WooMate AI, Studio and image generation run on your own API key from Anthropic, OpenAI or Google Gemini. WooMate does not use a key of its own for your requests.

• When you use an AI feature, WooMate sends the request to the provider you picked, under your account with that provider and on its terms.
• A request can include store data the task needs, such as product details or order figures.
• The provider bills token costs to you directly.
• Your keys are stored encrypted (section 9). You can remove them at any time in Settings → AI and costs.

5. Your customers' data

WooMate reads orders, customers and products from your store (and from accounts you connect) when you ask for a report or a task. We don't build our own customer database from it.

• For this data, you are the controller and WooMate processes it on your behalf, only to run the features you use.
• By default, the chat does not pass your customers' contact details to the AI provider: emails, phone numbers, street addresses, postcodes and last names (except the initial) are masked, for example j•••@gmail.com. You can turn on full data for a store in its advanced settings.
• WooMate saves changes to your store and connected accounts only after you approve them.
• If you are a customer of a store that uses WooMate, contact that store first — it controls your data. We will help it answer your request.

6. Cookies and analytics

• Sign-in (required): session cookies that keep you signed in (NextAuth.js).
• Preferences: your theme and your cookie choice are saved in your browser's local storage. They stay on your device.
• Google Analytics 4 (website, sign-in and sign-up pages): measures visits and actions on the site. Analytics cookies are set only after you click Accept. Until then, Google Analytics runs in Google's consent mode with cookies denied.
• Meta Pixel (website and app): measures how our Meta ads (Facebook, Instagram) perform. It loads only after you click Accept.
• Meta Conversions API: when you sign up, send the onboarding form or buy a plan, our server tells Meta about the event with your email hashed (SHA-256), your IP address and browser type. This happens only if you accepted cookies.

If you click Decline, Meta Pixel doesn't load, Google Analytics sets no cookies and nothing is sent to Meta Conversions API. To change your choice, clear this site's data in your browser and the banner will appear again.

7. Who processes your data

We share data only with the services below, and only as far as each one needs it.

WooMate also connects to your own WooCommerce and WordPress store. The YouTube video thumbnail on our site loads from YouTube servers when you view the page; the YouTube player loads only after you click it. The invoicing system we use receives the details needed on your invoice.

8. International transfers

Some of these services (Anthropic, OpenAI, Google, Meta, Stripe) are based in or process data in the United States. These transfers rely on the safeguards in Chapter V of the GDPR that each provider uses, such as a European Commission adequacy decision or standard contractual clauses. Each provider describes the details in its own privacy policy.

9. How long we keep it and how we protect it

• Account data: while your account is active, plus 30 days after deletion (backups). Keys, connection tokens, chats, content and store settings are deleted with your account or store. Account activity log entries and feature events are deleted with your account. Disconnecting a Google or Meta account deletes its token right away.
• Billing records: 5 years from the end of the tax year, as tax law requires.
• Server logs: 30 days.
• Email links: the email confirmation link is valid for 30 days; a password reset link until it is used or expires.
• Your customers' data: not copied into a separate database. It can remain in your chat history and saved changes until you delete them or your account.
• Form messages: until the matter or onboarding is complete, and no longer than 12 months. If you create an account in that time, the account rules apply.

• All connections use TLS 1.2/1.3 (HTTPS).
• Passwords are stored only as bcrypt hashes.
• WooCommerce keys, WordPress application passwords, AI keys and Google and Meta tokens are encrypted in the database (AES-256-GCM) on a private server and never shared.
• New accounts confirm their email within 3 days of signing up, using the link in the welcome email.
• Sign-in attempts are rate-limited, and changing your password signs your account out on all devices.

10. Your rights

Under the GDPR you can:

• access your data and get a copy,
• correct data that is wrong,
• delete your data (except what the law requires us to keep),
• take your data with you in a machine-readable format,
• object to processing based on our legitimate interests,
• restrict processing in certain cases,
• withdraw consent at any time, without affecting processing before you withdrew it.

Email hello@getwoomate.com and we will reply within 30 days.

You can also complain to a data protection authority. Our lead authority is the Polish President of the Personal Data Protection Office (uodo.gov.pl); you can also contact the authority where you live or work.

11. Changes to this policy

We will email you about significant changes at least 14 days before they take effect.

12. Contact

Questions about your data: hello@getwoomate.com