Privacy Policy

Last updated: February 15, 2026

At SumoDir ("we", "our", or "us"), we are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws. This Privacy Policy explains how we collect, use, and safeguard your personal data when you visit our website https://sumodir.com (the "Site") and use our services.

1. Data Controller

The data controller responsible for your personal data is SumoDir, reachable via our contact page. We are based in Poland and subject to the jurisdiction of Polish data protection authorities (UODO).

2. Personal Data We Collect

We collect personal data only when necessary and for specific, legitimate purposes:

a) Account Data

When you register an account, we collect your name, email address, and profile image. This data is necessary to provide our services (contractual basis, Art. 6(1)(b) GDPR).

b) Submission Data

When you submit a listing, we collect the details you provide about your product, including name, website URL, description, introduction text, images (screenshots, logos), and optional social media links (LinkedIn, X/Twitter, Facebook, Instagram). You also select categories and tags for your listing. This data is processed to fulfill the listing service you requested (contractual basis, Art. 6(1)(b) GDPR).

Submission data is publicly displayed on your listing page. Your email address is not publicly displayed but is used for communication regarding your submission. With your explicit consent, it may also be used for marketing communications (see section 2f below).

c) AI-Processed Data

If you use the optional "AI Autofill" feature during submission, your website URL is sent to a third-party AI provider (Google Gemini, OpenAI, DeepSeek, or xAI, depending on configuration) to analyze your website and generate suggested product details. The AI provider receives only your publicly accessible website content — no personal data beyond the URL is transmitted. AI-generated suggestions are presented to you for review and editing before submission.

For paid plans (Basic, Pro), AI may also be used to generate SEO-optimized descriptions and blog articles based on your submission data and publicly available information about your product. This processing is based on the contract you enter into when purchasing a paid plan (Art. 6(1)(b) GDPR).

d) Payment Data

Payments are processed by our third-party payment processor, Polar. We do not store your credit card or payment details. We only retain transaction identifiers necessary for order management. Polar processes your payment data as an independent data controller under their own privacy policy.

e) Analytics Data

We use DataFast, a GDPR-compliant analytics service, to understand how visitors use our Site. DataFast collects anonymized usage data such as page views, referrer information, browser type, and approximate geographic location. DataFast does not use cookies for tracking and does not collect personally identifiable information. This processing is based on our legitimate interest in improving the Site (Art. 6(1)(f) GDPR).

f) Email Communications

We use Resend to send transactional emails (account verification, order confirmations, submission updates). These emails are necessary to provide our services.

When you submit a listing, the email address you provide is used primarily for communication regarding your submission (e.g., status updates, review notifications, listing issues). If you give your explicit consent during submission, we may also use this email address to send you occasional product updates and promotional communications (legal basis: Art. 6(1)(a) GDPR — consent). You can withdraw your consent and unsubscribe from marketing emails at any time by clicking the unsubscribe link included in every email or by contacting us via our contact page.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR): Account creation, submission processing, and payment handling.
• Legitimate interest (Art. 6(1)(f) GDPR): Analytics, fraud prevention, and Site security.
• Legal obligation (Art. 6(1)(c) GDPR): Compliance with applicable laws and regulations.
• Consent (Art. 6(1)(a) GDPR): Where required, such as for optional marketing communications.

4. Data Recipients and Third-Party Services

We share your personal data only with trusted third-party service providers who assist us in operating our Site:

• Vercel (hosting) — servers located in the EU and US.
• Supabase (database and authentication) — data stored in the EU.
• Cloudflare (image storage via R2, CDN) — global infrastructure with EU data processing.
• Polar (payment processing) — processes payment data as an independent controller.
• Resend (transactional email delivery).
• DataFast (privacy-friendly analytics) — GDPR-compliant, no personal data collected.
• AI Providers (Google Gemini, OpenAI, DeepSeek, xAI) — used for the AI Autofill feature and AI-generated content. Only publicly accessible website content is shared; no personal data is transmitted to AI providers.

Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: retained for as long as your account is active. Deleted within 30 days of account deletion request.
• Submission data: retained for as long as the listing is published and for a reasonable period after removal.
• Payment records: retained for the period required by tax and accounting regulations (typically 5 years).
• Analytics data: automatically anonymized and aggregated; no personal data is stored.

6. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate personal data.
• Right to erasure (Art. 17) — request deletion of your personal data.
• Right to restriction (Art. 18) — restrict processing of your personal data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please reach out via our contact page. We will respond to your request within 30 days.

You also have the right to lodge a complaint with your local supervisory authority. In Poland, this is the President of the Office for Personal Data Protection (UODO) — uodo.gov.pl.

7. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS/SSL), secure database access controls, and regular security reviews. However, no method of electronic transmission or storage is 100% secure.

8. Children's Privacy

Our Site is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please reach out via our contact page.