Effective: March 16, 2026
1. Introduction & Scope
This Privacy Policy describes how Querytail Inc. ("Querytail," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with our website (querytail.com), our SaaS platform, including product catalog enrichment and transformation, distribution to third-party AI agents, and the Agentic Client Advisor, and all of our services. This Policy applies to three categories of individuals: (a) merchants and their authorized representatives who use the Querytail platform; (b) end-users who interact with a Querytail-powered Client Advisor on a merchant's website; and (c) visitors to the Querytail website. By accessing our services, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
The data controller is Querytail Inc., a C-Corporation incorporated in the State of Delaware, United States, with its registered office at 555 East Loockerman Street, Suite 320, Dover, DE 19901 (File Number: 10612739). In accordance with Article 27 of the EU General Data Protection Regulation (GDPR), Querytail Inc. has designated Yann Douchin, Avenida de la Ermita, 2, 28108 Alcobendas, Madrid, Spain, as its representative in the European Union. For all data protection inquiries, you may contact our EU representative or write to us at the address provided in Section 14.
3. What Data We Collect
Merchant Data: Company name, contact details (name, email, phone), billing information, catalog data (product descriptions, prices, inventory levels, images), transaction data (order volumes, GMV), catalog enrichment data (missing attributes detected, AI-proposed corrections, and merchant approval/rejection decisions), and Merchant Console interaction data (conversations reviewed, unanswered questions identified, catalog gaps flagged). End-User Data (processed on behalf of the merchant): Conversation logs with the Client Advisor, purchase behavior, product preferences, browsing context, device/session identifiers, and transaction data from integrated checkout (products purchased, amount, transaction confirmation). Conversation logs are aggregated and anonymized within the Query Lake to power continuous improvement of our algorithms. Querytail processes this data as a Data Processor on behalf of the merchant, who remains the Data Controller. Website Visitor Data: IP addresses (anonymized after 30 days), browser type, pages visited, referral source, cookies, and analytics data (via privacy-compliant analytics tools).
4. How We Use Your Data
We use collected data to: (a) provide, maintain, and improve the Querytail platform and Client Advisor services; (b) process transactions and manage merchant accounts; (c) detect gaps in product catalogs and propose AI-enriched corrections (Auto-Enrichment), subject to merchant validation; (c bis) transform product catalogs into semantically enriched Agent Cards and distribute them to third-party AI agents (ChatGPT, Gemini, Perplexity) according to the merchant's instructions; (d) generate aggregated, anonymized insights to improve our algorithms, from three complementary sources: conversational data, transaction data, and merchant responses to unanswered questions identified by the platform; (d bis) leverage anonymized conversational data (Query Lake) to identify unanswered questions, detect missed market opportunities, and power the Buyer Intelligence and Market Intelligence modules; (e) communicate with merchants about their account, service updates, and billing; (f) ensure platform security and prevent fraud; and (g) comply with legal obligations.
5. Legal Basis for Processing (GDPR)
We process personal data on the following legal bases: Contractual Necessity: Processing merchant data is necessary to perform our contractual obligations under the Querytail Terms of Service. Legitimate Interest: We process certain data (e.g., analytics, platform security, fraud prevention) on the basis of our legitimate interests, balanced against your rights and freedoms. Consent: Where required (e.g., non-essential cookies on our website), we obtain your explicit consent before processing. Legal Obligation: We process data as required to comply with applicable laws, including tax and accounting regulations.
6. Data Sharing & Third Parties
We share data with the following categories of third parties, solely to the extent necessary to provide our services: LLM Providers (OpenAI, Google, Anthropic): Product catalog data may be transmitted to large language model providers for the purpose of enrichment, distribution, and AI-readiness. The decision to distribute catalog data to specific LLM providers is controlled by the merchant through the Querytail platform. Querytail does not share end-user personal data with LLM providers. Payment Processors and Digital Wallets (Stripe, Adyen, Apple Pay): Transaction data is processed by the merchant's chosen payment service provider. Querytail never directly handles, stores, or has access to payment card data or customer funds. Merchant ERP/PIM Systems: As part of real-time product information verification (Trust Layer), Querytail accesses the merchant's ERP or PIM data in read-only mode (prices, availability, specifications). This access is strictly limited to deterministic verification and does not result in any permanent storage of ERP/PIM data by Querytail. Infrastructure Providers: Our website is hosted by OVH SAS (Roubaix, France). Our SaaS platform is hosted on enterprise-grade cloud providers certified SOC 2, ISO 27001 (AWS, GCP) with GDPR-compliant data processing agreements. The website uses Cloudflare, Inc. services for content distribution and protection. We do not sell personal data to any third party.
7. Data Retention
Merchant account data is retained for the duration of the contractual relationship and for 30 days following termination, after which it is securely deleted or returned to the merchant. Catalog enrichment data (proposed corrections, merchant decisions) is retained for the duration of the contractual relationship and for 30 days following termination. Raw end-user conversation logs are retained for a maximum of 24 months, unless a shorter period is configured by the merchant. Anonymized, aggregated data derived from the Query Lake (trends, market insights, behavioral analytics) may be retained indefinitely for platform improvement purposes. Website analytics data is retained for 14 months.
8. Your Rights
Under the EU GDPR (EEA residents): You have the right to access, rectify, erase, restrict processing, port your data, and object to processing of your personal data. You also have the right to withdraw consent at any time where processing is based on consent, and to lodge a complaint with your local supervisory authority (in France: CNIL). Under the UK GDPR and Data Protection Act 2018 (UK residents): You have equivalent rights to access, rectify, erase, restrict processing, port your data, and object to processing. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. Under the CCPA/CPRA (California residents): You have the right to know what personal information is collected, to request its deletion, to request correction of inaccurate personal information, to opt out of the sale or sharing of personal information, and to not be discriminated against for exercising your privacy rights. Querytail does not sell or share personal information as defined under the CCPA/CPRA. Under other US State Privacy Laws: If you reside in a US state with applicable consumer privacy legislation (including Virginia, Colorado, Connecticut, Texas, and Oregon), you may have similar rights to access, delete, and correct your personal data, and to opt out of certain processing activities. To exercise any of these rights, contact us at the address provided in Section 14.
9. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA) and the United Kingdom. Where such transfers occur, we ensure adequate safeguards are in place, "including": Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA; the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as approved by the Information Commissioner's Office, for transfers from the United Kingdom; adequacy decisions by the European Commission or the UK Secretary of State; or binding corporate rules of the receiving entity. LLM provider data processing occurs in data centers located in the United States and Europe, subject to appropriate data processing agreements.
10. Cookies & Tracking
Our website uses strictly necessary cookies required for the functioning of the site (e.g., theme preference, language selection). We use privacy-compliant analytics to understand traffic patterns. We do not use third-party advertising trackers. Non-essential cookies are only placed with your explicit consent, which you may withdraw at any time.
11. Security Measures
We implement industry-standard technical and organizational measures to protect personal data, "including": encryption at rest and in transit (TLS 1.3); access controls and role-based permissions; regular security audits and vulnerability assessments; real-time deterministic verification of product information via the Trust Layer (prices, inventory, specifications), ensuring no erroneous data is communicated to end-users; employee training on data protection; incident response and breach notification procedures compliant with GDPR Article 33/34 timelines.
12. Children's Privacy
Querytail services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete such data promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify merchants of material changes via email and/or an in-platform notice at least 30 days before the changes take effect. The "Effective" date at the top of this page indicates the date of the last revision.
14. Contact
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: privacy@querytail.com