Quira Privacy Policy

This Privacy Policy is issued by Quira Ltd ("Quira," "we," "us," or "our"), a company registered in the Republic of Cyprus under registration number HE 497679, with its registered office at Apostolou Pavlou, 16, 2nd floor, Flat/office 201, 8046, Paphos, Cyprus.

This Policy explains how we collect, use, share, and protect personal data when you:

• visit our website at quira.ai ("Site");
• create an account and use the Quira dashboard ("Personal Cabinet") and AI agent platform ("Service"); or
• interact, as a shopper or visitor, with the Quira chat widget embedded on one of our customers' online stores ("Widget").

Quira serves two different groups of people, and we act differently toward each:

• Customers — the online stores that sign up for Quira. For the account, billing, and usage data Customers give us directly, Quira is the data controller.
• End Users — shoppers who chat with the Widget on a Customer's store. For the content of those conversations, Quira acts as a data processor on behalf of the Customer, who remains the data controller. If you are an End User and want to exercise a data right about a conversation, please contact the store you spoke with — we support our Customers in honoring those requests, and you may also contact us directly at the address below and we will route your request.

Account and Customer data

• Email address and a securely hashed password
• Store name and website domain
• Billing details, processed through our payment processor, Stripe — we do not store full card numbers ourselves
• Support and sales communications

Onboarding / site-scan data

• The website URL you submit for scanning
• Publicly available content from that site, used to generate a summary of what it sells
• Traffic estimates for that domain, pulled from third-party analytics services
• The e-commerce platform (CMS) detected on that site

Widget / End User data

• The text of conversations between End Users and the AI agent, and, where a Connector is active, order- or catalog-related context needed to answer a question
• Timestamps and the page the conversation started on
• Any contact details an End User chooses to type into the chat (for example, a name, email, or order number)

Technical data

• IP address, browser and device information
• Cookies used to operate the Site and Personal Cabinet (see Section 8)

We use personal data to: operate and provide the Service, including generating the AI agent's replies (which involves sending conversation content to our AI subprocessor); run the site-scan and estimate a recommended trial size; manage accounts, billing, and support; maintain security and prevent abuse of free trials; improve the Service; and meet our legal obligations. Where you've agreed to receive them, we also send product and marketing communications, which you can opt out of at any time.

Where the GDPR applies, we rely on: performance of a contract (running your account and the Service), our legitimate interests (security, fraud prevention, service improvement), your consent (marketing communications, non-essential cookies), and compliance with legal obligations.

We do not sell personal data. We share it with the following categories of subprocessors, each bound to use it only to provide their service to us:

• OpenAI — processes conversation content to generate the AI agent's responses
• Our cloud hosting provider — stores and runs the Service's infrastructure and data
• Stripe — processes subscription payments

We may also disclose data where required by law, or to a party that acquires our business, subject to this Policy continuing to apply.

Quira Ltd is established in Cyprus, in the European Union. Some of our subprocessors may process data outside the EEA. Where that happens, we work with those providers to put appropriate safeguards in place. We are still formalizing our data processing agreements with each subprocessor and can share what is in place, or provide a data processing agreement, on request — please contact us if this is required for your organization.

We use essential cookies to operate the Site and Personal Cabinet. On eligible pages of our Site and Personal Cabinet, we use Google Ads to measure successful self-service account registrations and understand advertising performance. This integration does not track shopper conversations in our customers’ Widgets. Google may receive device/browser information, page and referrer information, advertising click identifiers (such as gclid, gbraid and wbraid), consent signals and an opaque registration transaction ID. Password-reset, verification, invitation and other secret-bearing pages are excluded from the Google tag.

We use Advanced Consent Mode. In the European Economic Area, United Kingdom and Switzerland, advertising storage, analytics storage, advertising user data and advertising personalization default to denied; elsewhere they default to granted. A saved explicit refusal takes priority in every region. Google can load and receive consent-aware cookieless signals before consent or while consent is denied: rejecting cookies does not mean that no request reaches Google. Advertising and analytics cookies depend on the applicable consent state.

For enhanced conversion measurement, where advertising user-data consent permits, we provide only the normalized, SHA-256-hashed email of the account owner who completed registration. We do not automatically collect email from forms or page content, and do not use invitee or shopper email for this purpose. Hashing is pseudonymization, not anonymization; Google may match this value with its own data to attribute conversions. An explicit refusal suppresses this email provision.

You can accept, reject or reopen cookie preferences using the cookie settings control on our Site and Personal Cabinet, and change or withdraw your choice at any time for future processing. A first-party preference cookie shares your choice across our configured main and account domains for 180 days by default; it contains no email, account ID or advertising click ID. After expiry, regional defaults apply again. Browser cookie controls are also available; blocking essential cookies may affect the Service. Withdrawal does not undo processing already performed.

Google is a recipient of advertising measurement data and may process it outside the EEA, including in the United States, under its own applicable terms and privacy information. See how Google uses information from sites and apps and Google’s Privacy Policy. These measurement choices apply to our Site and Personal Cabinet, separately from marketing email preferences. We do not promise that every registration is delivered to or reported by Google.

We keep Customer account data for as long as the account is active, and for a reasonable period afterward to meet legal, accounting, and dispute-resolution needs. Widget conversation data is kept according to the Customer's plan and settings; a Customer can request deletion of their store's data by contacting us. Data from abandoned trial sign-ups is deleted after a limited period of inactivity.

If the GDPR applies to you, you have the right to request access to, correction of, deletion of, or a copy of your personal data, to object to or restrict certain processing, and to lodge a complaint with a data protection supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection. We are a young company and are still building out our formal privacy program (including a dedicated data protection point of contact); in the meantime, you can exercise these rights by writing to us at the contact below and we will respond personally.

The Service is intended for businesses and their customers, not specifically for children, and we do not knowingly collect personal data directly from children through our Site or Personal Cabinet. Customers are responsible for ensuring their own use of the Widget complies with any rules that apply to their audience.

We describe the technical and organizational measures we take to protect personal data in our Security page.

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date, and, for material changes, make reasonable efforts to notify active Customers.

Quira Ltd
Apostolou Pavlou, 16, 2nd floor, Flat/office 201, 8046, Paphos, Cyprus
Email: privacy@quira.ai