Privacy policy

Who we are

The data controller is Expanding Web Marcin Dancewicz, Malinowskiego 1, 59-600 Lwówek Śląski, Poland (info@expandingweb.com).

Store scans

When you run the free agent-readiness scan we fetch a handful of public URLs from the domain you enter (homepage, robots.txt, sitemap, well-known files and at most one product page) and store: the domain, the time of the scan, the technical check results and the IP address the request came from (for rate-limiting). Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) — providing the diagnostic you asked for and protecting the service from abuse. Scan records are deleted or anonymised after 12 months. Individual scan results are never published.

Readiness review requests

When you submit the readiness-review form we store the details you provide (name, work email, company, store URL, platform, your note), the submission time, referrer and UTM parameters, and we link the scan you ran, in order to prepare and send your review and follow up about the engagement. Lawful basis: steps prior to entering a contract (Art. 6(1)(b)) and legitimate interest. We keep lead records for 24 months after last contact.

Site agent chat

If you use the AI site agent at chat.expandingweb.com we store: your account details (name, work email, the projects assigned to you), the full content of your conversations — your messages, the agent's replies and the actions it took on your site — and technical metadata (timestamps, the model used, token counts and cost). This is held on our own server in Google Cloud, EU region europe-west4.

We read those conversations. Lawful basis: performance of our agreement with you (Art. 6(1)(b) GDPR) for operating and supporting the service, and legitimate interest (Art. 6(1)(f)) in improving it — diagnosing failures, checking the quality of the agent's work, tuning its instructions and preventing abuse. Access is limited to Expanding Web people working on the service. Conversations are kept for 24 months from the last message, or until you ask us to delete the account, whichever comes first.

To produce replies, your messages are sent to the AI model providers we route through (currently OpenRouter and the model vendors behind it), which act as processors and may process the data outside the EEA under standard contractual clauses. Their terms govern what happens on their side, so please do not put passwords, payment details or other people's personal data into the chat.

Phone calls (AI receptionist)

Calls to the numbers listed on this site are answered by Nina, an AI receptionist (the same Nina runs the chat widget on this site; the widget keeps no history on our side beyond the conversation you choose to send to an engineer). She says so at the start of every call and tells you the call is recorded. From each call we store your phone number, the date, time and duration, and a text transcript — on our own server in the EU and in our email inbox. We do not keep the audio itself.

Call audio is processed in real time by OpenAI (USA), the provider of the voice interface, acting as our processor; transfers outside the EEA rely on the EU–US Data Privacy Framework and standard contractual clauses. Lawful basis: steps prior to entering a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in handling calls properly (Art. 6(1)(f)). Transcripts are kept for 24 months after last contact, like review requests; the receptionist makes no automated decisions with legal effect about you.

Marketing email

We send occasional agentic-commerce insights only if you tick the separate opt-in box (consent, Art. 6(1)(a)). You can withdraw at any time by replying to any email or writing to us; withdrawal does not affect your review request.

Business contacts and postal mail

We occasionally send a printed diagnostic report about a store to the person responsible for it at that company. For this we process business contact details only: name, job title and the company's postal address, taken from public professional profiles (such as LinkedIn) and company websites, together with the results of a scan of the store's public pages. We do not collect home addresses, private email addresses or phone numbers. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) — direct marketing of our services to businesses. Scan results are shared only with the store's own company, never published. Printing and postage are handled by a print-and-mail provider in the US acting as our processor, which receives only the report and the company address. You can object to this mailing at any time by writing to info@expandingweb.com; we will stop immediately. We keep these contact details for 12 months after our last contact, then delete the personal data.

Store shortlist (data we did not get from you)

We keep a working shortlist of online stores we may approach. It holds the store’s domain, its country, technical signals read from its public pages, whether the domain appears in the public Chrome UX Report, an automated summary of what the store sells, and the results of our own scan of its public pages. Where a store is run by a sole trader, that information can relate to a person, so we treat the whole list under this notice.

Sources: publicly available datasets of web domains (the Chrome UX Report and the HTTP Archive), public top-lists and agency portfolios, and the stores’ own public pages. We did not receive this information from you. Lawful basis: our legitimate interest (Art. 6(1)(f) GDPR) in identifying businesses that could use our services; we hold no home addresses, private contact details or special-category data. Entries are reviewed at least once a year and deleted when a store is no longer a candidate, and in any case 24 months after the last activity on the record.

You can ask what we hold about your business, have it corrected, or object to the whole processing — write to info@expandingweb.com and we will delete the entry and add the domain to our suppression list.

Analytics and cookies

The site loads Google Tag Manager for aggregate usage analytics. We do not send your name, email, store URL or form contents to analytics tools. The readiness form and scanner work without analytics cookies.

Processors and transfers

The site and the agent chat are hosted on Google Cloud (EU region, europe-west4). Email is delivered through our transactional mail provider. Agent-chat messages additionally go to the AI model providers described above, some of which process data outside the EEA under standard contractual clauses. We do not sell personal data and we share it only with processors bound by data-processing agreements.

Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest, by writing to info@expandingweb.com. You may lodge a complaint with the Polish supervisory authority (UODO, uodo.gov.pl).