Privacy Policy of Woobsy.com
Version 4.2 • Effective Date: September 17, 2026 • Governing Law: EU GDPR (2016/679), Polish Data Protection Act, Polish Electronic Communications Law (PKE), CCPA/CPRA, LGPD, PIPL, FADP
1. Executive Summary & Core Architectural Principles
1.1. Welcome to the Privacy and Personal Data Protection Policy of Woobsy.com. We operate under strict adherence to European data protection standards, including Regulation (EU) 2016/679 ('GDPR' / 'RODO'), the Polish Act of 10 May 2018 on Personal Data Protection, the Polish Electronic Communications Law (Prawo komunikacji elektronicznej - PKE), and international privacy standards.
1.2. Privacy by Design & Default: We collect only the absolute minimum data required to execute search indexing, user authentication, and system integrity. No personal data is ever sold, rented, or monetized to third-party data brokers.
1.3. Zero Financial Custody: Woobsy never processes, captures, or stores credit cards, bank credentials, billing addresses, or payment tokens. All monetary transactions occur entirely on external merchant checkout platforms.
We collect only the absolute minimum data required to execute search indexing, user authentication, and system integrity. No personal data is ever sold, rented, or monetized to third-party data brokers.
Woobsy never processes, captures, or stores credit cards, bank credentials, billing addresses, or payment tokens. All monetary transactions occur entirely on external merchant checkout platforms.
2. Identity of the Owner & Data Controller
2.1. For the purposes of the General Data Protection Regulation (GDPR Art. 4(7)), the Data Controller responsible for processing your Personal Data is:
Entity Name: Arian Fazel (Operating as Woobsy.com)
Jurisdiction of Incorporation: Republic of Poland, European Union
Official Domain: https://www.woobsy.com
Designated Privacy Desk: privacy@woobsy.com
Official Legal Desk: legal@woobsy.com
3. Exhaustive Categories of Personal Data Collected
3.1. Directly Provided Data: Email address, encrypted password hash (bcrypt/Argon2), display username or avatar, Google OAuth profile identifier.
3.2. User Activity Content: Product bookmarks, search queries, filter settings, and conversational shopping prompts.
3.3. Technical Telemetry: Truncated IP address, city/country level geolocation derived from Cloudflare edge headers (zero GPS coordinates), User-Agent string, browser version, screen dimensions, preferred language locale, and color theme.
3.4. Security Audit Logs: Cloudflare Turnstile bot challenges, rate-limiting counters, and access timestamps.
4. Statutory Legal Bases for Processing (GDPR Art. 6)
4.1. Account creation & authentication: Art. 6(1)(b) GDPR (Contract Performance).
4.2. Executing search queries & comparison results: Art. 6(1)(b) GDPR (Contract Performance).
4.3. AI conversational shopping assistance: Art. 6(1)(b) GDPR (Contract Performance).
4.4. Security defense, DDoS mitigation & bot blocking: Art. 6(1)(f) GDPR (Legitimate Interest).
4.5. Affiliate click attribution & anti-fraud: Art. 6(1)(f) GDPR (Legitimate Interest).
4.6. Optional persistent analytics & telemetry: Art. 6(1)(a) GDPR (Freely Given Consent).
4.7. Regulatory compliance, tax records & DSA summons: Art. 6(1)(c) GDPR (Legal Obligation).
5. Processing Purposes & EDPB Guidelines 05/2020 on Consent
5.1. Strict Prohibition of Cookie Walls: In strict compliance with European Data Protection Board (EDPB) Guidelines 05/2020 on Consent, access to Woobsy's product search and price comparisons is never conditional on consenting to non-essential cookies.
5.2. Users who decline non-essential cookies enjoy full, unrestricted access to all core platform comparison features.
6. Artificial Intelligence Query Processing & Zero-Training Guarantee
6.1. Woobsy utilizes enterprise Large Language Model (LLM) endpoints, including Google Generative AI (Gemini API), Groq, and OpenAI, to synthesize search results and price comparisons.
6.2. Zero Model Training Policy: User search queries and shopping conversations are NEVER retained, ingested, or used by AI providers to train, retrain, or fine-tune public foundational models.
6.3. Ephemeral Processing: Prompts are processed strictly in volatile memory and purged immediately following response generation.
6.4. Data Sanitization: All requests dispatched to inference APIs are stripped of personal tokens and account identifiers.
Strict Zero Model Training Policy
- Zero Public Model Training: User search queries and shopping conversations are NEVER retained, ingested, or used by Google, Groq, or OpenAI to train, retrain, or fine-tune public foundational models.
- Ephemeral Processing: Prompts are processed strictly in volatile memory and purged immediately following response generation.
- Data Sanitization: All requests dispatched to AI endpoints are stripped of sensitive personal tokens and user account identifiers.
7. WebRTC Live Peer-to-Peer Audio/Video Collaboration
7.1. Woobsy provides real-time peer-to-peer (P2P) shopping collaboration powered by WebRTC and Metered.ca (Metered Video infrastructure).
7.2. All audio, video, and screen-sharing media streams are encrypted end-to-end via DTLS and SRTP.
7.3. Woobsy servers never record, intercept, transcribe, or store live video or audio communications. Media flows directly between participating peer devices.
8. Authorized Third-Party Sub-Processors & Infrastructure
8.1. Supabase Inc. (EU / Frankfurt): PostgreSQL database hosting, Row Level Security, user authentication, and encrypted session storage.
8.2. Vercel Inc. (Global Edge CDN): Next.js serverless compute hosting, edge routing, and TLS certificate termination.
8.3. Cloudflare Inc. (Global Edge / US): DDoS defense, Web Application Firewall (WAF), bot filtering, and Turnstile challenge verification.
8.4. PostHog Inc. (EU Cloud / Frankfurt): Cookieless privacy-first telemetry. Operates strictly in memory until explicit user opt-in consent.
8.5. Metered Video / Metered.ca (Global TURN/STUN): WebRTC NAT traversal signaling for peer-to-peer video sessions.
8.6. Resend (US / Global): Transactional email routing for password resets and critical security notices.
PostgreSQL database hosting, Row Level Security, user authentication, and encrypted session storage.
Next.js serverless compute hosting, global edge asset routing, and HTTPS SSL/TLS certificate termination.
DDoS defense, Web Application Firewall (WAF), bot filtering, and Cloudflare Turnstile challenge verification.
Cookieless privacy-first product usage telemetry. Operates strictly in memory until explicit user opt-in consent.
9. Commercial Affiliate Attribution & Zero Payment Custody
9.1. When clicking outbound links to external merchant platforms (Amazon, eBay, AliExpress, Awin, CJ), an anonymous referral token is appended to attribute the referral.
9.2. External merchants process orders and financial transactions entirely on their own secure platforms under their independent privacy policies.
9.3. Woobsy never receives, processes, or stores your credit cards or payment credentials.
10. International Data Transfers & Adequacy Safeguards
10.1. All cross-border data transfers outside the European Economic Area (EEA) comply with GDPR Chapter V.
10.2. Transfers to the United States rely on the EU-US Data Privacy Framework (DPF) adequacy decision for certified entities.
10.3. For non-DPF recipients, transfers are anchored to European Commission Standard Contractual Clauses (SCCs - Implementing Decision (EU) 2021/914) reinforced by Transfer Impact Assessments (TIAs) and cryptographic safeguards.
11. Rigorous Data Retention & Automated Purging Schedule
11.1. User Accounts: Retained for the duration of the active account relationship; hard-deleted within 30 days of verified deletion request.
11.2. Search Telemetry: Anonymous query strings are purged from operational cache within 24 hours.
11.3. Security & Access Logs: Firewalls and WAF logs roll over automatically on a 30-to-90-day retention cycle.
11.4. Consent Records: Cookie consent timestamps are preserved for 12 months for compliance audit proof.
12. 72-Hour Data Breach Incident Response Protocol (GDPR Art. 33/34)
12.1. In the event of a personal data breach, the Controller shall notify the President of the Personal Data Protection Office in Poland (PUODO) within 72 hours of becoming aware of the breach pursuant to GDPR Article 33.
12.2. If the breach is likely to result in a high risk to user rights and freedoms, affected data subjects will be notified without undue delay via direct email and public announcement pursuant to Article 34.
The Controller shall notify the President of the Personal Data Protection Office in Poland (PUODO) within 72 hours of discovering any personal data breach, with immediate notification to affected users if high risks are identified.
13. Data Subject Rights Under GDPR (Art. 15–22)
13.1. Right of Access (Art. 15): Obtain confirmation of processing and a complete copy of personal data.
13.2. Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal records.
13.3. Right to Erasure / 'Right to Be Forgotten' (Art. 17): Request permanent deletion of personal data.
13.4. Right to Restriction of Processing (Art. 18): Request temporary limitation of processing activities.
13.5. Right to Data Portability (Art. 20): Receive personal data in a structured, commonly used, and machine-readable JSON/CSV format.
13.6. Right to Object (Art. 21): Object at any time to processing based on legitimate interest or direct marketing.
13.7. Automated Decision-Making & Profiling (Art. 22): Woobsy does NOT subject users to automated decisions producing legal effects.
14. California Residents Disclosures (CCPA / CPRA)
14.1. Pursuant to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA, Cal. Civ. Code § 1798.100 et seq.):
14.2. Right to Know, Delete, and Correct: California consumers have the right to request disclosure, deletion, and correction of their personal information.
14.3. 'Do Not Sell or Share My Personal Information': Woobsy does NOT sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising.
14.4. Sensitive Personal Information: Woobsy does not collect or process Sensitive Personal Information (SPI) as defined under the CPRA.
14.5. Non-Discrimination: We will never discriminate against any user for exercising their statutory privacy rights.
15. US Multi-State Privacy Notices (VA, CO, CT, TX, OR, MT, UT)
15.1. Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Utah (UCPA), and other US jurisdictions enjoy equivalent consumer rights to access, delete, correct, and opt out of profiling and targeted advertising.
15.2. Multi-state requests can be submitted anytime to privacy@woobsy.com with immediate 45-day statutory fulfillment.
16. Rights of Swiss Residents (Swiss FADP / DSG)
16.1. Personal data processing for individuals residing in Switzerland complies with the revised Swiss Federal Act on Data Protection (FADP / DSG, RS 235.1).
16.2. Swiss residents may exercise data access and correction rights directly via privacy@woobsy.com.
16.3. Competent Swiss Supervisory Authority: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, CH-3003 Bern, Switzerland.
17. Rights of Brazilian Residents (LGPD Lei nº 13.709/2018)
17.1. In compliance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados - LGPD, Lei nº 13.709/2018):
17.2. Brazilian data subjects enjoy statutory rights under LGPD Article 18, including confirmation of processing, access to data, correction of incomplete or outdated data, anonymization, blocking, elimination, portability, and consent revocation.
17.3. Designated Encarregado (DPO Channel): Contact privacy@woobsy.com with the subject line 'LGPD Encarregado'.
17.4. National Supervisory Authority: Autoridade Nacional de Proteção de Dados (ANPD), Brasília, Brazil.
18. Disclosures for Chinese Residents (PIPL 个人信息保护法)
18.1. For users in the People's Republic of China, processing complies with the Personal Information Protection Law (PIPL - 中华人民共和国个人信息保护法).
18.2. Separate Consent (单独同意): Where required by PIPL Article 29 or for cross-border data transfer, separate explicit consent will be collected.
18.3. Data Subject Rights: Chinese residents possess rights to know, decide, access, copy, correct, and delete personal data under PIPL Articles 44–47.
18.4. Cross-Border Safeguards: Any transfer of data outside mainland China adheres to regulatory mechanisms and standard contracts formulated by the Cyberspace Administration of China (CAC).
19. Children's Privacy & Prohibition of Underage Data (16+)
19.1. Woobsy is strictly intended for individuals aged 16 and older. We do not intentionally solicit, collect, or store personal information from minors under 16.
19.2. If we discover that personal data of a minor under 16 has been registered without parental consent, we will take immediate steps to permanently delete the data.
20. Data Protection Officer (DPO) Exemption Assessment & Privacy Desk
20.1. Pursuant to GDPR Article 37(1), Woobsy is not legally mandated to designate a formal Data Protection Officer, as our operations do not constitute public authority processing, large-scale systematic monitoring, or special category data processing.
20.2. All data protection, regulatory correspondence, and compliance matters are handled directly by our internal Privacy & Compliance Desk via privacy@woobsy.com.
21. Competent Supervisory Authority (PUODO Poland & EDPB)
21.1. Primary EU Lead Supervisory Authority: Urząd Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland. Phone: +48 22 531 03 00. Web: https://uodo.gov.pl.
21.2. EU residents may also lodge complaints with their domestic National Data Protection Authority via the European Data Protection Board (EDPB) portal (https://edpb.europa.eu).
22. Data Subject Access Request (DSAR) Procedure & Contact Desk
22.1. To exercise any statutory data subject rights, email privacy@woobsy.com with the subject line 'DSAR Request'.
22.2. Verification: To protect user confidentiality, we verify the requester's identity by confirming account email ownership.
22.3. Response Timeline: Verified requests are executed free of charge within one calendar month (30 days) pursuant to GDPR Article 12(3).