Privacy Policy
Updated October 6, 2026
This policy explains what personal data sild holds, why, and what rights you have.
1. Controller
Illia Kirieiev, sole trader, NIP 8513342075, ul. Małe Błonia 31/2, 71-779 Szczecin, Poland. Email: [email protected].
2. Two roles
- Our customers. For data about merchants who use sild and the people who contact us, we are the controller. This policy covers that data.
- Buyers in our customers' shops. For order and buyer data that a shop sends to sild, the shop is the controller and we are its processor. We handle it only on the shop's instructions, under our Data Processing Agreement (sild.cloud/dpa). If you bought something in a shop that uses sild, contact that shop about your data.
3. What we collect about customers and why
| Data | Where it comes from | Why | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Account email, company name and registry code, Merit country, store address and admin address, platform and plugin versions, language | The plugin when you connect | Run the account, send service emails and alerts | Contract (b) |
| Merit API ID and key | You, when you connect | Work with your Merit company | Contract (b) |
| Plan, billing status, invoices we issue to you, billing name, address and VAT number | Stripe and our invoicing | Bill you and keep tax records | Contract (b), legal duty (c) |
| Emails to support and our replies, diagnostic reports you send us | You | Help you | Contract (b), legitimate interest in support (f) |
| Technical logs: IP address of the server or browser that called us, time, address called, result | Our servers | Security, finding faults | Legitimate interest (f) |
Diagnostic reports from the plugin contain no keys and no buyer data.
We do not sell personal data, show advertising or build marketing profiles. The website sets no analytics or advertising cookies.
4. Who receives it
- Vultr (The Constant Company, LLC): servers in Poland (EU).
- Stripe (Stripe Payments Europe Ltd. and its affiliates): payments and the billing portal.
- Resend (Plus Five Five, Inc.): sending our emails.
- Symfonia (Symfonia sp. z o.o.): our sales invoices, which go to the Polish KSeF system as the law requires.
- Cloudflare (Cloudflare, Inc.): DNS for our domain and forwarding of emails to [email protected].
- Google (Google Ireland Ltd.): the mailbox where support emails arrive.
- Merit Tarkvara AS and its group companies: we send them requests with your API key, because that is the Service you ordered.
- Authorities, when the law requires it.
The current list with locations is at sild.cloud/subprocessors.
5. Transfers outside the EEA
Some of these companies are based in the United States or may access data from there. Transfers rely on the EU-US Data Privacy Framework where the company is certified, otherwise on the European Commission's standard contractual clauses.
6. How long we keep it
- Account data: while the account exists. Ask us to delete it once your stores are disconnected.
- Merit API key: until the last store of the company disconnects.
- Invoices and billing records: 5 years from the end of the year they relate to, as Polish tax law requires.
- Support emails: up to 3 years after the conversation ends.
- Technical logs: 14 days.
- Backups: encrypted, kept for up to 14 days.
7. Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. Write to [email protected]. We answer within one month.
You can also complain to a data protection authority: in Poland the Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), in Estonia the Andmekaitse Inspektsioon (aki.ee), or the authority where you live or work.
8. Security
How we protect data is described at sild.cloud/security.
9. Changes
We will publish changes here and email customers about important ones.