Customer Panel Privacy Policy

HeroSwipe business services | Version 1.0 | Effective date: 6 October 2026

1. Scope of this Policy

This Policy applies to persons using the HeroSwipe Panel on behalf of a business Client, including organisation-account administrators, team users, users of agency sub-accounts, contact persons, persons responsible for billing, and persons using integrations and Hero A/B or Hero Content+ features.

This Policy does not replace the privacy notice for HeroSwipe testers or the privacy information relating to the website itself. If a Client entrusts HeroSwipe with personal data of its customers, employees, contractors or other persons for the purpose of providing the Services, the processing of such data may additionally be governed by a data processing agreement (DPA).

2. Data Controller and contact

The controller of the personal data described in this Policy - to the extent that HeroSwipe independently determines the purposes and means of processing - is HEROSWIPE spółka z ograniczoną odpowiedzialnością, ul. Ignacego Mościckiego 1, 24-110 Puławy, Poland, KRS 0001184316, NIP 5214126072 ("HeroSwipe", "we", "us").

For privacy matters, you may contact us at: [email protected].

If we appoint a Data Protection Officer or another dedicated contact point required by law in the future, we will update this Policy and provide the relevant contact details.

3. When HeroSwipe is a controller and when it is a processor

HeroSwipe acts as a controller, among other things, in relation to data needed to create and operate an organisation account, authenticate users, provide security, handle billing and invoicing, manage communications and complaints, perform our own Service analytics and - to the extent permitted by law - develop and train our own AI/ML models.

Where a Client submits personal data to the Panel for which the Client determines the purposes and means of processing, and HeroSwipe processes that data solely to provide the Service and on the Client’s documented instructions, HeroSwipe may act as a processor. In that case, a DPA applies where required by the GDPR.

Where HeroSwipe uses personal data contained in Client Materials for its own separately determined purpose - for example, to develop its own models - HeroSwipe’s role for that specific processing activity is assessed separately. A DPA alone does not provide a legal basis for HeroSwipe to use personal data for its own purposes.

4. Personal data we process

4.1. Account and organisation data

• first and last name, business email address, job title or role in the organisation, if provided;
• user identifier, organisation identifier, role and permission information in the Panel;
• company name, country/region, billing data, tax identifiers and information required to operate the selected plan or order;
• information about team invitations, administrators, sub-accounts and the user’s assignment to an organisation or agency client.

4.2. Technical, security and Panel-usage data

• IP address, device type, operating system, browser, language, session and authentication identifiers;
• access logs, security events, error information, crashes and attempted abuse;
• information about the use of Panel features, such as creating tests, importing listings, generating content, exports, publishing and use of integrations.

4.3. Billing and commercial data

• selected plan, orders, vote packages, add-ons, currency, payment status and information needed to issue invoices;
• transaction and billing history to the extent needed for accounting, payment handling and complaints;
• we do not store full payment-card details where payments are handled by an external payment provider.

4.4. Client Materials and Service data

• product data, photographs, graphics, files, listings, text, trademarks, logos and research questions;
• data imported from supported marketplaces or other integrations within the scope authorised by the Client;
• test results, study settings, additional responses, aggregated demographic information and analytics available in Hero A/B;
• prompts, instructions, input data, generated content, drafts, quality assessments and Hero Content+ usage data;
• derived data such as representations, features, embeddings, labels, statistics, metrics and other elements created during analysis or model development.

4.5. Marketplace integration data

Depending on the integration, we may process seller-account identifiers, store or marketplace identifiers, access or refresh tokens, the scope of permissions granted, product/SKU identifiers, listing data and technical import and publication statuses. The scope depends on the permissions granted by the Client and the capabilities of the relevant API.

4.6. Correspondence and support

We process the content of messages, support tickets, complaints, commercial enquiries, information about technical issues and the history of actions taken to address them.

5. Where we obtain data from

• directly from the Panel user or from the Client that invites the user to an organisation;
• automatically from the Panel, device and security systems while the Services are used;
• from marketplaces and other integration providers after the Client grants the relevant permissions;
• from payment, hosting, email, support, security or other providers acting on our behalf;
• from Client Materials and data created in the course of providing the Services.

6. Purposes and legal bases for processing

The table below describes the main purposes for which HeroSwipe acts as a controller. For data processed solely as a processor, we follow the Client’s instructions and the DPA.

Purpose	How we use data	Legal basis
Registration and organisation-account management	creating the account, login, roles and permissions, team management and access to the Services	Article 6(1)(b) GDPR - performance of a contract; for a user acting on behalf of the Client, also Article 6(1)(f)
Provision of Hero A/B and Hero Content+	handling orders, tests, content generation, reports, exports and Panel functions	Article 6(1)(b) GDPR; where data is processed on behalf of the Client - in accordance with the DPA
Marketplace integrations	authorising connections, importing data, synchronisation and publishing approved content	Article 6(1)(b) GDPR and permissions granted through the integration
Billing and invoices	handling payments, issuing accounting documents, settlements and receivables control	Article 6(1)(b) and (c) GDPR
Security and abuse prevention	protecting accounts, detecting unauthorised access, breaches, bots and attempts to circumvent safeguards	Article 6(1)(f) GDPR - legitimate interest in protecting the Services, clients and testers
Support, complaints and claims	handling tickets, documenting matters, establishing, exercising or defending legal claims	Article 6(1)(b), (c) or (f) GDPR depending on the matter
Development, training and improvement of AI/ML	using Client Materials, Service-usage data and content generated in the Panel to develop, train, fine-tune, test, evaluate and improve HeroSwipe models, recommendations and analytics	as a rule, Article 6(1)(f) GDPR in relation to personal data, after assessing necessity and balancing interests; consent or another basis where required in a particular case
Product analytics	measuring feature use, quality, performance and effectiveness of the Services	Article 6(1)(f) for necessary/limited analytics; Article 6(1)(a) where optional technologies require consent
B2B marketing and commercial communications	sending information about offers, updates and promotions to the extent permitted by law	Article 6(1)(f) GDPR and any consents required under electronic-communications rules, where applicable

Where we rely on legitimate interests, we assess the purpose, necessity of processing and the impact on the rights and freedoms of data subjects. For AI/ML development, we seek to limit the use of personal data to what is necessary for the relevant purpose and to apply aggregation, pseudonymisation, removal of direct identifiers or anonymisation where possible and appropriate.

7. Development of AI/ML models using Client Materials

In accordance with the Customer Panel Terms, HeroSwipe may use Client Materials, including photographs, graphics, listings, product data, text, test results, aggregated study results, data about use of the Services, and content generated or processed in the Panel, to develop its own AI/ML models and features.

For this purpose, we may create working copies, training datasets, representations, features, embeddings, statistics, labels and other derived data. Models and features developed in this way may subsequently also be used in providing Services to other clients, but this does not grant a right to publicly disclose raw, non-public Client Materials.

If data used for model development constitutes personal data, the GDPR continues to apply. Including data in a training process does not automatically make it anonymous. Where processing is based on Article 6(1)(f) GDPR, the data subject may object as described in Section 13.

After termination of the agreement, anonymous or aggregated datasets, metrics, representations, and model parameters and weights that are not personal data and do not reasonably enable reconstruction of non-public Client Materials may continue to be stored and used.

8. Marketplace integrations and external providers

Connecting a marketplace account to HeroSwipe may result in data being exchanged between HeroSwipe and that marketplace within the scope of the authorisation granted by the Client. The Client may revoke access through Panel features or the relevant provider’s settings, although revocation may disable functions that depend on the integration.

A marketplace or another integration provider may act as a separate controller in relation to its own processing activities. Its processing is governed by its own privacy rules and terms.

9. Who we disclose data to

Access to data is limited to persons and entities that need it for a specified purpose. Depending on the feature used, recipients may include:

• authorised HeroSwipe employees and contractors;
• providers of hosting, cloud services, databases, file storage, backups, authentication and security;
• email, support, error-monitoring, analytics and measurement providers;
• payment, accounting and invoicing providers;
• marketplaces and integration providers, within the scope of the Client’s authorisation;
• AI/ML infrastructure or tool providers participating in the processing of data for HeroSwipe models;
• legal advisers, accountants, auditors, insurers, public authorities and courts where disclosure is required or justified by law.

Processors act under appropriate agreements and our instructions. Where a recipient acts as an independent controller, it is responsible for its own processing of personal data.

10. Transfers outside the EEA

HeroSwipe is established in Poland, but some providers or their subcontractors may process data outside the European Economic Area (EEA), including through remote access to systems.

Where data is transferred to a third country, we use a mechanism provided for in Chapter V GDPR, such as a European Commission adequacy decision or appropriate safeguards such as Standard Contractual Clauses, together with supplementary measures where necessary. Information about safeguards can be obtained by writing to [email protected].

11. Panel technologies, device storage and analytics

The Panel may store information on or access information from a user’s device to the extent necessary for login, security, session maintenance, remembering settings and providing functions expressly requested by the user.

If we deploy optional analytics, advertising or measurement technologies that are not necessary for the Panel to function and that require consent, we will activate them only after obtaining the required consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

12. How long we keep data

We keep data only for as long as necessary for the relevant purpose and then delete or irreversibly anonymise it, unless law permits or requires us to retain specific information for longer.

Data type	Retention period or criterion
User-account and organisation data	For the period during which the account is active and the agreement remains in force; afterwards, for the period needed for settlements, security and defence of claims, to the minimum necessary extent.
Client Materials and operational Service data	For as long as needed to provide the Services and maintain the account, and after termination until deletion or anonymisation in accordance with the agreement, DPA, legal obligation or justified operational need.
Data used in AI/ML development	Personal data in active model-development datasets is kept only as long as necessary for model development and evaluation and as permitted by the applicable legal basis. Anonymised and aggregated data and model parameters that are not personal data may be kept for longer.
Integration data and access tokens	Until the integration is disconnected, permissions expire or the technical need ends, subject to a short period required to safely withdraw the connection and settle operations.
Billing and accounting records	For the period required by applicable tax, accounting and other legal obligations.
Routine technical and security logs	As a rule, for up to 30 days after the event. Data linked to a specific incident, abuse case or dispute may be retained longer to the extent needed to investigate or resolve it.
Backups	Deleted data may remain in restricted disaster-recovery backups until overwritten or securely expired, for no longer than 90 days after deletion from live systems, unless a specific record must be retained on a separate legal basis.
Marketing and objections	Consents - until withdrawal or discontinuation of the relevant channel. We may retain a minimal record of an objection or withdrawal for longer to avoid resuming unwanted communications and to demonstrate compliance.
Requests, complaints and claims	For the duration of the matter and then, to the minimum necessary extent, for the applicable limitation period or while proceedings remain ongoing.

13. Your rights

Where the GDPR applies to the relevant processing activity, you have - within the limits laid down by law - the right to:

• access your personal data and obtain a copy;
• rectify inaccurate data and complete incomplete data;
• erase data in the cases provided by law;
• restrict processing;
• data portability where processing is automated and based on consent or a contract;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• object to processing based on Article 6(1)(f) GDPR, including - where applicable - the use of your personal data for AI/ML model development;
• object unconditionally to direct marketing, including related profiling.

You may send a request to [email protected]. We respond without undue delay, as a rule within one month, with the possibility of extension in the cases provided for by the GDPR.

If we process your data solely as a processor acting for the Client, we may forward the request to the relevant Client or assist the Client in handling it in accordance with the DPA.

14. Complaint to a supervisory authority

You have the right to lodge a complaint with the competent data-protection authority, in particular in the EEA country of your habitual residence, place of work or place of the alleged infringement.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO), Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

15. Data security

We use technical and organisational measures appropriate to the risk, including access controls, authentication, privilege restrictions, transmission safeguards, monitoring of security events, backups and controlled retention. Where possible, we separate direct identifiers from datasets used for analytics and model work.

No internet-based system can guarantee complete absence of risk. If a personal-data breach occurs, we fulfil our GDPR obligations, including risk assessment, incident documentation and - where required - notification of the supervisory authority and affected individuals.

16. Tester data in Hero A/B results

Results made available to the Client are generally aggregated and may include relevant demographic information, statistics, answers to additional questions and research analyses. We do not provide the Client with direct tester identifiers such as email addresses or login credentials.

The Client should not attempt to identify testers from the data received or combine results with other datasets in order to establish their identity unless HeroSwipe expressly provides a separate function and identifies an appropriate legal basis.

17. Changes to this Policy

We may update this Policy when the Panel, our processing activities, the scope of integrations, providers, the AI/ML development model or legal requirements change. The current version states its effective date.

We will inform active users of material changes in an appropriate way, for example in the Panel or by email. Where new processing requires consent, we will request it before that processing begins.

18. Contact

Privacy questions and requests concerning your rights: [email protected].

Postal address: HEROSWIPE sp. z o.o., ul. Ignacego Mościckiego 1, 24-110 Puławy, Poland.

HEROSWIPE sp. z o.o. · KRS 0001184316 · NIP 5214126072