Personal data protection
VERSION 1.2 · FROM 1. 10. 2026The controller of your personal data is Lumegro, s.r.o., Company ID 08827877, Nové sady 988/2, 602 00 Brno. Below is everything we hold about you, why and for how long.
Version 1.2 of 1. 10. 2026 is an editorial change: the service is now called Pickfirst. Your rights and obligations do not change, so it applies straight away — the 14-day notice under “Changes to the terms” is for changes of content.
What we process about you
| Data | What it is | Why | Legal basis |
|---|---|---|---|
| Sign-in details | e-mail, password hash (scrypt — we never store the password itself), the identifier from Google or Apple (if you sign in with them), active sessions and the time of the last sign-in | so that you have an account and nobody else can get into it | performance of contract |
| Billing details | company name, company ID, VAT ID, address, e-mail for invoices | issuing a tax document once the service is paid | performance of contract and legal obligation (accounting) |
| Shop details | shop address, Shoptet feed security hash, product feed addresses, product and category catalogue, seller details you fill in for ChatGPT | so that we can load and process the feeds and publish the output | performance of contract |
| Connected services | Access you grant us to Google Analytics 4, Google Search Console, Google Merchant Center and the ChatGPT (OpenAI) ads account: encrypted access tokens or the API key, the e-mail or name of the connected account, which properties and accounts you paired with your shop, and when and by whom they were connected. | To read your shop's performance data and product statuses and use them to optimise your product feeds and ads. | Performance of contract (only after you connect the service) |
| Questions to the assistant | The text of your question (max. 300 characters) is sent to a language model to recognise what you are asking, and it stays in your conversation history, which only you see. The record of the recognition stores only the recognised intent, confidence and cost — not the text. | So that the assistant understands questions in natural language. | Performance of contract |
| Connection to Mergado | the identifier of your Mergado account. We do not store the access token — it is made only when needed and lives only in the memory of the run | so that we can migrate your projects when you ask us to | performance of contract |
| Operational records | processing runs, notifications, error records | so that you see what happened and we can fix failures | legitimate interest in a working service |
| IP address | briefly in the server's memory for the counter of sign-up and sign-in attempts; it is not stored in the database and disappears on restart | protection against password guessing and automated sign-ups | legitimate interest in security |
Who gets the data
| Processor | What they get | Why |
|---|---|---|
| Mergado (Mergado technologies, s.r.o., Czech Republic) | product catalogue and seller details | Mergado makes the output feeds for Heureka, Google and ChatGPT |
| OpenRouter (OpenRouter, Inc., USA) | Product names, descriptions, prices and parameters, category names, your shop's name, and the text of questions you ask the assistant (max. 300 characters). No other personal data. | Language models for category and parameter matching and for understanding questions. |
| Google LLC (USA) | Requests to read data from the Google services you connected. | Source of data for optimisation (we read data from Google, we do not send it your data). |
| OpenAI (OpenAI OpCo, LLC, USA) | Requests to your ChatGPT ads account with the key or sign-in you provided; the product feed, which OpenAI downloads from the address you give it. | Managing and evaluating your ads in ChatGPT. |
| Hetzner Online GmbH (Germany) | all data stored in the application | the server the service runs on |
| Google LLC / Apple Inc. | only identity verification at sign-in, if you use it | one-click sign-in |
We sell the data to nobody and we don't use it for profiling or for automated decision-making with legal effect.
Transfers to the USA: Google LLC is certified under the EU–US Data Privacy Framework; for OpenRouter and OpenAI the transfer relies on the standard contractual clauses approved by the European Commission. Hetzner stores the data in the EU.
Data from Google services
If you connect Google Analytics 4, Search Console or Merchant Center, we access them read-only (scopes analytics.readonly, webmasters.readonly and content for the Merchant API, which we use only for reading). We read aggregated figures — sessions, transactions, revenue, ad cost, clicks and impressions by campaign and traffic source for the last 90 days —, search queries and pages with their clicks for your shop's site, and your products' data and statuses in Merchant Center. We do not read or store personal data of your customers.
We use this data only to provide and improve the optimisation features you see in the app for your own shop. We do not sell it, use it for advertising, share it with third parties (except the processors listed above, to run the service), or use it to train general AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retrieved data is not stored in the database: it is held only in the server's memory, for at most 24 hours, while the analyses you see in the app are computed. You can disconnect a service at any time in the app (Where is what → Connected services) or revoke access in your Google account (myaccount.google.com/permissions). When you disconnect a service or your shop is deleted, we revoke the access at Google and delete the tokens and the held data immediately.
How long we keep it
| Account and shops | while you use the service and 30 days after the account is closed |
| Billing details and documents | 10 years (Accounting Act and VAT Act) |
| Operational records and notifications | 90 days |
| Sign-in attempt counters | at most 1 hour, only in the server's memory |
| Access tokens, keys and the list of connected properties and accounts | until you disconnect the service, then deleted immediately |
| Data read from Google (traffic, search, products) | only in the server's memory, at most 24 hours; not stored in the database |
| Assistant intent records (without question text) | 90 days |
Your rights
- to access the data we hold about you
- to have inaccurate data corrected
- to erasure („the right to be forgotten“)
- to restriction of processing
- to data portability in a machine-readable form
- to object to processing based on legitimate interest
- to lodge a complaint with the Office for Personal Data Protection (uoou.gov.cz)