Privacy Policy

The data controller responsible for processing your personal data is:

ZESTIQ Sp. z o.o.
ul. Konduktorska 18/7
00-775 Warszawa, Poland

KRS: 0001227482 | NIP: 5214156564 | REGON: 544179182

Email: hi@zestiq.com

You can contact us with any privacy questions, data requests, or concerns using the contact information above. We aim to respond to all inquiries within 30 days.

We have appointed a Data Protection Officer (DPO) to oversee our data protection practices and ensure compliance with GDPR requirements. The DPO is available to answer questions about our processing activities and to assist with your rights requests.

Data Protection Officer, ZESTIQ Sp. z o.o. Email: hi@zestiq.com

We collect personal data only when necessary to provide our services, improve your experience, and comply with legal obligations. Below are the types of data we collect on this website.

3.1 Contact Form Submissions

When you submit a contact form, we collect:

• Name and email address: to reply to you
• Company name and website (optional): to understand your business before we respond
• Ecommerce platform (optional): Shopify, Magento, WooCommerce and similar
• Message content and enquiry type: so the right person answers, for example a call booking or a feature request
• Timestamp: to track when the submission occurred

3.2 Newsletter Subscriptions

When you subscribe to our newsletter, we collect your email address and subscription date, so we can send you checkout and conversion insights and manage your subscription. You can unsubscribe from any email.

3.3 Free Checkout Audit Requests

When you request a free audit, we collect:

• The website address you submit: the site we are asked to scan
• Your name and email address: to send you the finished report
• Ecommerce platform (optional) and the page you requested the audit from
• Your IP address: used only to rate limit requests and prevent abuse of the scanner

What the audit itself then does with your website is described in full in Section 4.

3.4 Gated Downloads

Some resources, such as the printable 77-point checkout checklist, ask for an email address before download. We use it to send the file and, where you agree, to follow up with related material.

3.5 Website Usage & Analytics Data

When you visit our website, we automatically collect:

• Pages visited and time on site: which content is useful
• Device information: browser type, operating system, device type
• IP address: to understand your general location (city or country level)
• Referral source: how you arrived at our site
• Clicks and interactions: which links and features you engage with

Analytics data is collected only after you accept analytics cookies in the cookie banner. Strictly necessary processing (your IP address in short-lived server logs and the session that keeps our forms working) happens regardless of that choice.

3.6 Cookie Data

Cookies and browser storage keep the site working and help us measure traffic. See Section 11 for the full list.

Our free audit is an automated scan of a website you ask us to look at. Because it visits a real store, this section sets out precisely what it does, what it refuses to do, and where the resulting data goes.

4.1 What the Scan Collects From Your Site

• Page content and markup: the HTML, headings, metadata, links and scripts of publicly reachable pages
• Screenshots: desktop and mobile captures of key pages, used for the design and usability review
• Technical signals: response headers, load timings, Core Web Vitals, security headers, structured data
• Cart and checkout structure: which fields, payment methods, trust signals and validation behaviors are present

The scan only sees what any member of the public can see. It has no access to your admin panel, your orders, your customer records or your analytics.

4.2 The Guest Checkout Walkthrough

For ecommerce sites, the audit may walk a guest checkout to see where it breaks. During that walkthrough it will add an item to a cart, proceed through the guest checkout steps, and stop at the payment step. It operates under strict, built-in limits:

• It never places an order and refuses to click pay, place-order or confirm buttons
• It never enters card or payment details and refuses to type into card, CVV or payment-provider fields
• It never logs in and does not attempt to pass any login wall or account area
• It empties the test cart afterwards, on a best-effort basis
• Where a checkout step requires an email address, a test address belonging to us is used, never yours and never a customer's

If your storefront publicly displays personal data, for example reviews showing customer names, that content may appear in the screenshots we capture. This is one reason audit reports are delivered by private link rather than published.

4.3 Who Processes the Audit Data

Scan findings and screenshots are analyzed by AI models to turn raw technical output into readable findings. This means your submitted pages and screenshots are sent to Anthropic (the Claude API) for that analysis, and questions you ask through the "Ask the Auditor" feature inside a report may be processed by Groq. Both act as processors on our instruction. Full list in Section 7.

4.4 Where the Report Lives

The finished report is stored on our servers and reachable through a private, unguessable link that we email to you. Report links are not indexed and are not listed publicly. We also keep the structured findings so that a later audit of the same site can show you what was fixed and what is still open.

4.5 If You Do Not Want This

Only request an audit for a website you own or are authorized to act for. You can ask us to delete a report, its findings and the screenshots at any time by emailing hi@zestiq.com with the domain and the report date.

Under GDPR Article 6, we only process your data where we have a legal basis. Here is our basis for each type of data:

We use collected personal data only for the following purposes:

Customer Service & Support

• Respond to your inquiries and support requests
• Follow up on contact form submissions and audit requests
• Answer questions about a report we produced for you

Delivering the Checkout Audit

• Scan the website address you submitted and generate your report
• Email you the private report link when it is ready
• Compare a repeat audit against your previous one to show progress
• Improve the accuracy of our checks using aggregated, cross-audit patterns

Marketing & Communications

• Send newsletter emails with checkout and conversion insights
• Share relevant case studies, guides and resources
• Inform you about new services (with your consent)

Product Improvement

• Analyze usage patterns to enhance the site and the audit tool
• Identify content and features that need refinement
• Gather feedback that shapes what we build next

Site Security & Analytics

• Detect and prevent spam, fraud and abuse of our forms and scanner
• Monitor website performance and uptime
• Debug technical issues and, with your consent, analyze traffic patterns

We do not sell, rent, or trade your personal data to third parties. We share data only with the providers we need to run this site and the audit, each bound by data protection terms:

Service Providers (Data Processors)

• Cloudways: managed hosting for our web and worker servers, where your submissions and reports are stored
• Anthropic (Claude API): AI analysis of audit scan output and screenshots
• Groq: AI processing of free-text questions asked inside a delivered report
• Elastic Email: delivery of transactional and newsletter email
• Google LLC (United States, certified under the EU-US Data Privacy Framework): Tag Manager and Analytics for site measurement (only with your consent), and reCAPTCHA v3 for spam protection on our forms
• Ahrefs Pte. Ltd. (Singapore, Standard Contractual Clauses): Web Analytics for aggregate traffic statistics (only with your consent)

All service providers are bound by Data Processing Agreements (DPAs) ensuring they process data only on our instruction and maintain equivalent security measures.

Legal & Regulatory Requirements

We may disclose personal data if required by law, court order, or government request. We will notify you of such requests unless legally prohibited.

Business Transfers

If ZestIQ is acquired, merged, or sold, your data may be transferred as part of that transaction. We will provide notice of such changes and any choices you may have regarding your data.

Zero Data Selling Policy: We are fundamentally committed to NOT selling, trading, or disclosing your personal data to advertisers, brokers, or third-party marketers. Your privacy is not a commodity.

We operate globally, and your data may be transferred to, stored in, or processed in countries outside the European Union. Several of the processors listed above, including the AI providers used by the audit, are based in the United States. When we transfer data internationally, we ensure adequate safeguards:

• Standard Contractual Clauses (SCCs): legally binding agreements that impose GDPR-equivalent protections
• Data Processing Agreements (DPAs): contracts with all our processors
• Adequacy decisions: where applicable

Concretely: Google LLC, based in the United States, relies on its certification under the EU-US Data Privacy Framework. Ahrefs Pte. Ltd., based in Singapore, a country with no EU adequacy decision, relies on the European Commission's Standard Contractual Clauses.

You have the right to know where your data is being transferred and the safeguards in place. You can request information about our data transfer mechanisms at any time by contacting our DPO.

We retain personal data only as long as necessary to fulfill the purposes for which it was collected. Once data is no longer needed, we securely delete or anonymize it.

After the retention period, data is deleted or irreversibly anonymized. You can request earlier deletion at any time (subject to legal obligations).

Under GDPR Articles 12-22, you have the following rights regarding your personal data:

Right to Access (Article 15)

You have the right to request a copy of all personal data we hold about you, including:

• A human-readable copy of your data
• Information about how we are processing your data
• Details about our processing purposes and legal basis

How to exercise: Email hi@zestiq.com with subject "Data Access Request."

Right to Rectification (Article 16)

If your personal data is inaccurate or incomplete, you can request correction. We will update your data and notify relevant third parties (where applicable).

How to exercise: Email hi@zestiq.com with subject "Data Correction Request" and details of what needs to be updated.

Right to Erasure, the "Right to Be Forgotten" (Article 17)

You can request deletion of your personal data, including any audit report we hold for your site, except where we have a legal obligation to retain it (for example for tax or billing purposes). Upon your request, we will:

• Delete your data from our active systems
• Instruct third-party processors to delete your data
• Retain only data necessary for legal compliance

How to exercise: Email hi@zestiq.com with subject "Right to Erasure Request."

Right to Restrict Processing (Article 18)

You can ask us to pause our use of your data while you dispute its accuracy, or while you exercise other rights. We will store your data but not actively process it.

How to exercise: Email hi@zestiq.com with subject "Data Processing Restriction Request."

Right to Data Portability (Article 20)

You can request your data in a portable, machine-readable format (for example CSV) to transfer to another service. We will provide this within 30 days.

How to exercise: Email hi@zestiq.com with subject "Data Portability Request."

Right to Object (Article 21)

You can object to processing based on legitimate interest or direct marketing. Upon objection, we will:

• Stop marketing emails immediately (if applicable)
• Review any other processing and cease where possible
• Keep only data necessary for legal obligations

How to exercise: Email hi@zestiq.com with subject "Data Processing Objection" or click "Unsubscribe" in any marketing email.

Right to Withdraw Consent (Article 7)

If you consented to marketing emails, you can withdraw that consent at any time. For cookies, open Cookie settings (also linked in the footer of every page) and switch analytics off. Withdrawing analytics consent stops Google Analytics and Ahrefs immediately and deletes the analytics cookies they set. We honor every withdrawal immediately.

How to exercise: Click "Unsubscribe" in marketing emails, or email hi@zestiq.com.

Right to Lodge a Complaint (Article 77)

If you believe we are not complying with GDPR, you have the right to lodge a complaint with your local data protection authority:

• Poland: Urzad Ochrony Danych Osobowych (UODO), uodo.gov.pl
• Other EU residents: contact your national data protection authority
• UK residents: Information Commissioner's Office (ICO), www.ico.org.uk

Response timeline: We will respond to all rights requests within 30 days of receipt. If your request is complex, we may extend this to 60 days (with notification). Requests are free, except for excessive or unfounded repeated requests.

When you first visit checkoutexpert.com a banner asks how we may use cookies. It offers three choices with equal weight: Accept all, Reject non-essential, and Customize, which lets you switch analytics on or off. Nothing non-essential loads before you choose. Your choice is stored for 12 months in a first-party cookie, after which we ask again. Strictly necessary cookies and the reCAPTCHA check on our forms work regardless, because the forms would not function without them.

Cookies We Use

Browser Storage (Functional)

Some preferences are stored locally in your browser and are never transmitted to us:

• Theme preference: remembers light or dark mode
• Checklist progress: remembers which items you ticked on the 77-point checklist

This is browser storage, not a cookie, and it stays on your device.

Consent Records

When you make a choice in the banner we store a short record on our server: a random consent id (also kept in the ce_consent cookie), the date and time, and the categories you chose. It contains no name or email address and exists only so we can demonstrate consent as GDPR Article 7(1) requires. We keep it for 3 years.

No Advertising or Retargeting

We do not run advertising pixels, retargeting tags or third-party ad networks on this website.

Managing Cookies

Open Cookie settings at any time (the same link sits in the footer of every page) to change your choice. You can also block or delete cookies through your browser settings, and you can opt out of Google Analytics everywhere using Google's browser opt-out add-on. Blocking strictly necessary cookies may prevent our forms from working.

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from individuals under 16 without verifiable parental consent.

If you are under 16: do not submit personal information through our contact forms, audit requests or newsletter signup. If you believe we have collected data from a child under 16 without consent, please contact us immediately.

Parental rights: parents or guardians can request access to, or deletion of, their child's data by contacting hi@zestiq.com with proof of guardianship.

We implement technical and organizational measures to protect your data from unauthorized access, alteration, or loss:

• Encryption in transit: all data transmitted to and from our servers uses TLS 1.2+ encryption (HTTPS)
• Access controls: only authorized staff can access personal data, on a need-to-know basis, and our admin area is password protected with brute-force lockout
• Private report links: audit reports are reachable only through an unguessable token and are excluded from search engines
• Form protection: CSRF tokens, honeypots, reCAPTCHA v3 and rate limiting on every public form
• Data processing agreements: all third-party processors sign Data Processing Agreements (DPAs)
• Incident response: we have a documented breach response plan and notify authorities within 72 hours (GDPR requirement)

However, no system is 100% secure. If you find a security issue, please report it to hi@zestiq.com.

We may update this privacy policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email if you are a subscriber or customer
• Request your consent for significant changes affecting your rights
• Provide a summary of what changed in the update

Your continued use of our website after changes indicates your acceptance of the updated policy. If you do not agree with changes, you can request deletion of your data.