1. Who handles the data
The data controller is Pura Lógica - Unipessoal, Lda., company registration number 509772994, with registered offices atRua do Parque Tejo, 11 2625-437 Forte da Casa, Portugal.
For any question about this policy or about your rights, write to info@buskara.com.
2. Two different roles
This policy covers two situations that the law treats differently, and that are best not confused:
We are the controller of the data of anyone with an account in the panel: the name, the email, the billing details and the record of how the product is used.
We are the processor of the data we handle on behalf of client shops, namely the searches and the clicks of those shops' visitors. There, the shop decides the purposes, and we handle the data according to its instructions and the processing agreement that accompanies the Terms and Conditions.
3. What data we handle
From anyone with an account: name, email address, encrypted password, preferred language, role in the team, billing details and payment history, access and panel usage records.
From the client shop's catalogue: product titles, descriptions, categories, brands, prices, availability and images, as supplied by the shop.
From the visitors of client shops: the terms searched, the results shown and clicked, a random session identifier, the truncated IP address and technical browser information. We do not ask for a name, an email or any other direct identifier of the visitor; if one happens to be typed inside a search, it is handled as text and deleted along with the record.
4. What they are for and on what basis
| Purpose | Basis |
|---|---|
| Creating and maintaining the account, giving access to the panel | Performance of the contract |
| Indexing the catalogue and answering searches | Performance of the contract |
| Invoicing and collecting the subscription | Performance of the contract and legal obligation |
| Retaining billing records | Legal obligation (tax) |
| Measuring and improving the quality of the results | Legitimate interest |
| Security, abuse detection and usage limits | Legitimate interest |
| Communications about the service you subscribed to | Performance of the contract |
| Marketing communications about news and updates | Consent, withdrawable at any time |
| Usage statistics for this site (Google Analytics, Microsoft Clarity) | Consent, withdrawable at any time |
5. Features that use language models
Some features, such as synonym suggestions and the discovery assistant, send text to a language model provided by Anthropic or OpenAI. What is sent are search terms and catalogue information, never account or billing data.
This processing is carried out to produce the suggestion you asked for and is not used to train models.
6. Who we share with
We use processors that handle data on our behalf and under the same obligations:
PTServidor - hosting of the application and the databases, in the European Union;
ifthenpay, Lda. - payment processing;
Anthropic or OpenAI - language models, for the features listed in point 5;
Google Ireland Limited - usage statistics for this site (Google Analytics 4), only with your consent, given when asked on your first visit;
Microsoft Ireland Operations Limited - usage statistics for this site (Clarity), with the same consent.
We do not sell personal data and we do not share it for third-party advertising. Outside these cases, we only disclose data when the law or a competent authority requires it.
7. Transfers outside the European Union
The application and the databases are hosted in the European Union. When a processor handles data outside the European Economic Area, that transfer is made under the standard contractual clauses approved by the European Commission or under an adequacy decision.
8. How long we keep it
Account data: for as long as the account exists, and for up to 90 days after it is closed.
Billing records: 10 years, as required by tax law.
Search and click records: according to the retention period of the plan the shop has contracted, after which they are deleted by an automatic routine.
Technical security logs: 12 months.
9. Your rights
You have the right to access your data, to correct it, to erase it, to restrict or object to the processing, and to data portability. Where the processing is based on consent, you can withdraw it at any time, without affecting what was done before.
To exercise any of these rights, write to info@buskara.com. We reply within 5 days.
If you are a visitor of a client shop, address your request to the shop: it is the shop that decides the purposes of that processing. If it reaches us, we forward it to them.
You may also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, at www.cnpd.pt.
10. Security
Passwords are stored encrypted and never in plain text. Traffic is served exclusively over HTTPS. Access to production data is limited to those who need it to do their work, and API keys can be revoked by the customer at any time from the panel.
11. Changes to this policy
When this policy changes in any relevant way, we notify account holders by email. The date of the last update is at the top of the page.