Privacy Policy

This Privacy Policy explains how the operator of Pumo (“Pumo,” “we,” “us”), a natural person established in Greece, collects, uses, and shares personal information when you use pumo.app, www.pumo.app, studio.pumo.app, and related services (the “Services”).

For GDPR, the controller is the operator of Pumo. Contact: hello@pumo.app. You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or, if you live in another EEA country, your local supervisory authority.

The Services are built for businesses. We treat account information as relating to people acting for a business. Individuals using the Services still have the rights described below where the law gives them those rights.

When a company is formed to operate Pumo, we will update this policy with the company’s name and address.

1. Information we collect

You provide: account details (name, email, hashed password via our auth provider, and Google identifiers if you use Google sign-in); business and brand context (shop or listing URLs, ASINs, brand name, colors, fonts, logos, product photos, related copy); billing details needed to start a subscription (card numbers are handled by Stripe; we do not store full card numbers); messages you send us.

We collect when you use the Services: listing and competitor data you ask us to analyze, including publicly available marketplace fields; generated images, video, scores, and Radar alerts stored in your account; usage data (pages viewed, features used, device and browser type, approximate location from IP, diagnostics); cookies and similar technologies (see section 8).

From others: Google if you sign in with Google; Stripe (payment status, last four digits, subscription state); marketplace data providers for public listing information; analytics and error tools described below, subject to your cookie choice.

We do not require identity documents or special-category data. Please do not send them.

2. How we use information

We use personal information to: provide the Services (accounts, listing checkup, competitor sets, Radar, generation, storage, and support); process subscriptions, trials, invoices, and failed-payment recovery; send transactional email (account, billing, Radar alerts, security); measure and improve the marketing site where you have accepted analytics cookies via CookieYes; secure the Services, prevent abuse and fraud, and debug errors; comply with law and enforce our Terms; communicate about the Services. Marketing email is sent only where allowed. You can unsubscribe from marketing.

We do not sell your personal information. We do not use your product photos, listing content, or Outputs to train our own AI models. Third-party AI providers process content you submit in order to return Outputs, as described in the Terms.

3. Legal bases (GDPR)

We rely on: contract — creating an account, running a checkup you requested, generating assets, billing a plan you bought; legitimate interests — securing the product, improving features, limited B2B communication, processing public marketplace data to deliver competitor comparison; consent — analytics cookies on pumo.app (Google Analytics, Microsoft Clarity) via CookieYes, and any marketing that requires it; legal obligation — tax, accounting, lawful requests.

You may object to processing based on legitimate interests; see section 9. You may withdraw cookie consent at any time via Cookie settings, which reopens the CookieYes banner.

4. How we share information

We share personal information with vendors who process it for us:

Vendors may only use the data to provide their service to us, except where they independently process it under their own privacy policy (for example Google Analytics after you consent, or an AI provider generating an image).

We may also share information if you ask us to; with professional advisers under confidentiality; if we sell or reorganize the business, under appropriate safeguards; or if required by law, or to protect rights, safety, or security.

Radar and similar emails go to the email on your account. You can ask us to stop Radar email; in-app Radar may still run on a paid plan.

5. International transfers

Personal information is processed in Greece and in other countries where our vendors operate, including the United States. Those countries may not have the same data-protection laws as Greece.

Where GDPR requires a transfer mechanism, we rely on the vendor’s Standard Contractual Clauses or equivalent (for example Stripe, Google, Supabase, Vercel, AWS).

6. Retention

We keep account, listing, and asset data while your account is open and for a reasonable period after closure so you can recover the account or we can complete billing. We keep payment and invoice records as tax and accounting law requires. Analytics data follows the retention set in those tools, and is not collected until you accept analytics cookies. Backups may persist for a limited time after deletion.

Public marketplace snapshots used for checkup and Radar may be retained as part of your listing history and our ability to show what changed.

7. Security

We use industry-standard measures (encryption in transit, access controls, hashed passwords via our auth provider). No internet service is completely secure. Use a strong unique password and protect access to your mailbox and Google account.

8. Cookies and similar technologies

We use CookieYes on pumo.app to ask for consent and to scan cookies on the marketing site.

Necessary (always on): sign-in session (Supabase) and a logged-in flag so pumo.app can show the right navigation when you are signed in on studio.pumo.app; Sentry error reports (we strip cookies from those reports). These are required to run the Services.

Analytics (off until you accept in CookieYes): Google Analytics 4 and Microsoft Clarity on pumo.app. Clarity may record session interactions (clicks, mouse movement, pages visited) so we can see how the marketing site is used — it is not used to collect passwords.

CookieYes may also list Functional or Advertisement categories if a scan finds those cookies.

The Reddit Pixel runs on pumo.app and studio.pumo.app. It measures ad landing pages and product actions (audit, account, trial, paid plan). It does not receive the listing URL, ASIN, or generated images.

You can change your choice later via Cookie settings in the footer.

We do not use analytics or advertising cookies on pumo.app before you accept. We do not respond to “Do Not Track” signals in a uniform way because browsers send them inconsistently.

9. Your rights

You may request access, correction, deletion, or export of your personal information, restriction or objection to certain processing, and withdrawal of consent. Email hello@pumo.app from the address on your account. We may need to verify it is you. You may also close your account.

You may complain to the Hellenic Data Protection Authority (www.dpa.gr) or your local EEA supervisory authority. We would rather fix the issue directly first.

10. California privacy

If the California Consumer Privacy Act (as amended) applies: we collect the categories in section 1 (identifiers, commercial information, internet activity, visual information you upload, and inferences such as listing scores); we use them for the purposes in section 2; we disclose them to the service-provider categories in section 4; we do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined in CCPA. Email hello@pumo.app to know, delete, or correct. You will not be discriminated against for exercising those rights.

11. Children

The Services are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes

We may update this Privacy Policy. We will post the new version here and change the effective date. For material changes, we will provide additional notice where required.

13. Contact

hello@pumo.app

Controller: the operator of Pumo, established in Greece.