On this page
Effective date: October 21, 2026
Document version: 2.2
Read together with our Privacy Policy and Security page. The current sub-processors list is in section 9. Need a counter-signed Data Processing Addendum? See section 10.
1. Introduction
The General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") governs how organizations process personal data of people located in the European Economic Area (EEA). Equivalent regimes apply in the United Kingdom (UK GDPR) and Switzerland (FADP).
Quoli is built to help merchants comply with these laws when collecting reviews, photos, videos, and Questions from EEA, UK, or Swiss shoppers. This page sets out our commitments and the specific GDPR-relevant features we offer.
2. Who this applies to
The GDPR applies if any of the following is true:
- You are a merchant established in the EEA, UK, or Switzerland.
- You sell to or market to customers located in the EEA, UK, or Switzerland.
- You monitor the behavior of people in those regions (for example, analytics that profile EU shoppers).
If any of those apply, the obligations in this page apply to your use of Quoli.
3. Our role under GDPR
For data processed via the Quoli Service, the relationship is:
- The Merchant is the Controller. You determine the purposes and means of processing your shoppers' personal data.
- Quoli is the Processor. We act on your documented instructions to provide the Service.
- Our sub-processors (listed in section 9) act as further processors, bound by contract to the same standards.
Where Quoli collects data about you and your team directly (account info, billing, support), we act as the Controller for that data. That handling is described in our Privacy Policy.
4. Data we process on your behalf
The personal data Quoli processes about your shoppers typically includes:
- Identifiers: name, email address and phone number from the order, Shopify customer ID, and IP addresses, which appear in our server logs and are used to limit abuse of review and vote forms.
- Order data: order number, products purchased, fulfillment and delivery dates.
- Review and Questions content: text, star rating, photos, videos.
- Review form answers: answers to any extra questions the merchant adds to its review form, and the reviewer's city where the merchant shows it.
We do not process special categories of personal data (health, race, religion, political opinions, biometric data) and we do not knowingly collect data from children under 16.
5. Lawful basis for processing
As your processor, we rely on the lawful basis you have established as the controller. For most review-related processing, the typical lawful bases are:
- Consent from the shopper at the moment they submit a review, photo, or video.
- Legitimate interest for sending review request emails after a confirmed purchase, where the customer relationship arising from the purchase justifies the contact.
- Legal obligation for retention of records required by law (for example, tax records).
You should reference these in your own privacy notice. Quoli supports this by suppressing recipients who unsubscribe, bounce or are on your email blocklist.
6. Data subject rights
Under the GDPR, data subjects (shoppers, in our context) have the following rights:
- Access: request a copy of the personal data held about them.
- Rectification: ask to correct inaccurate or incomplete data.
- Erasure: request deletion (the "right to be forgotten").
- Restriction: request that processing be paused.
- Portability: receive their data in a machine-readable format.
- Object: object to processing based on legitimate interest.
- Withdraw consent: at any time, where processing is based on consent.
In the Quoli dashboard you can find a shopper's reviews by name or email, unpublish them, and export your reviews. To have a shopper's data deleted, or to get a copy of it, email support@quoli.io and we will handle the request.
7. International data transfers
Personal data we process is stored and processed in the United States. Where data of EEA, UK, or Swiss data subjects is transferred to a country that has not been recognized as offering an adequate level of protection, the transfer is governed by:
- The Standard Contractual Clauses (SCCs) issued by the European Commission in Decision 2021/914 (Module 2: Controller-to-Processor).
- The UK International Data Transfer Addendum for transfers from the UK.
- The Swiss DPA-equivalent of the SCCs as recognized by the Swiss FDPIC.
The SCCs are pre-incorporated into the DPA we offer to merchants (see section 10).
8. Security and breach notification
Quoli encrypts data in transit with TLS and stores data with providers that encrypt it at rest. Read our Security page for details.
If a personal data breach affects your data, we will notify you without undue delay, with the information you need to meet your own notification duties under Articles 33 and 34.
9. Sub-processors
We use a small number of sub-processors to deliver the Service, each bound by contract to data protection obligations no less protective than those we owe you. Merchants who want to hear about changes to this list can email support@quoli.io with the subject "Subscribe to sub-processor updates".
The current sub-processor list:
| Sub-processor | Purpose | Personal data |
|---|---|---|
| Google Cloud | Application servers, database and cache (United States) | All personal data processed by the Service |
| Cloudflare | Storage and delivery of review photos and videos | Photos and videos shoppers upload |
| Amazon Web Services | Email delivery (Amazon SES, United States) | Recipient name and email, email content |
| OpenAI | QI reply and answer drafts, review summaries, ad copy and the QI confidence check | Review text and ratings, reviewer first name, product and store names |
| Anthropic | Ask QI answers in the merchant dashboard | Review text and ratings |
| remove.bg | Background removal on photos a merchant picks for ads | Review photos the merchant chooses |
| Intercom | Support chat | Name, email and messages of people who contact support |
| Partner.io | Partner and affiliate program management | Partner contact details and referral activity |
| Shopify | Platform, billing, Shopify Flow and the Shop app | Store, order and customer data under Shopify's terms |
Objections to a current or proposed sub-processor on reasonable data protection grounds: contact support@quoli.io. Where the parties cannot resolve the objection in good faith within 30 days, you may terminate the affected portion of the Service without penalty.
10. Data Processing Addendum (DPA)
Most merchants do not need a separately executed DPA because our standard Terms of Service already incorporate the necessary processor obligations and the SCCs by reference. The Terms operate as our DPA on acceptance.
If your legal team requires a counter-signed DPA document, email support@quoli.io with the subject line "DPA execution request." Include:
- Your full legal entity name and registered address.
- Any required modifications (we accept reasonable redlines).
- Your signing party's name, title, and email.
We return a counter-signed copy. There is no fee, and DPA execution does not require an upgraded plan.
11. Contact our Data Protection point of contact
For GDPR questions, data subject requests routed to Quoli, sub-processor objections, or anything else GDPR-related, contact us at support@quoli.io with subject line "GDPR request." Our team responds on weekdays.