This Privacy Policy explains how Lemonmind sp. z o.o. (“we”, “us”, “our”), operating the openProd.io platform, collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Polish data protection law.
We are established in the EU, so we apply the GDPR to every visitor, wherever they are. Local laws can add rights on top of it (see section 6.1); they never reduce it.
1. Data Controller
Lemonmind sp. z o.o. ul. Azymutalna 9, 80-298 Gdańsk, Poland KRS: 0000953368 (District Court Gdańsk-Północ in Gdańsk, VII Commercial Division of the National Court Register) NIP: 9571141336 | REGON: 521268736 Email: hello@openprod.io
In all matters concerning your personal data, write to hello@openprod.io or to the address above, marked “Personal data protection”.
2. Data We Collect
2.1 Account & Contact Data
When you register, request a demo, or contact us, we may collect:
- Full name
- Email address
- Company name and job title
- Phone number
2.2 Usage Data
When you use our platform, we collect:
- Features accessed and actions performed
- Content uploaded or created
- Timestamps and session duration
2.3 Technical Data
We automatically collect:
- IP address
- Browser type and version
- Operating system
- Device identifiers
- Referring URLs and pages visited
- Approximate country and region, which our hosting provider derives from your IP address. We use them only to show prices in your currency and any local privacy links (such as the US link in section 6.1). Your browser keeps them for the current session; we do not store them on our servers.
2.4 Form Data
When you use a form on openprod.io, we receive what you enter:
- Book a demo: work email and full name, and optionally your company, team size, current PIM system and main product data challenge.
- Request a quote: work email and full name, and optionally your company, current PIM system, how many suppliers send you files and what the quote should cover.
- Contact: full name, email and message, and optionally your company and phone number.
- ROI calculator report: work email, optionally your name and company, and the calculator assumptions you entered.
- Marketing consent: whether you ticked the optional box, the version of its wording, and the time we received it; if you withdraw it, when and how.
- Job application: full name, email, the role you apply for and your CV, and optionally your phone number, a LinkedIn or portfolio link and a message; whether you ticked the optional future-recruitment box, the version of its wording, and the time we received it.
Providing this data is voluntary. Without the required fields we cannot answer your request, send the report or consider your application.
3. Purposes and Legal Bases
We process your personal data for the following purposes under Article 6 GDPR:
| Purpose | Legal Basis |
|---|---|
| Providing and maintaining our services | Performance of a contract (Art. 6(1)(b)) |
| Account creation and management | Performance of a contract (Art. 6(1)(b)) |
| Responding to inquiries and support requests | Legitimate interest (Art. 6(1)(f)) |
| Replying to demo requests, quote requests and contact messages, sending the ROI reports you request, and following up on them | Legitimate interest (Art. 6(1)(f)) |
| Sending product updates and marketing communications | Consent (Art. 6(1)(a)) |
| Running the recruitment you apply for, including assessing your qualifications | Steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Keeping your application for future recruitment, if you agree | Consent (Art. 6(1)(a)) |
| Website analytics, heatmaps and session recordings, after you accept optional cookies (section 4) | Consent (Art. 6(1)(a)) |
| Counting visits and measuring page speed without cookies (section 4.2) | Legitimate interest (Art. 6(1)(f)) |
| Showing prices in your currency and local privacy links based on your approximate country | Legitimate interest (Art. 6(1)(f)) |
| Ensuring security and preventing fraud | Legitimate interest (Art. 6(1)(f)) |
| Keeping records to establish, pursue or defend legal claims | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
Our legitimate interests are answering the people who contact us, presenting and selling openProd.io, knowing how often our pages are visited and how fast they load, keeping our website secure, and protecting ourselves against claims.
We do not use your personal data for automated decision-making, including profiling, that produces legal effects for you or similarly significantly affects you.
3.1 Marketing Consent
The marketing box on our forms is optional and never ticked in advance. If you tick it, Lemonmind sp. z o.o. may email you about openProd.io products and services. Not ticking it does not affect your request.
You can withdraw your consent at any time with the unsubscribe link in every marketing email we send you, or by writing to hello@openprod.io. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
If you tick the box, we keep a record of your consent: your email address, the form you used, the version and wording of the consent text, and when you gave or withdrew it. We keep these records in a database hosted by Upstash, our processor (section 7), for as long as your consent is active and then as long as we need them to prove it (section 5).
3.2 Recruitment
When you apply for a role through openprod.io/careers, Lemonmind sp. z o.o. uses your application and CV to run that recruitment, including assessing your qualifications, as steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). The form sends your application to our team as one email with your CV attached, delivered by Resend (section 7). We keep it until the recruitment ends and then delete it.
The box for future recruitment is optional and never ticked in advance. If you tick it, we keep your application and CV for 12 months from when we receive them, to contact you about other roles, based on your consent (Art. 6(1)(a) GDPR). Not ticking it does not affect your application.
You can withdraw this consent at any time by writing to hello@openprod.io; we then delete your application unless the recruitment you applied for is still running. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. We do not make recruitment decisions by automated means.
4. Cookies
4.1 What Are Cookies
Cookies are small text files stored on your device when you visit our website. They help us provide a better user experience and understand how our site is used.
4.2 Types of Cookies We Use
Essential Cookies: Required for the website to function properly. These cannot be disabled. They handle session management, security, and basic functionality.
Analytical Cookies: Used to understand how visitors interact with our website. We use Google Analytics (via Google Tag Manager) to collect anonymous usage statistics. These cookies are only activated after you provide consent.
With the same consent, we use Hotjar (also via Google Tag Manager) to see how visitors use our pages, through heatmaps and recordings of visits: clicks, taps, mouse movement, scrolling and the pages viewed. Hotjar does not record what you type into form fields, and we hide your email address where a page shows it, so recordings do not contain them. Hotjar stores cookies such as _hjSessionUser_<id> (up to 365 days) and _hjSession_<id> (30 minutes).
Statistics without cookies: Vercel, which hosts this website, counts page visits (Web Analytics) and measures how fast pages load (Speed Insights) for every visitor. It sets no cookies and stores nothing on your device: a visit is recognised by a hash of the request that is discarded after a day, and we remove the query part of page addresses before anything is sent. This runs whatever you choose in the cookie banner, on our legitimate interest (section 3). You can object to it at any time (section 6).
Advertising Measurement: With your consent, the OpenAI Ads Pixel measures page views, article views, and successfully received demo, quote and ROI report requests to help attribute them to ads in ChatGPT. For submitted requests, we normalize and SHA-256 hash your email in your browser before sharing the hash for conversion matching. Our integration does not send your raw email, name, company, or message to the Pixel. We set events to opt out of future user-level personalization.
The Pixel may store the first-party cookies __oppref (up to 30 days) and __obref (up to 365 days). Browser restrictions or clearing cookies can shorten these periods. These periods describe cookie storage, not conversion-data retention.
4.3 Managing Cookies
When you first visit our website, a cookie consent banner will appear. You can choose to:
- Accept All: enables essential cookies, analytics (Google Analytics, and Hotjar heatmaps and session recordings), and OpenAI advertising measurement, including hashed-email matching
- Essential Only: optional analytics and advertising measurement remain disabled; the statistics without cookies in section 4.2 still run
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a choice of Essential Only: optional analytics and advertising measurement stay off and the banner does not ask you. You can still turn them on yourself in Cookie settings.
You can change your preference at any time using Cookie settings at the bottom of the page. Visitors from US states with opt-out rights also see a Do Not Sell or Share My Personal Information link that opens the same settings. Choosing Essential Only stops future Pixel measurement and asks the Pixel to remove its cookies; the page reloads to unload optional analytics already running. Previously granted analytics consent alone does not enable the new OpenAI measurement. You can also configure cookie settings in your browser.
5. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, in particular for the period required by law or until related claims become time-barred:
- Account data: retained for the duration of your account and up to 12 months after deletion, unless longer retention is required by law.
- Form enquiries (demo requests, quote requests, contact messages, ROI report requests): retained while we handle your request and any follow-up, then until related claims become time-barred, unless longer retention is required by law.
- Marketing: we use your email for marketing until you withdraw your consent.
- Usage and technical data: retained for up to 26 months.
- Marketing consent records (section 3.1): retained for the duration of consent plus 3 years after withdrawal, to prove the consent.
- Job applications: retained until the recruitment you applied for ends; with your consent to future recruitment, for 12 months from when we received them or until you withdraw consent.
- Invoicing and financial data: retained for 5 years as required by Polish tax law.
6. Your Rights
Under the GDPR, you have the right to:
- Access your personal data and receive a copy (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data (“right to be forgotten”) (Art. 17)
- Restrict processing (Art. 18)
- Data portability: receive your data in a structured, machine-readable format, where we process it based on your consent or a contract (Art. 20)
- Object to processing based on legitimate interests, at any time, on grounds relating to your particular situation (Art. 21)
- Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal (Art. 7(3))
- Lodge a complaint with the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa https://uodo.gov.pl
You can also complain to the data protection authority where you live or work. Visitors outside the EU, including in Canada and Brazil, have the same rights and choices described here.
To exercise your rights, contact us at hello@openprod.io. We will respond within one month (Art. 12(3)).
6.1 US State Privacy Rights
If you live in California or another US state with a consumer privacy law, you may have the right to know what personal information we collect and how we use it, to access, correct and delete it, and to opt out of its “sale” or “sharing”, including for targeted advertising. We do not sell your personal information for money.
With your consent, our cookie banner enables the OpenAI Ads Pixel, including hashed-email matching for submitted forms (section 4.2). Some US state laws can treat this as “sharing” or targeted advertising. To opt out, use the Do Not Sell or Share My Personal Information link shown to US visitors under our forms and in the footer, or Cookie settings at the bottom of any page, and choose Essential Only. We also honour a Global Privacy Control signal from your browser as this opt-out (section 4.3).
To use any of these rights, write to hello@openprod.io; an authorized agent can also write for you. We will not discriminate against you for using them.
7. Third-Party Services
We use the following third-party services that may process your data:
- Vercel: hosts the website and runs the form endpoints, so it processes technical data such as your IP address and the content of the forms you send. It also provides the statistics without cookies described in section 4.2 (Web Analytics and Speed Insights). Vercel Privacy Policy
- Resend: delivers the emails our forms send, to our team and to you. Resend Privacy Policy
- Upstash: hosts the database of marketing consent records described in section 3.1. Upstash Privacy Policy
- Calendly: if you book a meeting through our Calendly link, Calendly processes your booking details. Calendly Privacy Notice
- Google Analytics (via Google Tag Manager): website analytics, only after your consent. Google may process data in the United States. Google Privacy Policy
- Hotjar: heatmaps and session recordings of how visitors use our pages, only after your consent (section 4.2). Hotjar Privacy Policy
- OpenAI Ads Measurement Pixel: consent-based advertising measurement and conversion matching as described above. OpenAI Measurement Pixel documentation
- YouTube: we link to our videos on YouTube and do not embed its player on openprod.io, so YouTube receives data only when you open a link. Google Privacy Policy
We may also share data with providers of IT and email systems that support our business, and with our legal, accounting and financial advisers. They process data under a contract with us and only on our instructions, and they must keep it secure and confidential. We may disclose data to public authorities where the law requires it.
We only share personal data with third parties when necessary to provide our services, and we ensure appropriate data protection agreements are in place.
8. International Data Transfers
Some of the services above are based in the United States, so your data may be transferred outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure adequate protection in line with Chapter V GDPR through:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c))
- Transfers to countries with an adequacy decision from the European Commission
9. Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS) and at rest
- Access controls and authentication mechanisms
- Regular security assessments
- Employee training on data protection
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via our website or email. The “Last updated” date at the top of this page indicates the most recent revision.
11. Contact
If you have questions about this Privacy Policy or our data practices, contact us:
Lemonmind sp. z o.o. ul. Azymutalna 9, 80-298 Gdańsk, Poland Email: hello@openprod.io