Privacy policy
Effective October 8, 2026
This explains what Rating Talk collects when you visit ratingtalk.com or buy from it, why we collect it, who else sees it, and what you can tell us to do about it.
We are based in Austria, so European data protection law (the GDPR) applies to everything below, wherever in the world you live. If you are in the United States, a section further down adds the rights your state gives you.
Who is responsible
Emanuel Chereji, sole trader (Einzelunternehmen), Hofmannsthalweg 20/1/4, 4030 Linz, Austria. Rating Talk is a trading name of that business, and that business is the controller of the personal data described here.
Email: support@ratingtalk.com. Full business details are in our Legal Notice.
We have no data protection officer, because the law does not require a business of this size to appoint one. Write to the address above and it reaches the person who decides.
The short version
To sell you a file we need an email address and a payment. To learn whether our page and our advertising work, we measure what visitors do on our pages and we tell Meta when a purchase happens. Nobody pays us for your data, and we make no automated decisions about you that have legal or similarly significant effects. Every tool that touches your data is named below, by name.
What we collect
When you buy. Your name, email address, billing address, phone number if you give one, and what you ordered. Card details go straight to the payment processor. We never see them.
When you visit. Which pages you open and for how long, how far you scroll, which sections you see, which buttons, links and questions you tap, and where on the page you tap, click or move your mouse (never what you type into a field), whether you copy text (how much, never the text itself), page errors, how fast the page loads, and your device, browser, screen size and language. Your IP address: our analytics work out an approximate country, region and city from it and then drop it, keeping no postal code or exact location. If you arrived from an advertisement or an email, the campaign tags, the ad's identifier and Meta's click identifier (fbclid) in the link.
On your order. Shopify keeps the IP address and browser details of the device you order from, for fraud checks. When you check out, we also store on your order which ad or link brought you to us (the campaign tags, the ad's identifier, Meta's click identifier and how long ago you clicked), the page you first arrived on, which version of our page you saw, whether you came through an app's built-in browser, and the anonymous analytics identifiers of your visit, so we can tell which advertising works. We do not use them to identify you as a person.
During and after checkout. The steps of your checkout (when you start it, when you submit your contact and payment details, and when the order is complete), any message the checkout shows you about a problem (with addresses and numbers removed), what you ordered, the order's number and value, any discount code, and which download or offer buttons you tap on the order pages. Our analytics never receive your card details, your name, your email address, your phone number or your billing address.
Recordings, only with your consent. If you visit from the European Economic Area, the United Kingdom or Switzerland and accept analytics in the cookie banner, we may record your visit: a replay of the pages as you saw them, with your scrolling, taps and clicks, and with everything typed into fields hidden. Visitors in the United States are not recorded.
If you answer our question. We may show a one-question survey on the page. If you answer it, we keep your answer and anything you type into it.
When you sign up for the free sample. Your email address, when you signed up and on which form, so we can send you the sample and the emails you asked for, and show that you asked for them.
When you write to us. Whatever you write and your email address, and, on the contact form, your name and an order number if you give one.
Why we collect it, and what allows us to
| What we do | Why we are allowed to |
|---|---|
| Take your order, deliver your files, honor the guarantee | Performing our contract with you (Art 6(1)(b) GDPR) |
| Answer your messages | Performing our contract, or our legitimate interest in running a business people can reach (Art 6(1)(b) and (f)) |
| Keep invoices and accounting records | A legal obligation on us under Austrian tax law (Art 6(1)(c)) |
| Measure how the page and the checkout perform, so we can improve them, and ask our survey question | Your consent where we ask for it (the European Economic Area, the United Kingdom and Switzerland; Art 6(1)(a)); elsewhere our legitimate interest in knowing whether the page and our advertising work, which you can object to at any time (Art 6(1)(f)) |
| Record visits | Your consent (Art 6(1)(a)). We ask for it only in the European Economic Area, the United Kingdom and Switzerland, and record no one else |
| Measure and target advertising | Your consent where we ask for it (the European Economic Area, the United Kingdom and Switzerland; Art 6(1)(a)); elsewhere our legitimate interest in knowing whether our advertising works, which you can object to at any time (Art 6(1)(f)) |
| Send you marketing email | Your consent (Art 6(1)(a)), which you can take back at any time |
| Keep our forms free of spam | Our legitimate interest in a site that works (Art 6(1)(f)) |
| Let Shopify use store data for its own network features (Shopify Network Intelligence) | Your consent where we ask for it (the European Economic Area, the United Kingdom and Switzerland; Art 6(1)(a)); elsewhere our legitimate interest in the store features that depend on it, which you can object to through "Your privacy choices" (Art 6(1)(f)) |
Where we rely on legitimate interest, the interest is a plain commercial one: knowing whether the page and the advertising work, so that money is not spent on things that do not. We weighed that against your side of it, which is why we never record a visitor we have not asked, why our analytics drop the IP address once the approximate location is known, and why we do not build a profile of you as a named person.
Giving us your data is voluntary, but we cannot sell you anything without an email address and a payment.
Who processes data for us
- Shopify International Limited, Ireland, runs the store, the checkout, the order records and the order emails. Shopify also uses this data, together with data from other stores and its own services, for its own analytics, personalization and advertising features (Shopify Network Intelligence). For that use Shopify is responsible itself, under its Consumer Privacy Policy (https://www.shopify.com/legal/privacy/consumers), and you can exercise your rights with Shopify at https://privacy.shopify.com. It follows your cookie choice and your opt-out on this site.
- Shopify Payments, executed by Stripe Technology Europe Limited, Ireland, takes the payment and checks it for fraud. If you pay with Shop Pay, Apple Pay, Google Pay or another wallet or payment method, its provider also handles the payment under its own privacy policy.
- Shopify Messaging sends the marketing emails you asked for, and Shopify Flow decides which of them go to whom. Both are part of Shopify.
- ReConvert (ReConvert Ltd., Israel, trading as Upsell.com) shows the one-click offer on the page after your payment and adds what you accept to your order. It receives your order and the customer details Shopify holds for it (your name, email address, billing address and what you bought), and measures how its offers are used, which can include its own pixel on our pages. It processes data in Israel, the United States and the European Union.
- PostHog (PostHog, Inc., USA) provides the page and checkout analytics, the recordings and the survey described above, and stores them in the United States (PostHog's US Cloud). It receives your IP address only to work out the approximate location.
- Meta Platforms Ireland Limited handles advertising. Meta is a special case and has its own section below.
- Microsoft hosts the mailbox that receives your support email (Microsoft 365, provided through GoDaddy).
- Anthropic (Anthropic Ireland, Limited, with processing by Anthropic PBC in the USA) provides Claude, the AI assistant we use to read your support emails, draft our replies and look up your order. A person checks every reply before it is sent. We use Claude under Anthropic's consumer terms, so Anthropic handles this data under its own privacy policy (https://www.anthropic.com/legal/privacy), with model training switched off for our account.
- hCaptcha (Intuition Machines, Inc., USA) checks that a form on this site is sent by a person. It sees your IP address and browser details when you use a form.
These providers act on our instructions and may not use your data for their own purposes, except Shopify and Anthropic as described above, Stripe for fraud prevention and its own legal duties, Microsoft for its limited business operations, and where a section below says otherwise.
Advertising, and the part where Meta and we are jointly responsible
A Meta pixel runs on our pages and reports page views, the product you look at, checkout steps and purchases, along with scrambled (hashed) versions of contact details you type into a form on this site or at checkout. Our store also sends these events to Meta from its server (Meta's Conversions API), with scrambled (hashed) versions of your email address, name, phone number if you gave one, and billing city, state, ZIP code and country, together with your IP address and browser details, so Meta can match the sale to the advertisement you clicked. Meta can combine what its pixel collects here with what it knows about your activity on other websites and apps.
For that collection and transmission, Meta Platforms Ireland Limited and we are joint controllers under Art 26 GDPR. This is the essence of the arrangement between us, which we are required to make available to you:
- We are responsible for having a legal basis for collecting the data and sending it to Meta, for telling you about it (which is what this section does), and for making this summary available.
- Meta is responsible for its own security, for keeping records of the processing, and for handling your requests about the data once it has arrived.
- Once the data has reached Meta, what Meta does with it afterwards is Meta's own responsibility, not ours, and not covered by the joint arrangement.
- You can exercise your rights against either of us. Whichever one you contact, the request is valid.
Meta's own description of its side is at facebook.com/legal/controller_addendum. What Meta lets you change about the advertising you see is in your Facebook or Instagram settings, under Ads.
Under US state privacy laws, sending these events to Meta is targeted advertising (California calls it sharing for cross-context behavioral advertising). Because Meta gives us advertising measurement in return, some states may count it as a sale too, although no money changes hands. We say so plainly rather than leave you to work it out: we treat it as both, and one opt-out covers both (see "If you are in the United States").
Data leaving Europe
Some of the providers above are in, or send data to, the United States, and ReConvert also to Israel.
Where the European Commission has decided that a country, or a certified provider in it, protects personal data adequately (Israel, for example, or providers in the United States certified under the EU-US Data Privacy Framework), the transfer relies on that decision. Where it has not, the transfer relies on the European Commission's Standard Contractual Clauses, together with the extra technical and organizational measures the provider has in place.
Shopify is not certified under the Data Privacy Framework. Transfers to Shopify rely on the safeguards in Shopify's data processing terms: Standard Contractual Clauses or Shopify's binding corporate rules.
You are entitled to a copy of the safeguards we rely on. Email support@ratingtalk.com and we will send them to you.
How long we keep things
| What | How long | Why |
|---|---|---|
| Orders, invoices, accounting records | 7 years from the end of the year they relate to | Austrian tax law requires it (§ 132 BAO) |
| Analytics events and survey answers | Up to 7 years, stored without your name (the order they belong to carries it) | PostHog's retention on our plan |
| Recordings of visits | 30 days | PostHog's retention setting for this store |
| Marketing subscription | Until you unsubscribe, plus a record afterwards that you did | So that unsubscribing actually works and we do not email you again by mistake |
| Support email and contact form messages | Up to 7 years, unless you ask us to delete them sooner (we then keep only what our tax records need) | So we can answer follow-up questions and show what was agreed about a refund |
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to object to anything we do on the basis of legitimate interest, and to receive your data in a portable form. Where we rely on your consent, you can withdraw it at any time, and doing so does not make anything we did before that unlawful.
Email support@ratingtalk.com. We answer within one month. There is no charge.
If you think we have got this wrong, you can complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at. You can also complain to the authority where you live.
Cookies and similar technologies
Strictly necessary cookies keep your cart, your checkout and your session working. They run without consent because the site cannot work without them.
If you visit from the European Economic Area, the United Kingdom or Switzerland, analytics and advertising run only if you accept them in the cookie banner. Rejecting is exactly as easy as accepting, on the same screen, in one click. You can change your mind at any time through "Cookie preferences" in the footer, and withdrawing is as easy as giving it was. On our pages, our own analytics also wait for your yes whenever your device's time zone is in Europe or cannot be read, wherever you are; checkout analytics and advertising follow the cookie banner's regions.
Everywhere else, including the United States, analytics and advertising run from your first page, and you can stop them. "Your privacy choices" in the footer opts you out of sharing for advertising. A Global Privacy Control signal from your browser does the same, and our own analytics then do not load at all. If you object by email instead, we delete the analytics data we can link to you, for example through your order, and tell you how to switch the analytics off in your browser. Browsers' older "Do Not Track" setting has no agreed meaning, so we act on Global Privacy Control instead.
Marketing email
We only send marketing email to people who asked for it: by ticking the box at checkout, which is never ticked for you, or by signing up for the free sample. The order confirmation, which carries your download buttons, is not marketing and will reach you either way, because it is part of delivering what you bought.
Every marketing email carries an unsubscribe link. Unsubscribing takes effect straight away, and in any event within 10 business days.
If you are in the United States
These rights come from state law and apply on top of everything above. Wherever you live in the United States, you have them.
We share personal information for targeted advertising. That is the Meta pixel and the server-side events described above, which we also treat as a possible sale. Nobody pays us money for personal information. We do not sell or share sensitive personal information, we do not use personal information for profiling that leads to decisions with legal or similarly significant effects, and we do not use personal data to train large language models or sell or give it to anyone for that purpose.
You can opt out of targeted advertising, of any sale, and of profiling, through "Your privacy choices" (https://ratingtalk.com/pages/data-sharing-opt-out), linked in the footer of every page, or by emailing support@ratingtalk.com (writing "opt out" in the subject line helps). We also honor Global Privacy Control signals from your browser.
You can also ask for a copy of the data we hold about you, ask us to correct it, and ask us to delete it. We will answer within 45 days. If we say no, you can appeal by replying to that answer, and we will respond to the appeal within 60 days.
Exercising any of these rights costs nothing and we will not treat you differently for it.
Children
Rating Talk sells to adults, for their work. We do not knowingly collect data from anyone under 16, and we have no reason to. If you believe a child has given us data, email support@ratingtalk.com and we will delete it.
Changes to this policy
If we change it, the new version appears here with a new effective date. Changes apply going forward. They do not change what we already agreed with you about a purchase you have already made.
Rating Talk is a trading name of Emanuel Chereji, Hofmannsthalweg 20/1/4, 4030 Linz, Austria. Full business details are in our Legal Notice.