Legal

Privacy Policy

Last updated: 28 October 2026

This Privacy Policy explains what personal data Bitlane collects, why, and what rights you have. It covers the website bitlane.co, the dashboard at app.bitlane.co, the API and our emails.

1. Who we are

The controller of your personal data, which builds and operates Bitlane ("we", "us"), is:

NMC Soft, a limited liability company registered with the National Business Center (QKB) of Albania, tax ID (NIPT) L11424007S
Muhamet Gjollesha, building next to Ring Center, entrance 2, 6th floor, Tirana, Albania
support@bitlane.co

Data in our customers' engines. Stores and websites that use Bitlane send us their catalogues and, through the search widget and the integrations, their visitors' searches, clicks and orders. For that data the store or website is the controller and we only process it on its behalf (see section 6). If you are a visitor of such a store, please refer to its privacy policy.

2. What we collect and why

Visitors of this website

  • Server logs: IP address, browser, the page requested and the time, kept by our hosting to deliver the site and keep it secure (legitimate interest).
  • Contact form: your email address, your message and the page you sent it from, to answer you (pre-contractual steps or legitimate interest). The message is delivered to our mailbox and not stored in the Service. The form is protected by Cloudflare Turnstile, which looks at your browser and IP address to tell people from bots (legitimate interest in preventing spam).
  • Website and dashboard analytics, only if you accept them in the cookie notice (consent, which you can withdraw at any time through Cookie Preferences at the bottom of every page of the website, or in the dashboard's account menu): Google Analytics records the pages you view (on the dashboard, only the kind of page, never the names or ids of your projects, engines or indexes), where you came from, your browser and device, and your approximate location, to tell us how the website and the dashboard are used. It is kept for 2 months. Details in the Cookie Policy. We do not use advertising on this website.

Customers and their team members

  • Account: name, email address, password (stored only as a secure hash), language, two-factor settings, the projects and roles you have. Needed to provide the Service (contract).
  • Security and sign-ins: IP address and browser of sign-ins and of requests to the dashboard and API, failed attempts (including the email address entered), the emails we sent you, and an audit log of important actions in your projects. Used to protect your account (for example, the email we send on a sign-in from a new device, with the device and IP address), prevent abuse and investigate incidents (legitimate interest). Sign-in, sign-up and password reset forms are protected by Cloudflare Turnstile, like the contact form.
  • Billing: your plan, subscription status, usage counts and invoices. Payments are handled by our payment provider (section 4), which collects your payment and billing details; we never receive your card details (contract, legal obligations).
  • Usage of the Service: how many records, searches and requests your engines handle, to apply your plan and bill usage (contract).
  • Emails: we only send emails about your account, security, billing, usage and important changes to the Service (contract). We send no newsletters or marketing emails; if we start, we will ask you first or let you opt out in every email.
  • Support: what you write to us and our answers.
  • Store plugins: when you connect a WordPress, PrestaShop, Magento, Shopware or OpenCart store, the store's address and name and the connection you authorise. The Shopware app also gives us the shop's ID and Shopware version, and the access you grant when installing it: reading the catalogue, to keep your search in sync, and the orders, for the purchases in your reports (see section 6). The WordPress, PrestaShop and OpenCart plugins check our servers for updates, which shows us the store's server address (and, for WordPress, its site address).

3. How long we keep it

  • Account data: while your account exists. To delete your account, write to support@bitlane.co; we delete it, with your projects, apart from what we must keep by law. Projects are also deleted after a plan ends, as described in the Terms of Sale.
  • Invoices and billing records: as long as tax and accounting law requires (in general 10 years).
  • Request logs of our servers (IP address, browser, the address requested): 30 days, longer when needed for an investigation.
  • Audit log and sign-in records: as long as the account or project they belong to exists.
  • Database backups: 7 days.
  • Contact form messages: up to 2 years after the conversation ends.
  • Usage records linked to your account, used for billing: as long as tax and accounting law requires, also after the engines are deleted.

4. Who we share it with

We do not sell personal data. We share it only with the service providers that help us run Bitlane, under contracts that bind them to protect it: our hosting provider (Google Cloud, in the European Union), our analytics database (ClickHouse Cloud, in the European Union), our payment provider, our email delivery service and our DNS and spam protection provider. The full list, with what each one does and where, is on the Sub-processors page. For the analytics of the website and the dashboard, if you accept them, we use Google Analytics (Google Ireland Limited).

We may also disclose data when the law requires it, or to protect our rights, our users or the public.

International transfers. Our Service and your engines run in the European Union. Where a provider processes data outside the European Union, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses.

5. Your rights

You have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw any consent you gave, under the GDPR and other data protection laws that apply. You can change most of your data in the dashboard; for anything else write to support@bitlane.co. We answer within one month.

You can also complain to a data protection supervisory authority, in particular the one of the country where you live or work, or in Albania, where we are established, the Information and Data Protection Commissioner (IDP, idp.al).

6. Data we process for our customers

When a store or website uses Bitlane, we process on its behalf:

  • the documents it indexes (products, pages and other content);
  • its visitors' searches (the query, the filters and the results returned, with the engine and time);
  • with the widget's analytics on: a random session id kept in the visitor's browser until 30 minutes of inactivity, visits, the pages of results seen, clicks on results, and through the integrations additions to the cart, orders and refunds (order number, products, amounts, the session id and the kind of device), never the buyer's name, email or address.

These analytics hold no IP addresses, names or contact details of visitors. Our servers' request logs do record each request's IP address, browser and address (which can include the search), for security and troubleshooting, and keep them for 30 days. Raw searches and clicks are kept for 90 days, orders and refunds for 2 years, the products seen in each session for 1 year, and reports aggregated by day for up to 2 years.

The widget can also pass its events (searches, clicks, additions to the cart, purchases) to the store's own tags on the page, such as Google Tag Manager or the Meta Pixel. What those tools do with them is up to the store and those providers, not us. The store decides whether the widget's analytics run: it can keep them off until its visitor consents, and the widget follows the visitor's choice where the store uses Google Consent Mode. This processing is governed by our Data Processing Agreement.

7. Security

We protect personal data with encryption in transit and at rest, access limited to the people who need it, two-factor authentication, and hosting in Google Cloud's European data centres. No system is perfectly secure: if a breach affects your data, we will inform you and the authorities as the law requires.

8. Cookies

How we use cookies is explained in the Cookie Policy.

9. Children

The Service is meant for businesses and is not directed at children under 16.

10. Changes

We may update this Privacy Policy. The date at the top shows the current version; we let customers know of important changes by email.