kwery uses Hetzner for application servers, PostgreSQL, and data pipelines hosted in Germany. Cloudflare provides DNS, content delivery, and web application security, while additional listed providers support authentication and transactional email. The current sub-processor list identifies each provider and its purpose. View Sub-processors.
Personal data is encrypted in transit using TLS 1.2 or later and protected at rest. Webhook payloads are signed with HMAC-SHA256 so your endpoint can verify their origin and integrity. Access to production systems and customer data is restricted according to role and operational need. View DPA.
kwery is built to collect and structure marketplace product, offer, seller, price, availability, and related commercial signals. It is not designed to track individual shoppers or collect their browsing behavior. Account, billing, and support data supplied by kwery customers is handled as described in the Privacy Policy and DPA. Privacy Policy.
kwery provides three layers of defensibility: audit trails (every observation includes timestamp and source attribution), confidence scores (document which results you filtered and why), and signed change events (your repricing reacts to actual market movement, not noise). Together this gives compliance teams a clear record of how each pricing decision was reached using market data, not personal consumer data. Compliance & Provenance.
Yes. kwery publishes a pre-signed Data Processing Addendum (GDPR Art. 28) that is incorporated by reference into our Terms when you accept them. No countersignature is required for self-serve customers. View DPA.
Our sub-processor list is public and kept up to date. Today it includes Supabase (auth and identity), Hetzner (application servers, PostgreSQL, and data pipelines, hosted in Germany), Cloudflare (DNS, CDN, WAF), and Resend (transactional email). View Sub-processors.
Operational pricing data and event history are retained for the active term of your subscription and a short window thereafter for audit and replay. Account data follows the retention rules in the Privacy Policy. Privacy Policy.
Yes. kwery is intended for legitimate market intelligence and pricing use cases. You are responsible for keeping your API keys confidential, complying with applicable law, and not using the data to harm consumers or violate marketplace terms. Terms of Service.
Email security@kwery.co with a clear description, affected endpoint or feature, reproduction steps, and the potential impact. Do not include customer data or exploit the issue beyond what is needed to demonstrate it. Please allow us time to investigate and address the report before public disclosure.
Request API access and the team will walk through sources, volumes, and integration in detail.