Política de privacidad GP Connect.

This Privacy Policy describes how Gorilla Software Sp. z o.o. ("Gorilla Software", "we", "us", "our") collects, uses, stores, and protects data when you use the GP Connect Chrome Extension (the "Extension") and related Gorilla Panel Connect services. We are committed to transparency and complying with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Google Chrome Web Store Developer Program Policies.

The single purpose of the GP Connect extension is to enable website administrators and clients to report requested changes, defect fixes, and development tasks directly from their browser while viewing their website, receive instant automated estimates, and order development work from Gorilla Software. The extension operates only when explicitly invoked by the user.

GP Connect requests only the permissions required to provide its core functionality. This list corresponds exactly to the contents of manifest.json in this version of the Extension — we request no other permissions:

• storage: Saving draft task reports, local user settings and session state in your browser’s local storage.
• scripting: Injecting the visual element selector and annotation interface into the page you are reporting on, including tabs that were already open when the Extension was installed.
• tabs: Reading the URL and title of the active tab on which you create a report.
• notifications: Notifying you when a quote is ready or a ticket changes status.
• alarms: Periodically synchronising ticket statuses in the background without continuously consuming CPU.
• offscreen: Recording a voice note, or a tab recording with your voice, for a report. Chrome lets an extension use the microphone only from its own page, so the Extension opens a hidden page of its own for this. The microphone is used only while you record a voice note or a tab recording you started yourself, for at most 2 minutes; Chrome asks for your permission the first time.
• identity: Signing in with a Google account, only when you choose “Continue with Google”. Chrome opens a Google sign-in window, and the Extension receives from Gorilla Panel only a one-time sign-in code; it never sees your Google password.
• Host permissions (<all_urls>): The Extension is available on the websites you visit, because its purpose is to report changes on any client site and it cannot know in advance at which address a given site is located. It is not injected on the clickup.com, stripe.com, tpay.com or sslip.io domains. Apart from those exceptions we do not maintain a list of excluded domains — no data is collected until you open the Extension yourself and submit a report.

Optional permission:

• tabCapture: Recording a short video of the current browser tab to show a problem. It is not granted at installation: the Extension asks for it only when you choose to record, and you can refuse or withdraw it in Chrome at any time. See section 4.

Both are optional, started only by you, and sent only together with a report you submit.

• Tab recording: started only from the Extension’s toolbar button. It captures only the tab it was started on and, if you allow the microphone, your voice while you record; the tab’s own sound is not recorded. It stops when you stop it or after 60 seconds at most.
• Voice note: recorded from your microphone only while you are recording it, for at most 2 minutes.
• Recordings and voice notes are stored in Gorilla Panel with the report they belong to, where the team handling it watches or listens to them. They are not sent to ClickUp, and they are kept as long as the rest of the report’s technical data (see the data retention section).

To enable developers to replicate and resolve reported issues, submitting a Ticket bundles the following technical context:

• A screenshot of the selected area.
• URL, screen resolution, viewport size, browser version, and operating system.
• DOM element snippet corresponding to the annotated page area.
• Count of JavaScript console errors (count only; no stack traces or private log content).
• User-provided task descriptions and annotations.
• If you record them: a video of the browser tab (with your voice, if you allow the microphone) and a voice note (see section 4).
• If you sign in with Google: Gorilla Panel receives from Google your e-mail address, whether Google has confirmed it, your name, your profile picture and your Google account identifier. We do not receive your Google password or any other data from your Google account.

Billing details. Before the first payment the Extension asks for the company's billing details: tax number (NIP), name, address and the e-mail address for invoices. After a valid NIP is entered, we fetch the company name and address from the REGON register of Statistics Poland (GUS); you can correct them or type them in yourself. We save them on the company's account in Gorilla Panel and use them to issue the invoice.

Payments. You enter card, BLIK or bank account details only on the payment operator's page (Tpay). Neither the Extension nor Gorilla Panel sees or stores them; we receive only the amount and the status of the payment.

Access to your site. If you give us access to your site's admin panel or server (for example a CMS, hosting or FTP login and password, or an account created for us), we store it in Gorilla Panel in encrypted form. Only the person on our team assigned to the request and our administrators can see it, and every time it is opened we record who opened it and when. Access data is never sent to ClickUp or in e-mails.

Price estimate and transcript. To prepare the price, we send the request's description, the page context and the screenshot of the selected element or a few frames from your tab recording to a language model provider (section 8), for that purpose only. The sound of a voice note or a tab recording is turned into text on our own server; while you record, the speech recognition built into Chrome (Google) writes it out too, so you see the text at once. The request carries the recording and that text.

In strict adherence to Google Chrome Web Store Developer Policies:

• No Sale of Data: We never sell, rent, monetize, or trade your personal data or extension data to third parties.
• No Unrelated Data Transfers: Data is transferred solely to process change requests and provide technical services ordered by you.
• No Advertising or Credit Assessment: Data is never used for personalized ads, behavioral tracking, retargeting, or credit assessment.
• No Passive Browsing Tracking: The Extension does not track, collect, or record your browsing history. Data capture occurs strictly upon manual submission.

We process personal data in accordance with Article 6(1) of the GDPR:

• Art. 6(1)(b) GDPR: Necessary for the performance of a contract or to take steps at the user's request prior to entering into a contract (estimating quotes, delivering technical fixes).
• Art. 6(1)(c) GDPR: Compliance with legal and tax obligations (invoicing, accounting retention).
• Art. 6(1)(f) GDPR: Legitimate interests of the controller (system security, abuse prevention, assertion of legal claims).

Data may be processed by trusted subcontractors bound by GDPR Data Processing Agreements:

• Hosting and server infrastructure providers within the European Economic Area (EEA).
• Authorized payment operators (Tpay / Krajowy Integrator Płatności S.A., Wise) for payment processing.
• Invoicing and accounting systems (e.g., Fakturownia.pl).
• Internal project task management (ClickUp) under strict confidentiality;
• language model providers (Anthropic, OpenRouter) — only the request's description, the page context and the screenshot or frames from a tab recording, to prepare the price estimate;
• Statistics Poland (GUS, REGON register) — only the tax number (NIP), to fetch the company name and address for the invoice.

Draft tickets in local browser storage remain until cleared by the user or submitted. Technical context attached to orders is retained for the duration of the service plus 3 years for warranty and dispute handling. Invoices and tax records are retained for 5 years following the relevant tax year. Account data is retained until account termination or verified deletion request.

All communication between the Extension and Gorilla Panel servers is encrypted with TLS 1.2/1.3. Access to customer code, screenshots, and server logs is restricted to authorized personnel under strict non-disclosure obligations. Regular vulnerability assessments and backups are maintained.

Under the GDPR, you have the right to request access to, rectification of, or erasure of your personal data, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with a supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

The data controller is Gorilla Software Sp. z o.o., ul. Jana i Jędrzeja Śniadeckich 20D/7, 35-006 Rzeszów, Poland, KRS 0000890717, REGON 388472110, NIP 8133856997.
Contact email: [email protected] | Phone: +48 789 022 921.