Privacy Policy

Version 2026-09-19. Explains which personal data we process, why, and your rights.

1. Controller and processor

The provider's identification details are not yet configured for this environment (deployment decision).

For account data (e-mail, sessions, preferences) we act as controller. For content uploaded by a Customer into its workspace (documents, staff CVs, references) we act as processor under the Data Processing Agreement.

2. Data processed

  • Account data: e-mail address, display name, language, time zone, session log and security events.
  • Workspace content: procurement documents, company evidence, staff data included in CVs and references, drafted texts.
  • Technical data: IP address (stored only as a hash), user agent, request identifiers for diagnostics.
  • Billing data: customer identifier at the payment processor, invoices; we store no card data.

3. Purposes and legal bases

Contract performance (providing the Service), legitimate interest (security, abuse prevention, product improvement from pseudonymised events), legal obligations (invoicing, fiscal records) and consent (marketing communications, analytics cookies).

4. AI-assisted processing

Certain stages (requirement extraction, drafting, briefs) use language models supplied by subprocessors with processing in the European Union where the provider offers it. Document text is treated as data, not instructions; results are verified against sources and marked as generated. We do not train models on Customer content.

5. Recipients

Subprocessors are listed publicly with processing region and transfer mechanism; changes are notified to workspace owners 30 days in advance. Public authorities receive data only under a legal obligation.

6. Retention

Account data is kept while the account is active and 30 days after deletion (anonymised security log). Workspace content is kept for the subscription term and 365 days after expiry with prior retention notice, then deleted, except under legal hold. Invoices are kept as required by tax law.

7. Your rights

Access, rectification, erasure, restriction, portability and objection, exercised directly from the account ("Privacy", "Data export", "Account deletion") or by e-mail to the Provider. We respond within 30 days. You may lodge a complaint with the Romanian supervisory authority (ANSPDCP).

8. Security

Per-customer data isolation at database level, encryption in transit and at rest, operator access only through limited, audited support sessions notified to the Customer, immutable audit log.

9. Changes

Versions of this policy are dated; material changes are notified by e-mail.

Version 2026-09-20 · Provider information (Romanian Law 365/2002): The provider's identification details are not yet configured for this environment (deployment decision).