Privacy policy

Version 2026-09

Controller

REVOMKT Agency, registration no. (CUI) 35399100, Rădăuți, Suceava county, Romania, e-mail [CONTACT E-MAIL]. Write to this address with any question about your personal data.

What we process, why and on what basis

• Account: name, e-mail address, company, country, password (cryptographic hash only), language, date and version of acceptance of the terms — to provide the service (Art. 6(1)(b) GDPR).
• Labels: the brands, model identifiers and periods you enter — to provide the service.
• Payments and invoicing: pack, amount, payment status, the billing details entered at checkout (name/company, address, tax/VAT ID, e-mail) and the invoice. Card details are entered directly at Stripe and never reach us — to perform the contract and meet tax obligations (Art. 6(1)(b) and (c)).
• Security: IP address, browser and a log of account actions (sign-ins, changes) — legitimate interest in protecting the service and accounts (Art. 6(1)(f)).
• Visit statistics: only if you accept analytics cookies (Google Analytics 4, IP anonymised) — consent (Art. 6(1)(a)); you can withdraw it at any time from “Cookie settings”.
• Proof of cookie consent: a random identifier, your choices, the policy version and a hash of the IP address — obligation to demonstrate consent (Art. 7(1)).

Who receives the data (processors)

• ROMARG SRL (Romania) — server and database hosting.
• Stripe Payments Europe Ltd. (Ireland) — card payment processing.
• Oblio Software SRL (Romania) — invoicing; invoices to Romanian companies are sent to the RO e-Factura system (ANAF).
• Google Ireland Ltd. — Google Analytics, only with your consent. Google may transfer data to the USA under the EU-US Data Privacy Framework.
• Our accountant and public authorities, when the law requires it.

We do not sell data and do not use personalised advertising.

Retention

• Account data and labels: while the account exists. Deleting the account permanently removes the company, users, brands and labels.
• Invoices and payment records: 10 years, as required by tax and accounting law.
• Security log and consent records: 12 months.
• Database backups: at most 14 days (then overwritten).

Your rights

You have the right of access, rectification, erasure, restriction, portability (data export under “My account”), objection, to withdraw consent and to lodge a complaint with a supervisory authority (in Romania: ANSPDCP, dataprotection.ro). We answer requests within one month.

Security

Encrypted connection (HTTPS), passwords stored with modern hashing algorithms, encrypted integration keys, sign-in rate limiting, strict separation of data between accounts, activity logging and daily backups.

Automated decisions

We do not take decisions based solely on automated processing that produce legal effects concerning you.