Last updated: draft
Gromatik (the controller). The controller's and Data Protection Officer's (DPO) contact details will be completed before launch.
Account data (name, email, role), organization data (name, Company / VAT no., address), the project and estimate data you create (including client information, addresses, uploaded plans), and minimal technical usage data.
Contractual necessity for core features; legitimate interest for product analytics (analytics cookies only with consent); explicit consent for marketing communications.
Supabase (database and authentication, EU hosting), Vercel (app hosting and file storage, EU region), the AI model provider via Vercel AI Gateway (document processing and estimate generation), Resend (transactional email delivery). Data Processing Agreements (DPAs) are in place with each.
Data is hosted in the European Union (Supabase eu-central-1; Vercel functions pinned to the EU region). We do not transfer data outside the EU/EEA without adequate safeguards.
You have the right to access, rectification, erasure, portability, restriction, and objection. Exercise these rights from the Account & privacy page (export and deletion request) or by contacting the controller.
We keep estimate data while the account is active. Financial and estimate data are archived (not hard-deleted) for compliance. Backups are retained for 30 days.
You can lodge a complaint with the Romanian Data Protection Authority (ANSPDCP).