Privacy Policy

Last updated: October 23, 2026

This Privacy Policy describes how TIMIS RAZVAN VASILE PERSOANA FIZICA AUTORIZATA, CUI 53126043, trade register no. F2025051481008, with registered office at Strada Dionisie Roman, Nr. 3, Bl. A.1.1, Sc. 1, Et. 3, Ap. 26, Cluj-Napoca, Cluj County, Romania ("Provider", "we") collects, uses and protects your personal data when you use the Contami platform ("Service").

1. Data Controller

The data controller is:

TIMIS RAZVAN VASILE PERSOANA FIZICA AUTORIZATA
CUI: 53126043
Trade register no.: F2025051481008
Registered office: Strada Dionisie Roman, Nr. 3, Bl. A.1.1, Sc. 1, Et. 3, Ap. 26, Cluj-Napoca, Cluj County, Romania
Email: [email protected]

2. Data We Collect

2.1. Data provided directly by you

• Identification data: email address, name (if provided via Google/GitHub login)
• PFA data: CUI, PFA name, registered address, CAEN code, bank account (IBAN)
• Financial data: issued invoices (including client data), expenses, bank transactions, bank statements
• e-Factura data: data transmitted to/from ANAF through the SPV system
• Support messages: the content of messages sent to our WhatsApp support number, to the support address [email protected] (or to any other @contami.ro address, including a reply to an automated email — it reaches the same support mailbox) or through the live chat on the site, the email address or phone number they are sent from, files attached to a support email, and our replies
• Phone number: if you choose to log in with WhatsApp, the number we send the login code to, which stays linked to the account until you disconnect it in settings or ask us to remove it ([email protected])

2.2. Data collected automatically

• Technical data: IP address, browser type, date and time of access
• Authentication data: authentication sessions, authentication method used
• Browser error monitoring: on every page, a script served from our own server (Grafana Faro) sends to our own infrastructure the JavaScript errors and console error messages, failed requests, request and page-load timings (Web Vitals), the browser and operating system type and version, the page the event happened on and a random session identifier. The identifier is kept in the tab's sessionStorage and disappears when you close the tab. Page addresses are cut down on the server before storage (no parameters, so no login or invitation links), and the events carry no user identifier, email or name. The data does not reach third parties.
• Consent data: PFA account that accepted, email of the person who accepted, date of Terms accepted, IP address and date of acceptance
• Usage measurement: cookieless and server-side, in two parts. (1) Public pages: for each visit we log the page, the referrer and campaign parameters and a visitor hash, a truncated keyed hash of the IP address and browser string computed with a salt that changes daily, so a visitor cannot be recognised from one day to the next. A click on the sign-up button is logged with the same hash. The IP address and browser string themselves are not stored. (2) Account milestones: when you create an account, we log that event with your user identifier and the visitor hash of that same request, which links that day's anonymous page views to your account once. Later milestones (completing onboarding, issuing your first invoice, first e-invoice submission to ANAF) are logged with your user and company (tenant) identifiers and no visitor hash. These events carry no email, name, tax identification number or amount. No cookie or local storage is set for this, no session is recorded, and the log lines are kept with the application logs in the EU.

2.3. Cookies

We use only strictly necessary functional cookies for authentication, account preferences and CSRF protection. These cookies do not require consent pursuant to art. 4(5) of Law 506/2004, as they are essential for providing the Service requested by the User. We do not use third-party tracking or advertising cookies. Usage analytics are collected without cookies (see Section 2.2). Browser error monitoring sets no cookie: it only keeps a random session identifier in the tab's sessionStorage, deleted when the tab closes, used solely to group the errors of one visit (see Section 2.2).

2.4. Data we do NOT collect

• We do not collect biometric data
• We do not collect location data

3. Purposes and Legal Bases for Processing

4. Data Sharing

4.1. Sub-processors

We use the following sub-processors to provide the Service:

**Google Drive: optional integration, activated exclusively by the User. Data is transmitted only if the User configures Google Drive synchronization.

*USA transfers: protected by Standard Contractual Clauses (SCC) per art. 46 GDPR. Per the AI provider's terms, data transmitted via API is not used for training models.

4.2. We do not sell data

We do not sell, rent or share your personal data with third parties for marketing or advertising purposes.

4.3. Legal disclosure

We may disclose data if required by law or court order.

5. International Data Transfers

5.1. Data is primarily stored and processed in the European Union (Germany — Hetzner; Frankfurt — AWS).

5.2. For artificial intelligence features, required data is transmitted to third-party AI service providers (EU/USA), directly or through an intermediary platform. For Google Drive synchronization (optional integration), documents are transmitted to Google LLC (USA). Technical reports created from support conversations are transmitted to GitHub Inc. (USA) only after personal data has been removed. WhatsApp login codes are sent through Meta Platforms Ireland Ltd (Ireland, EU); any onward transfer outside the EU that Meta makes under its own terms rests on the same clauses. These transfers are protected by Standard Contractual Clauses (SCC) per art. 46 GDPR.

5.3. We do not transfer data to countries that do not provide an adequate level of protection without appropriate safeguards.

6. Data Retention

Upon account closure, the User has 30 days to export their data. Export is available in CSV format (for tabular data: invoices, expenses, journal register, clients) and PDF format (for individual invoices and journal register). After the 30-day period expires, all data will be permanently deleted, with two exceptions: consent data (retained 5 years after closure as legal proof per GDPR art. 7.1) and support conversations, which are not linked to the PFA account and are deleted on request. The User is responsible for exporting and archiving their data in accordance with legal obligations before the 30-day period expires.

7. Your Rights

Under GDPR, you have the following rights:

• Right of access (art. 15) — you may request a copy of your data
• Right to rectification (art. 16) — you may correct inaccurate data
• Right to erasure (art. 17) — you may request deletion of your data (except data required by legal obligations)
• Right to restriction of processing (art. 18)
• Right to data portability (art. 20) — you may export your data in a structured format
• Right to object (art. 21) — you may object to processing based on legitimate interest

How to exercise your rights

Send a request to [email protected]. We will respond within 30 days.

Data deletion

You can delete your data in any of the following ways:

• Self-service (recommended) — in the app, Settings → Close account. The account enters a 30-day grace period during which you can export your data (CSV/PDF); after the period expires, all data is permanently deleted, except consent data retained as legal proof and support conversations, which are not linked to the account (see Section 6).
• On request — email [email protected] from the address associated with your account; we process deletion requests within 30 days.
• Support conversations (WhatsApp, email, live chat) — we delete a support conversation at your request, within 30 days. Conversations have no automatic deletion period (see Section 6).

Right to lodge a complaint

If you believe that data processing violates GDPR, you have the right to file a complaint with:

National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, Romania
Website: www.dataprotection.ro

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Secure connection for all communications
• Secure storage with restricted access
• Passwordless authentication (email link or Google/GitHub login)
• Role-based access control
• Automatic backups
• Access monitoring and logging

In case of a personal data security breach, the Provider will notify the competent supervisory authority (ANSPDCP) within 72 hours of becoming aware, in accordance with art. 33 GDPR. If the breach poses a high risk to the rights of data subjects, the Provider will also notify affected Users without undue delay, in accordance with art. 34 GDPR.

9. Automated Processing and Automated Decisions

9.1. The Service uses AI features (automated data extraction from documents, suggestions, classifications, drafting of replies in support conversations) delivered by third-party AI service providers. These are selected on the basis of contractual commitments that expressly provide that transmitted data is not used to train or improve AI models. Where the provider offers that option, calls are configured so that data is not stored after processing.

9.2. The Service does not make automated decisions with legal or significant effects on the User, within the meaning of art. 22 GDPR. Document processing results are presented as suggestions, and the final decision always belongs to the User. Replies in support conversations are informational and do not perform operations on the User's behalf.

10. Minors

The Service is not intended for persons under 18 years of age. We do not intentionally collect data from minors.

11. Policy Changes

11.1. We reserve the right to modify this Privacy Policy.

11.2. Changes that narrow your rights or extend the processing (new purposes, new data categories, new recipients) will be notified at least 30 days before taking effect. All other changes (clarifications, adaptations to legal requirements, updates to the Controller's or sub-processors' details) take effect on publication.

11.3. The current version will always be available at https://contami.ro/privacy.

11.4. If the operation of the Service is taken over by a successor legal entity (see Section 20.4 of the Terms and Conditions), that entity becomes the new Controller of the data, under the same conditions and for the same purposes. You will be notified at least 30 days in advance and this Policy will be updated with the new Controller's details.

12. Contact

For any questions or requests regarding your personal data:

---

Email: [email protected] — We respond within 5 business days.

Controller: TIMIS RAZVAN VASILE PERSOANA FIZICA AUTORIZATA, CUI 53126043, trade register no. F2025051481008, Strada Dionisie Roman, Nr. 3, Bl. A.1.1, Sc. 1, Et. 3, Ap. 26, Cluj-Napoca, Cluj County, Romania