Privacy Policy

1. Who is the controller of your data

The controller is Special Software Development SRL, tax ID 39594308, registered with the Trade Register under no. J40/9725/2018, with its registered office at Aleea Slt. Adrian Cârstea nr. 70, bl. 35, sc. 1, et. 8, ap. 34, Sector 3, București, România. Postal address: Aleea Adrian Cârstea nr. 70, București, România.

For any question or request about personal data, write to [email protected]. The controller has not appointed a data protection officer (DPO) at this time; requests are handled at the same address.

2. What data we process

We process only the data we need for the purposes below:

• account data: name, email address, phone, company, address, password (stored only as a hash) and account settings;
• billing and payment data: invoicing details, subscription and payment history. Card details are entered directly with the payment processor and are not stored by us;
• usage and technical data: IP address, browser and device type, pages visited, date and time of access, authentication and security records;
• communications: messages sent through the contact form, chat, support tickets and conversations with the virtual assistant;
• marketing data: newsletter subscription, communication preferences, referral source (affiliate programme) and consents given;
• data from public sources about companies and their contact persons, used for B2B prospecting (see section 9).

3. Why we process data and on what legal basis

• providing the Service, creating and managing your account, technical support — performance of a contract (Art. 6(1)(b) GDPR);
• invoicing, accounting, tax obligations and replies to authorities — legal obligation (Art. 6(1)(c));
• security of the Service, fraud and abuse prevention, access logs — legitimate interest (Art. 6(1)(f));
• newsletter, commercial communications to individuals, cookies and analytics and advertising technologies — consent (Art. 6(1)(a)), which you can withdraw at any time;
• commercial communications to companies and B2B prospecting, product improvement — legitimate interest (Art. 6(1)(f)), subject to your right to object;
• defence of legal claims — legitimate interest.

4. Cookies and similar technologies

We use strictly necessary cookies (language, market, session, plan chosen at checkout), which do not require consent. Preference, analytics and marketing cookies are enabled only after you give consent in the cookie banner. You can change or withdraw your choice at any time from the "Cookie settings" link in the page footer. The full list, with names, purpose and duration, is in the Cookie Policy.

5. Who we share data with (recipients)

Data is accessed only by staff who need it and by providers who process it on our behalf under contract (processors). Categories of providers:

• hosting and infrastructure: Hetzner (European Union); delivery network and protection: Cloudflare;
• payment processing: Stripe, Netopia;
• transactional email, SMS and notifications: email and SMS providers;
• analytics and advertising (only with your consent): Google, Meta, OpenAI;
• artificial-intelligence features: model providers (for example Anthropic, OpenAI) — see section 11;
• online meetings in the appointments application: Daily.co or Jitsi;
• public authorities, where required by law (for example the tax authority for electronic invoicing).
• We can send you the up-to-date list of providers and their role on request at [email protected].

6. Transfers outside the European Economic Area

Some providers (for example Cloudflare, Stripe, Google, Meta, OpenAI, Anthropic) may process data outside the EEA, in particular in the United States. We transfer data only on the basis of safeguards provided by the GDPR: an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or the European Commission's standard contractual clauses. You can request a copy of the applicable safeguards at [email protected].

7. How long we keep data

We keep data only as long as necessary for the purpose it was collected for:

• account data: while the account is active and up to 30 days after deletion or termination of the subscription;
• invoices and accounting records: 10 years, as required by accounting law;
• access and security logs (including IP addresses): up to 90 days; authentication records: up to 12 months;
• virtual assistant and chat conversations: up to 6 months;
• contact messages and support tickets: up to 24 months after closure;
• newsletter and consents: until consent is withdrawn, and proof of consent for the limitation period;
• B2B prospecting data: up to 12 months without a reply, or until you object;
• encrypted backup copies are overwritten within at most 12 months.

8. Your rights

Under the GDPR you have the right to: access your data; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing based on legitimate interest and to direct marketing; withdraw consent without affecting the lawfulness of earlier processing; and not be subject to a decision based solely on automated processing. Send your request to [email protected]; we reply within one month (extendable by up to two further months for complex requests, with notice to you). You can edit profile data and consents from your account panel. We may ask for proof of identity to protect your data.

9. B2B prospecting and data from public sources

To contact companies that may be interested in our services, we use data from public sources about companies and their contact persons (for example the trade register, the tax authority, public listings, online maps): company name, tax ID, address, administrators, professional contact details. The basis is our legitimate interest; we have assessed it in writing (balancing test) and we do not contact people who have objected.

If you receive a message from us this way, the first message tells you who we are, which source we obtained your data from and how you can ask us to delete it or object. You can object at any time at [email protected] or through the link in the message; we add your address to a suppression list that we respect.

10. Data our customers enter into the applications

When you use an ecosystem product for your own business (for example CRM, HR, invoicing, appointments, clinics, practices), the data of the people you enter into the application (your customers, employees, patients, students) is processed by you as controller. We act as a processor, only on your instructions and under a data processing agreement (Art. 28 GDPR). If you are a person whose data was entered by one of our customers, please contact that customer first.

11. Artificial-intelligence features

Some features (for example the virtual assistant, suggestions or summaries) send your text to artificial-intelligence model providers, who process the data only to return the result to us. Where the provider's contract or settings allow it, we do not permit the provider to use your content to train models, and we do not take decisions with legal effect on you by solely automated means. Do not enter into these features data that is not needed, in particular sensitive data.

12. Data security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), password hashing, role-based access control, access logs, encryption of sensitive fields where relevant, encrypted backups and separation of environments. If a personal data breach affecting you occurs, we notify the authority and, where the law requires, you, within the legal deadlines.

13. Minors

The Service is intended for people with full legal capacity and is not directed at children under 16. Data of students or children in education applications is entered by the school or parent as controller.

14. Changes to this policy

When the policy changes materially, we update the effective date and, if the change significantly affects you, we notify you by email or in the Service.

15. Contact and complaints

For questions or requests: [email protected] or by post to Aleea Adrian Cârstea nr. 70, București, România. You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro, or with the authority in your EU country of residence.