Last updated: August 29, 2026
Privacy policy
1. Controller
The controller is HAGIU ANCA-GABRIELA PERSOANĂ FIZICĂ AUTORIZATĂ, a Persoană Fizică Autorizată (PFA), registered at B-dul Bucureștii Noi, 136, Ground Floor, Apt. 5, Sector 1, Bucharest, Romania, Romania; Romanian Trade Registry number F2025016524007; CUI 51776490; intra-Community VAT number RO51877613. Contact: ancagabrielauiux@gmail.com.
2. Information we process
- Public participant name, slug, website, optional logo URL, approved message, confirmed amount and public placement history.
- Private contact email, accepted legal-document versions and acceptance time.
- Dodo checkout-session, payment, refund and dispute identifiers and statuses. We do not receive or store full card details.
- An opaque first-party visitor identifier stored in an HTTP-only cookie; one-way keyed hashes derived from IP address and user agent for rate limiting and click deduplication; referrer, page path, click and recent-activity times.
- Moderation decisions and one-way content hashes, reports, admin audit actions, webhook-processing records, security logs and correspondence.
3. Why we process it
We process information to provide checkout and paid placement, maintain public history and handle service requests; secure and moderate the service; prevent fraud and duplicate counting; measure first-party product use; comply with accounting, consumer, platform and lawful-request obligations; and establish, exercise or defend legal claims. The applicable legal basis may include performance of a contract, legitimate interests, legal obligations and consent where expressly requested.
4. Public content
Approved participant identity, message, confirmed amount and history are intentionally public and may be indexed, shared, cached or archived by third parties. Private email, provider identifiers, visitor identifiers, hashes, reports and internal moderation information are not exposed through public views.
5. Service providers and transfers
V1 uses Dodo Payments for payment processing, Supabase for managed database and admin authentication, and Vercel for application hosting and delivery. No Google Analytics, advertising platform or third-party semantic moderation provider is currently used. These providers process information under their own terms and applicable data-processing arrangements, which may include international-transfer safeguards.
6. Cookies and first-party analytics
The service sets an HTTP-only, SameSite=Lax first-party visitor cookie, marked Secure in production, for unique and recent-online counts, security and click deduplication. “Online” means activity within approximately five minutes. A page-view event is recorded once when a page loads; later heartbeats update recent presence without creating extra page views. First-party analytics do not include contact email, raw message text or full payment payloads. No advertising cookies are used.
7. IP addresses and user agents
The application reads network and browser headers transiently to secure requests, apply rate limits and deduplicate outbound clicks. Application tables store keyed one-way hashes rather than raw IP addresses or raw user-agent strings. Hosting and infrastructure providers may maintain their own operational logs under their policies.
8. Retention
Approved public history may remain while the service operates. Removed content is replaced publicly with a neutral notice while payment and audit chronology may be retained where necessary. Payment, accounting and legal records are retained for applicable statutory periods. Security, visitor, analytics, report and moderation records are retained only for as long as reasonably necessary for their stated purposes, dispute handling and legal obligations.
9. Security
Controls include restricted access, transport encryption, server-side validation, verified payment webhooks, one-way keyed hashing, audit records, rate limits and deny-by-default database access. No online service can guarantee absolute security.
10. Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction, objection or portability where relevant, and withdraw consent where processing relies on consent. Some records may need to be retained for legal, accounting, fraud-prevention or security purposes. Contact ancagabrielauiux@gmail.com. You may complain to the Romanian National Supervisory Authority for Personal Data Processing or another competent supervisory authority.
11. Adults and changes
The service is for adults aged 18 or older and is not directed to children. Material policy changes will receive a new date and version. Privacy version: 2026-08-29.