Privacy policy

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

a. Account and Authentication Data Security

What we collect:

• Email address
• Login metadata (e.g., timestamp, method)
• Authentication info (Google OAuth or Magic Link)
• A pseudonymous internal user ID

Why we collect it:

To create and manage your account, authenticate access securely, and prevent unauthorized use of the platform.

b. Billing and Subscription Data Billing

What we collect:

• Name (for invoicing, if provided)
• Billing address and country
• VAT number (if applicable)
• Payment metadata (via Stripe or Paddle)

Why we collect it:

To process payments, issue legally compliant invoices, meet tax obligations, and provide customer support for billing.

c. Technical and Security Data Monitoring

What we collect:

• IP address
• Browser type and version
• Device and OS
• Login attempts and access timestamps
• CAPTCHA/bot check signals

Why we collect it:

To detect fraud, secure user accounts, optimize service performance, and protect against denial-of-service attacks or unauthorized access.

d. Operational Logs and Usage Metrics Analytics

What we collect:

• Feature usage (e.g., dashboard interactions)
• Timestamped system events
• Error and exception logs

Why we collect it:

To monitor platform health, debug technical issues, and improve overall system reliability without tracking user behavior across services.

e. Support and Communication Data Support

What we collect:

• Your email address and name (if provided)
• Message content and attachments

Why we collect it:

To respond to your inquiries, troubleshoot issues, and provide support or legal documentation (e.g., invoices, data requests).

a. Account and Authentication Data

Lawful basis:

• Contractual necessity – to create and manage your account, authenticate your access, and deliver the services you request
• Legitimate interest – to protect the security of the platform, detect fraud, and prevent unauthorized access

b. Billing and Subscription Data

Lawful basis:

• Contractual necessity – to process your subscription and deliver paid features of the Service
• Legal obligation – to comply with tax, accounting, invoicing, and financial reporting laws in the EU and Romania

c. Technical and Security Data

Lawful basis:

• Legitimate interest – to ensure the performance, stability, and security of the platform, including protection against fraud, abuse, and malicious activity

d. Operational Logs and Usage Metrics

Lawful basis:

• Legitimate interest – to monitor system health, debug technical issues, and improve the Service. This data is limited in scope, anonymized or pseudonymized where appropriate, and is never used for profiling, behavioral tracking, or advertising.

e. Support and Communication Data

Lawful basis:

• Contractual necessity – when your inquiry relates to your use of the Service
• Legitimate interest – to respond to general questions, collect feedback, and improve customer service

f. Optional Cookies and Analytics

Lawful basis:

• Consent – where required by law, we will obtain your explicit consent before placing non-essential cookies or using analytics tools. You can withdraw this consent at any time through your cookie settings or browser preferences.

a. Trusted Service Providers (Processors)Processors

We engage carefully selected third-party service providers to help us deliver, secure, and maintain the platform. These subprocessors may process limited categories of personal data strictly on our behalf.

Examples include:

• Authentication and login providers (e.g., Google OAuth)
• Payment processors (e.g., Stripe, Paddle)
• Security and fraud prevention tools (e.g., Cloudflare)

All subprocessors are subject to written data processing agreements that require them to implement appropriate technical and organizational security measures under Article 32 of the GDPR.

b. Internal Access and ConfidentialityAccess Control

Access to your personal data is strictly limited to authorized personnel and contractors who require access to fulfill their job responsibilities. All such access is governed by confidentiality agreements and role-based access controls consistent with GDPR Article 32 and industry best practices.

c. Legal Obligations and Government RequestsLegal Compliance

We may disclose personal data when required to do so under applicable law, such as to comply with a valid subpoena, court order, or government investigation under Article 6(1)(c) of the GDPR.

We carefully review each request to verify its legal basis, necessity, and proportionality. If permitted, we will notify you of such disclosures.

d. Corporate TransactionsBusiness Continuity

In the event of a merger, acquisition, financing, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will ensure confidentiality protections are maintained and notify you in advance of any material changes to the way your data is processed.

e. With Your ConsentUser Control

We may share your personal data with third parties for other purposes only with your explicit, informed consent—for example, when you voluntarily enable third-party integrations. You may withdraw this consent at any time.

a. Transfers to Third CountriesGDPR Articles 46–49

Where personal data is transferred outside the EEA, we implement appropriate legal safeguards as required by GDPR Articles 46–49, including:

• Standard Contractual Clauses (SCCs) issued by the European Commission
• Supplemental technical and organizational safeguards, such as end-to-end encryption, pseudonymization, and strict access controls
• Vendor due diligence and contractual restrictions to ensure GDPR-level protection

We regularly assess these safeguards to ensure their effectiveness and adequacy, especially for any transfers to countries subject to conflicting laws (e.g., surveillance regimes).

b. U.S. Service Providers and the Data Privacy FrameworkEU–U.S. DPF

Some of our infrastructure, payment, or authentication providers may be located in or subject to U.S. jurisdiction. In such cases, we:

• Ensure your personal data is hosted in EU data centers where applicable
• Require the use of Standard Contractual Clauses as a legal basis for transfer
• Limit access to only what is necessary for secure operation
• Monitor eligibility for and participation in the EU–U.S. Data Privacy Framework (DPF), and may rely on this mechanism where applicable

c. Fallback Measures and Transfer SuspensionContinuity Measures

If any data transfer safeguard we rely on is invalidated or no longer provides adequate protection, we will:

• Implement an alternative lawful transfer mechanism where available, or
• Suspend the transfer until such safeguards are re-established

This ensures your personal data is never transferred internationally without a lawful basis under the GDPR.

d. Your Rights Regarding TransfersAccess Rights

You have the right to request more information about our cross-border transfer safeguards, including a copy of the Standard Contractual Clauses we rely on, by contacting us at privacy@turbobulls.com.

a. Retention Periods by Data CategoryGDPR Art. 5(1)(e)

*Inactive accounts may be scheduled for deletion after a 30-day notice is sent to the associated email address.

We may retain anonymized or aggregated data for analytics or service improvement, provided it can no longer be linked to an identifiable individual.

b. Account Deletion

You may delete your account at any time through your account settings or by contacting privacy@turbobulls.com. Upon verified deletion:

• Your personal data is promptly removed from active systems
• Associated identifiers are deleted or anonymized
• Billing records may be retained where legally required
• End-to-end encrypted user content becomes permanently inaccessible and is removed during scheduled secure cleanup

c. Right to Erasure (Article 17 GDPR)Your Rights

You have the right to request deletion of your personal data where:

• The data is no longer necessary for its original purpose
• You withdraw consent (where consent was the basis)
• You object to processing based on legitimate interest
• The data was unlawfully processed or collected
• Erasure is required to comply with a legal obligation

We respond to verified erasure requests within 30 days, unless retention is required by law.

d. Data Portability Before Deletion (Article 20 GDPR)Portability

Before deletion, you may request a copy of your account metadata, billing records, or other portable personal data in a structured, commonly used, machine-readable format, in accordance with Article 20 of the GDPR.

e. Backup and Archival Systems

Personal data may remain in encrypted backups for up to 30 days after deletion, solely for disaster recovery purposes. These backups are automatically deleted after expiration and are not used for any operational processing.

a. Right of Access Article 15

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with relevant information about how and why we process it.

b. Right to Rectification Article 16

You may request correction of inaccurate or incomplete personal data that we hold about you.

c. Right to Erasure (Right to be Forgotten) Article 17

You have the right to request the deletion of your personal data where there is no compelling reason for us to continue processing it, such as when:

• The data is no longer needed
• You withdraw consent (where consent was the legal basis)
• You object to processing and no overriding legitimate interest exists
• Processing was unlawful or must be erased to comply with legal obligations

d. Right to Restriction of Processing Article 18

You may request that we restrict the processing of your personal data in certain circumstances, such as while we verify a correction request or assess an objection.

e. Right to Data Portability Article 20

You have the right to request your personal data in a structured, commonly used, machine-readable format, and to have it transferred to another controller, where technically feasible and where processing is based on consent or contract.

f. Right to Object Article 21

You have the right to object to processing based on legitimate interest, including profiling. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds.

You also have the right to object to the use of your data for direct marketing, in which case it will be stopped immediately.

g. Right Not to Be Subject to Automated Decision-Making Article 22

You have the right not to be subject to a decision based solely on automated processing, including profiling, which significantly affects you. We do not use any such automated decision-making in our Service.

h. Right to Withdraw Consent Article 7

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.

i. Right to Lodge a Complaint Article 77

You have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)