Privacy Policy

1. Who the controller is

The controller of the personal data collected through the Platform is CeVreau (“CeVreau”, “we”). You can contact us about anything relating to personal data at our support address.

This policy explains what data we collect, why, who we share it with and what rights you have. It complements the Terms & Conditions and the Cookie Policy.

2. What data we collect

We collect only the data needed to operate the Platform:

• account data: name, email address, profile photo (optional), phone number;
• authentication data: the password encrypted by our authentication provider, access logs;
• public profile data: bio, company, VAT number, city, published services, photos;
• content: messages, quote requests, reviews, attachments;
• technical data: IP address, device and browser type, pages visited;
• billing data: payment history and the last four digits of the card.

3. Purposes and legal bases

We process data for the following purposes, on the following legal bases:

• creating and administering the account, providing the Platform services — performance of a contract (art. 6(1)(b) GDPR);
• authentication, security, fraud and spam prevention — legitimate interest (art. 6(1)(f) GDPR);
• moderating content and reviews, including with automated tools — legitimate interest and legal obligations;
• billing, accounting and tax obligations — legal obligation (art. 6(1)(c) GDPR);
• account and message notifications — performance of a contract;
• marketing communications — consent (art. 6(1)(a) GDPR), revocable at any time;
• listing statistics (views and clicks) — consent (the Analytics category in the cookie settings);
• the history of recently viewed services shown in your account — performance of a contract (art. 6(1)(b) GDPR).

4. Cookies and similar technologies

We use cookies for session and preferences and, with your consent, for analytics and marketing. Full details, including the cookie list and their durations, are in the Cookie Policy.

You can change or withdraw your cookie choice at any time from the “Cookie settings” button available in the footer of every page.

5. Who we share data with

We do not sell personal data. We share it only with the providers that help us operate the Platform, acting as processors:

• Supabase — database and authentication;
• Vercel and the API hosting provider — application hosting;
• Google Gemini — automated moderation of text and images;
• Resend — transactional email delivery;
• payment providers — payment processing;
• identity-verification and SMS providers — where the service is used;
• public authorities — where the law requires it.

6. Transfers outside the EEA

Some providers are established outside the European Economic Area. Transfers rely on European Commission adequacy decisions or on standard contractual clauses, backed by additional technical safeguards.

7. How long we keep data

We keep data while the account is active and, afterwards, only as long as legal obligations require:

• account data — until the account is deleted;
• invoices and accounting documents — 10 years, as required by law;
• messages and reviews — until the account or the content is deleted;
• technical security logs — no more than 12 months;
• cookie consent records — 6 months, after which we ask you again.

8. Your rights

As a data subject you have the following rights:

We answer requests within 30 days of receipt, at our support address.

• access to your data and to information about the processing;
• rectification of inaccurate data;
• erasure (“the right to be forgotten”), subject to legal exceptions;
• restriction of processing;
• data portability, in a structured format;
• objection to processing based on legitimate interest;
• withdrawal of consent at any time, without affecting prior processing;
• lodging a complaint with the supervisory authority.

9. Deleting your account and data

You can request deletion from Settings → Privacy or by email at our support address, mentioning the account's email address. We delete the associated data within 30 days, except documents the law requires us to keep.

If you signed up with Google, you can also revoke access from your Google account under Security → Third-party apps.

10. Security

Data is transmitted encrypted (HTTPS) and stored in access-restricted databases. Access to production data is limited and logged.

No protection method is infallible. If a security breach affects your data, we notify you and inform the supervisory authority within 72 hours, as required by law.

11. Minors

The Platform is not addressed to persons under 16. If we learn that we collected a minor's data without the consent of their legal guardian, we delete it.

12. Complaints and updates

If you believe the processing infringes the GDPR, you can write to us first, at our support address. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

This policy may be updated. The version in force is the one published on this page, together with the last-updated date.