1. The controller
This policy describes how STEMDARK S.R.L., with its registered office at Str. Sg. Constantin Moise nr. 5D, bl. 2, sc. 2, ap. B5, sector 6, 061421 București, Trade Register no. J2023023617404, tax code RO49256843 (the “Controller”), processes the personal data of persons who use the Adeveri service and the adeveri.com website (the “Service”), in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Law no. 190/2018.
The Controller can be contacted about any matter concerning your data at [email protected].
2. Data processed, purposes and legal bases
| Categories of data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Account data: email address, password (solely as a hash), two-step sign-in configuration, sign-in methods (the identifier and email address received from Google or Facebook), dates of creation and last sign-in | Creating and managing the account, authentication | Performance of a contract (GDPR art. 6(1)(b)) | For the life of the account; erased within 30 days of account closure and within 35 days from backups |
| Connected applications: the application (such as Claude or ChatGPT), dates of connection and last use, authorisation data | Giving the application access to the Service on the user’s behalf and disconnecting it | Performance of a contract | Until the application is disconnected or the account closed |
| Connections without an account: a random identifier assigned to the connection | Operation and security of the Service | Legitimate interest (GDPR art. 6(1)(f)) | 90 days from last use |
| Queries: the content sent by the assistant to the Service (search terms, articles requested), the application and the user identifier it sends. The structure of each query is kept; the full text is kept only for queries that returned no result | Providing the answer, detecting errors, improving search | Performance of a contract; legitimate interest in improving the Service | Server logs: 30 days. Telemetry: 60 days. Errors: 30 days |
| Court file search: the name of the party indicated by the assistant, sent to the provider that queries the courts’ portal | Identifying the files requested, from public sources | Legitimate interest (access to public information about justice) | As in the previous row |
| Technical data: IP address, browser or client type, time of the request | Security of the Service and error diagnosis | Legitimate interest | 30 days |
| Correspondence: messages sent by email or through the application’s feedback function | Handling requests | Legitimate interest | Until resolved, then at most 12 months |
| Billing data, should paid plans become available, through the merchant of record | Meeting accounting obligations | Legal obligation (GDPR art. 6(1)(c)), Law no. 82/1991, art. 25 | 5 years from 1 July of the year following the end of the financial year |
The content of queries is determined by the assistant you use. If you give it personal data, yours or another person’s, it may include that data in a query. We recommend that you do not provide such data where it is not necessary.
3. Sale of data and automated decisions
The Controller does not sell users’ personal data.
The Controller does not take decisions about users based solely on automated processing that produce legal effects or similarly affect them, within the meaning of GDPR art. 22.
4. Cookies and storage on your device
The website uses no cookies or other technologies that store or access information on your device. Consequently, the consent provided for by Law no. 506/2004, art. 4(5) is not required.
If you choose to sign in with Google or Facebook, you will be redirected to their pages, which apply their own rules on cookies.
5. Recipients of data
The Controller uses the following processors, which process data solely on its instructions:
| Processor | Activity | Location |
|---|---|---|
| S.C. Pidgin Host S.R.L. | Hosting the Service | Romania |
| Cloudflare, Inc. | Content delivery and attack protection, through which traffic passes | Global, including the US |
| Functional Software, Inc. (Sentry) | Error reporting and availability monitoring | EU (Germany) |
| Hound Technology, Inc. (Honeycomb) | Telemetry, solely to ensure the Service works, not to track users | US |
| Sendinblue SAS (Brevo) | Sending confirmation and password reset messages | EU (France) |
| Scaleway SAS | Storing encrypted backups | EU (France) |
| DosarJust.ro | Searching court files | Romania |
Anthropic (Claude), OpenAI (ChatGPT), Google and Meta are independent controllers of the data they process within their own services, under their own policies. From Google and Meta, the Controller receives only an identifier and an email address.
6. Transfers outside the European Economic Area
Cloudflare and Honeycomb may process data in the United States of America. These transfers rely on the EU–US Data Privacy Framework, under which both companies are certified. You may request further information about these safeguards at [email protected].
7. Rights of data subjects
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object at any time to processing based on legitimate interest, including where your name appears in court file searches.
Requests must be sent to [email protected], not through the application’s feedback function: feedback messages are anonymous, so they cannot be attributed to you or receive a reply. The Controller responds within one month at the latest.
You have the right to lodge a complaint with Romania’s National Supervisory Authority for Personal Data Processing (dataprotection.ro), B-dul G-ral. Gheorghe Magheru 28–30, sector 1, Bucharest, or with the supervisory authority where you live or work.
8. Security of data
The Controller applies technical and organisational measures appropriate to the level of risk, in accordance with GDPR art. 32.
9. Minors
Accounts may be created by persons aged 16 or over. If you learn that a younger person has created an account, please inform us so that it can be erased.
10. Changes to this policy
Significant changes are announced on the website and, to account holders, by email, at least 30 days before they take effect.
