Privacy policy

The controller within the meaning of Regulation (EU) 2016/679 (“GDPR”) is:

• CĂTĂLIN NASTASĂ Persoană Fizică Autorizată
• Romanian tax identification number (CUI): 50387940
• Trade Register number: F2024005261406
• European Unique Identifier (EUID): ROONRC.F2024005261406
• Registered office: Str. C. C. Arion nr. 11, parter, ap. 1, Sector 1, București, România
• Email: contact@casapractic.ro

For any question about your data or to exercise your GDPR rights, you can write to us at contact@casapractic.ro.

Visitors without an account. For each page visited we record the page address, the device type and the operating system, with the date and time. These own statistics do not include the IP address and are not linked to an identity. The figures entered in the calculators are used only for the result shown and are not stored. If you accept cookies, Google Analytics collects pseudonymised usage data (details in the Cookie policy).

Approximate location (country). Our hosting provider determines the country from which you access the Site based on your IP address. We keep only the country code, in a cookie, to suggest the language version and to show prices converted into your currency; we do not store the IP address for this purpose.

User account. Your email address, the date the account was created and of the last sign-in, temporary sign-in links (valid for 15 minutes) and the language in which you prefer to receive account emails (set by the version of the Site from which you sign in).

Data you save in your account. Renovation projects (budget, stages, expenses, photos, journal), the people you choose to share a project with (their email address), documents in the digital archive, estimates and quotes uploaded for analysis, scanned receipts, 2D plans and My house in 3D projects, price alerts, the maintenance calendar and, for the Pro account, the quotes, customers and payments you enter.

Conversations with Cipică. The messages and images sent to the assistant are passed to the artificial intelligence provider to generate the reply. The conversation history stays only in your browser and we do not store it on the server; in your account we keep only the credit balance and history.

Payments. For subscriptions, paid services, credits and donations, the payment is processed by Stripe. We receive only the information needed to activate your service: email address, Stripe customer identifier, product purchased, amount and payment or subscription status. We do not see or store card details.

Invoicing. For every payment we issue a tax invoice, using the billing details entered on the Stripe checkout page: your name (or company name and tax ID, if you buy as a business), billing address and email. Details on the Invoicing page.

Newsletter. Your email address and the page from which you subscribed, based on consent. You can unsubscribe at any time from the link in every email.

Plan by email. If you ask for your renovation plan by email, we keep your address and the plan concerned, based on consent, to send you the plan, the shopping list (after 2 days) and tips for the next steps (after 7 days). You can unsubscribe from the link in every email.

Calculator result by email. If you ask for the result by email, we use the address only to send it, once. We do not keep it: for 7 days we retain only a cryptographic fingerprint (hash) of the address and of the IP address, to limit abuse (how many emails are sent daily to the same address).

Tradespeople sign-up. If you sign up on the “For tradespeople” page, we keep your name or company, email, phone, county and work area, trades, legal form, years of experience and your message, based on consent, to contact you about the tradespeople network. You can ask for their deletion at any time at contact@casapractic.ro.

Emails sent to us. If you write to us at contact@casapractic.ro, we keep the correspondence in order to reply.

• Providing the services (account, projects, archive, AI analyses, Cipică, subscriptions and payments) — performance of the contract with you (Art. 6(1)(b) GDPR).
• Transactional emails (sign-in link, confirmations, budget or price alerts you activated, project invitations) — performance of the contract.
• Newsletter, plan by email and tradespeople sign-up — your consent (Art. 6(1)(a)).
• Google Analytics and personalised advertising — your consent, given in the cookie banner.
• Own anonymous statistics, language and currency suggestion, security and abuse prevention (for example, limiting the number of requests) — our legitimate interest (Art. 6(1)(f)).
• Accounting and tax records of payments — legal obligation (Art. 6(1)(c)).

We do not sell or rent personal data. We do not take decisions with legal effects on you based solely on automated processing.

We use the following providers, as processors (or, where stated, as independent controllers), strictly to make the Site work:

• Vercel Inc. (USA) — hosting of the application, processing of requests and determining the approximate country of access.
• Neon — the database (account, projects, credits, newsletter, statistics) and password authentication (Neon Auth), hosted in the European Union (Frankfurt, Germany).
• Cloudflare R2 (Cloudflare Inc.) — storage of uploaded files (photos, estimates, receipts, archive documents).
• Anthropic PBC (USA) — the Claude artificial intelligence models used by Cipică and by the automatic analyses. Under its commercial terms, Anthropic does not use data sent through the API to train models.
• Stripe — payment processing, including currency conversion where you choose to pay in your local currency; for payment data, Stripe acts as an independent controller (stripe.com/legal/privacy-center).
• ContaDigital (Romania) — the invoicing software in which we issue invoices and which emails them to you. Invoices are reported to the Romanian tax authority (ANAF) through the national RO e-Factura system, as required by law (legal obligation, Art. 6(1)(c) GDPR).
• Brevo (France) and Resend (USA) — sending emails (sign-in links, notifications, newsletter).
• Google — Google Analytics and Google AdSense, only according to your choice in the cookie banner (policies.google.com/technologies/partner-sites), as well as hosting the correspondence received at the contact address.
• Forward Email — forwarding emails sent to the contact address.

When you click an affiliate link, you go to the website of the 2Performant network and then of the partner store, which process the data as independent controllers (details in the Affiliate policy). We do not pass on your email address or other account data.

Transfers outside the EU. Some providers (Vercel, Anthropic, Resend, Google, Stripe, Cloudflare) may process data in the USA. Transfers are based on the EU-US Data Privacy Framework (where the provider is certified) or on the standard contractual clauses approved by the European Commission.

• Account data and the data saved in it — for as long as you have the account. On a deletion request, we delete it within 30 days at the latest.
• Sign-in links — expire after 15 minutes.
• The session cookie — 30 days or until you sign out.
• The country cookie — 24 hours.
• Digital archive documents — while the subscription is active; after it ends we keep your documents for a reasonable period so you can download them, then delete them on request or when the account is closed.
• Newsletter — until you unsubscribe.
• Payment records and invoices — 10 years, as required by accounting law (kept by Stripe, in the ContaDigital invoicing software and in our database).
• Own traffic statistics — up to 24 months.

Under the GDPR you have the right to:

• access the data concerning you and obtain a copy;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing and to object to processing;
• data portability;
• withdraw your consent at any time (newsletter, cookies), without affecting the processing carried out before;
• lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro) or with the data protection authority of the EU country where you live or work.

You can exercise your rights by writing to us at contact@casapractic.ro from the email address of your account. We reply within one month at the latest.

The paid services and the account are intended for people over 18. We do not knowingly collect data about children.

Communication with the Site is encrypted (HTTPS). You sign in either without a password, through single-use links, or with email and password. Passwords are not stored in plain text: they are kept by the Neon Auth authentication service only in irreversibly encrypted form (hash), and the email address is confirmed with a code sent by email. Uploaded files are stored privately and are accessible only through temporary signed links. Access to the administration panel is protected and not public.

We may update this policy to reflect changes to the Site or to the law. The applicable version is the one published on this page, with the date of the last update shown above.