Privacy Policy

1. The data controller

Your personal data is processed by the controller identified below. The trading name used on the website ("NeuroAI Consulting") and the legal name of the company handling your data ("NeuroAI Advance S.R.L.") are one and the same entity — a single controller operating under two names.

• Legal name: NeuroAI Advance S.R.L.
• Trading name: NeuroAI Consulting
• Registered office: Str. Călugărului nr. 17, Sat Bălteni, Comuna Periș, jud. Ilfov, RO
• Tax ID (CUI): 54729441
• Trade Register number: J2026032931002
• Email: [email protected]
• Phone: +40 736 495 817
• Website: https://neuroai.ro

2. The dual role of NeuroAI Advance S.R.L. in processing

Depending on the service you use, NeuroAI Advance S.R.L. may act in two distinct capacities under the GDPR:

(a) Data Controller — for anonymous website visitors, people who submit the contact form or the AI Readiness Calculator, buyers of PDF guides and other digital products sold directly on the site, and for correspondence received by email. In these situations we alone determine the purposes and means of the processing.

(b) Data Processor — for employee data processed in the OutOfDesk application on behalf of employer customers, and also for B2B consulting, digital audit, automation or training projects in which, in the course of performing the contract, we come to access personal data held by the customer (employees, beneficiaries, leads or other data subjects). In these situations the Controller is the customer (the company engaging us), and NeuroAI Advance S.R.L. acts strictly on that customer's instructions. For every such B2B relationship, NeuroAI Advance S.R.L. signs a separate Data Processing Agreement (in international practice: Data Processing Addendum, "DPA") as required by art. 28 GDPR. The agreement is an annex required by law whenever one company processes personal data on behalf of another, and it sets out the exact protection rules.

This distinction matters: if you are an employee of a customer using OutOfDesk, or a data subject within a B2B project of NeuroAI Advance S.R.L., requests to exercise your GDPR rights should be addressed first to the Controller (your employer, or our customer respectively). NeuroAI Advance S.R.L. can assist you, but the legal basis and the final decisions belong to the Controller.

3. The categories of personal data we process

4. Purposes and legal bases of processing

We process personal data on the following legal bases, in accordance with art. 6 GDPR:

5. Recipients of the data (sub-processors and third parties)

We do NOT sell, rent or transfer your personal data to third parties for commercial purposes. We disclose data strictly to the providers that enable us to operate, and to public authorities upon documented legal requests.

Our current sub-processors are:

• Stripe (Stripe Payments Europe Limited, Dublin, Ireland; with secondary processing by Stripe, Inc., United States, certified under the EU-U.S. Data Privacy Framework) — processes online card payments for the PDF guides and OutOfDesk subscriptions. Stripe receives card details directly from the buyer (Stripe Elements embedded in the checkout pages); NeuroAI Advance S.R.L. neither receives nor stores those details. Stripe acts as an independent Controller for banking compliance (PCI-DSS Level 1 certified), anti-fraud and anti-money-laundering obligations. Details: https://stripe.com/privacy
• Oblio Software S.R.L. (Romania) — automatic issuing of electronic tax invoices and their transmission to SPV/ANAF (the Romanian tax authority's system) through the native Stripe integration on the payment flow. Receives: name, billing details, order value and product description. Details: https://www.oblio.eu/termeni
• Resend (Resend, Inc., United States) — delivers transactional emails (order confirmations, download links for PDF guides, OutOfDesk notifications, AI Readiness Calculator results, replies to leads) and the newsletter editions; Resend also stores the subscriber list (email address and subscription status) and operates the unsubscribe link
• Cloudflare (Cloudflare, Inc., EU infrastructure for this application) — hosts the website front-end and the related serverless functions (DNS, CDN, firewall, DDoS protection, Pages Functions and the KV store for the cookie consent audit trail)
• Render (Render Services, Inc., United States) — hosts the backend API for the contact form and other server-side functions
• Firebase / Google Cloud (Google LLC, United States) — hosts the backend of the OutOfDesk application (authentication, the Firestore database, serverless functions, file storage)
• Google Analytics 4 (Google LLC, United States) — anonymised traffic analysis, with Google Consent Mode v2 in Advanced mode (see section 7.2 for details)
• Google reCAPTCHA Enterprise (Google LLC, United States) — bot protection for the OutOfDesk application, via Firebase App Check. Collects technical signals (IP address, device signature, browser interactions) to distinguish real users from bots
• Sentry (Functional Software, Inc. d/b/a Sentry, EU infrastructure for NeuroAI Advance S.R.L. projects) — collects error and performance reports from the OutOfDesk application and from the backend functions (URL, error message, stack trace, user agent, request identifier and, where applicable, an anonymised user identifier). Used exclusively for debugging and operational monitoring
• Competent public authorities (ANAF, ANSPDCP, courts, Police) — exclusively upon documented legal requests

The complete, up-to-date list of sub-processors, together with their processing locations and GDPR certifications, can be requested at any time at [email protected].

6. Transfers of data outside the European Union

Some of the service providers listed above (Google LLC for Firebase / Analytics / reCAPTCHA Enterprise, Resend, Render) are established in the United States. Cloudflare is a US company, but for this application we use its European Union infrastructure; Sentry likewise runs on EU infrastructure for our projects. Stripe processes payments through Stripe Payments Europe Limited (Ireland), with primary data held in the European Union; part of the fraud processing and support may be replicated at Stripe, Inc. (USA), certified under the EU-U.S. Data Privacy Framework. Oblio is a Romanian company and billing data remains in Romania. For transfers that leave the EU, NeuroAI Advance S.R.L. relies on the appropriate safeguards provided for by the GDPR:

• Standard Contractual Clauses (SCC) approved by the European Commission through Implementing Decision (EU) 2021/914
• The EU-U.S. Data Privacy Framework, for DPF-certified providers (Google LLC is DPF-certified)
• Additional technical measures: encryption in transit (TLS 1.2+), encryption at rest for sensitive data, role-based access control

For OutOfDesk, Firebase authentication data and part of the operational data may be stored on Google servers in the United States, with the safeguards described above. Some Firebase services (Authentication, Analytics) do not yet offer storage exclusively within the European Union; NeuroAI Advance S.R.L. will update this policy as those options become available.

You can request full details about the storage locations of each category of data by writing to [email protected].

7. Cookies and similar technologies

The website uses cookies and similar technologies for operation, performance measurement and, where applicable, personalisation of the experience. Cookies fall into three categories:

8. How long we keep the data

We keep personal data strictly for as long as necessary for the purposes for which it was collected, or for as long as the law requires:

• Contact form data: 24 months from the last interaction, then automatic deletion
• Leads and answers from the AI Readiness Calculator: 24 months from submission, then automatic deletion (or immediately upon request)
• Orders, invoices and other accounting documents: for the period required by tax and accounting legislation
• Active OutOfDesk account: for the whole duration of the subscription, plus 30 days for data export after termination
• Deactivated OutOfDesk account: complete deletion 30 days after termination, except for data kept to meet legal obligations (invoices)
• Website and backend access logs: maximum 6 months
• Analytics data (Google Analytics 4): maximum 14 months
• Sentry error reports: maximum 90 days
• Cookie consent audit trail: 30 months (see 7.4)
• Newsletter subscription: until you unsubscribe (the address remains flagged "unsubscribed" so that your choice is respected); proof of consent is kept for 30 months from confirmation
• Email correspondence: until the purpose of the communication has been fulfilled, then archived for a maximum of 36 months

After these periods expire, the data is irreversibly deleted or, where technically more appropriate, fully anonymised (so that it can no longer be associated with an identifiable person).

9. Your rights under the GDPR

You have the following rights, exercisable free of charge upon a simple written request by email to [email protected]:

• The right of access (art. 15 GDPR) — to find out what personal data we hold about you, the purposes of processing, the recipients and the retention period, and to receive a copy
• The right to rectification (art. 16 GDPR) — to have inaccurate or incomplete data corrected
• The right to erasure / the "right to be forgotten" (art. 17 GDPR) — under the conditions provided by law
• The right to restriction of processing (art. 18 GDPR) — in specific situations (e.g. you contest the accuracy of the data)
• The right to data portability (art. 20 GDPR) — to receive your data in a structured, commonly used and machine-readable format (CSV, JSON)
• The right to object (art. 21 GDPR) — for processing based on legitimate interest and for direct marketing
• The right not to be subject to automated decision-making (art. 22 GDPR) — NeuroAI Advance S.R.L. does not make solely automated decisions producing legal effects
• The right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal
• The right to lodge a complaint with the supervisory authority

We respond to requests within 30 calendar days, with a possible extension of up to 60 further days for complex requests, in accordance with art. 12 para. 3 GDPR.

The supervisory authority in Romania: the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, email [email protected], website www.dataprotection.ro.

10. Data security

We implement technical and organisational measures proportionate to the risk in order to protect personal data against unauthorised access, loss, alteration or destruction:

• TLS 1.2+ encryption on all connections between the client, the front-end, the backend and the sub-processors
• Encryption at rest for the OutOfDesk database (Firestore) and for file storage
• Role-based access control and strong-password authentication for administrators
• Regular backups of operational data, tested for restore
• Monitoring of access logs and of abnormal behaviour
• Data breach notification procedure: assessment within 24 hours, notification to the ANSPDCP within a maximum of 72 hours where a risk is present, notification of the data subjects where the risk is high (arts. 33-34 GDPR)

No method of transmission over the Internet or of electronic storage is 100% secure. We make commercially reasonable efforts to protect the data, but we cannot guarantee absolute security. In the event of a security breach affecting us, you will be notified in accordance with our legal obligations.

11. Artificial intelligence and your data

NeuroAI Advance S.R.L. is an artificial intelligence consultancy and we ourselves use AI models in our day-to-day work. To stay consistent with our public positioning and with the transparency requirements of Regulation (EU) 2024/1689 (the EU AI Act, art. 50 applicable from 2 August 2026), we state explicitly what we do and do not do with your data.

12. Minors

NeuroAI Advance S.R.L. services are not intended for persons under 16. We do not knowingly collect personal data from minors. If you become aware that a minor has sent us personal data, contact us at [email protected] for immediate deletion.

For OutOfDesk, used in a professional B2B context, compliance with the legal minimum working age (15 for light work with parental consent, 16 for full employment, under the Romanian Labour Code) rests entirely with the employer customer.

13. Changes to this policy

We reserve the right to update this Privacy Policy to reflect changes in legislation or in our practices. Any substantial change will be notified through:

• A visible notice on the website on your first visit after the change
• An email to users with an active OutOfDesk account or with recent orders of digital products
• An update of the "Last updated" date in the page header

Previous versions of the policy are available on request at [email protected]. We encourage you to check this page periodically to stay informed about changes.

14. Contact

For any question about the processing of personal data, to exercise your GDPR rights or to report a data protection issue, you can reach us via:

• Email: [email protected]
• Phone: +40 736 495 817

We respond to every request within the statutory period of 30 calendar days, with a possible extension of a further 60 days for complex requests, in accordance with art. 12 para. 3 GDPR. For requests received at [email protected], receipt is confirmed within a maximum of 48 working hours.

If you are not satisfied with our answer, you always have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, email [email protected], website www.dataprotection.ro.