Privacy Policy
This policy explains what personal data gRaffRO.dev collects through https://app.graffro.dev, why, and what you can do about it. It is written to be read, not to cover us. If a sentence is unclear, ask at contact@graffro.dev.
Who is responsible
The controller of your data is gRaffRO.dev, Romania, registration —. Reach us at contact@graffro.dev.
What we collect, and why
When you send a brief or create an account. Your name, email address and, if you give it, phone number, together with what you write in the brief. We use these to answer you, prepare an offer and run the project. Legal basis: taking steps at your request before a contract, then the contract itself.
When you buy work. Your billing details: address, and for companies the company name, registration number and VAT number. We check EU VAT numbers against the European Commission's VIES register, which tells us only whether the number is valid. We use these to invoice you correctly and to keep the records the tax law requires. Legal basis: the contract and our legal obligations.
When you pay. Card payments are handled by Stripe and, where we offer it, PayPal payments by PayPal. We never see your card number; we receive a confirmation, the last digits and the amount. Bank transfers reach us through our bank, and you may upload a proof of payment. Legal basis: the contract.
While the project runs. The messages you exchange with us, the files you upload, your comments on delivered work, the reviews you write and your answers about publishing them. We use these to do the work. Legal basis: the contract, and for publishing a review, your consent, which you can withdraw from your account.
To keep your account safe. Sign-in times, the browser and operating system used, and IP addresses. We use these to detect sign-ins that are not you and to let you see and close sessions. Legal basis: our legitimate interest in security, and yours.
To keep the platform working. Technical error reports through Sentry, so we can fix what breaks. If you allow analytics in the cookie card, a recording of how the pages were used as well, with text and media masked. Legal basis: our legitimate interest in a working service for the reports, and your consent for the recording.
To understand how the site is used. Only if you allow it in the cookie card, Google Analytics with IP anonymisation. Legal basis: your consent, which you can withdraw from the Cookie Policy page.
We do not buy data about you, do not build advertising profiles and do not sell anything we hold.
Who sees it
Our staff and contractors who work on your project, bound by confidentiality. Providers who process data for us under contract: our hosting provider, our email provider, Stripe for payments (and PayPal, where we offer it), Sentry for error reports, Google for analytics when you allow it, and our accountant, who receives invoices as the law requires. Authorities, when the law obliges us. No one else.
Some providers process data outside the European Economic Area, under the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Your account and project data: for as long as your account exists, then up to three years in case of a dispute. Invoices and payment records: ten years, as Romanian accounting law requires. Security logs: one year. Error reports: ninety days. Analytics data: as set in Google Analytics, at most fourteen months.
When you close your account from your profile, we anonymise what we can at once and keep only what the law makes us keep, for as long as it makes us keep it.
Your rights
You can ask us for a copy of your data, correct it, have it deleted, restrict or object to how we use it, take it with you in a machine-readable form, and withdraw any consent you gave. Most of this you can do yourself from your profile: edit your details, download your data, close your account. For the rest, write to contact@graffro.dev; we answer within a month.
If you are not satisfied with our answer, you can complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (www.dataprotection.ro), or to the authority of the country where you live.
Security
Passwords are stored hashed, never in clear. Connections are encrypted. Payment details never touch our servers. Access to your data is limited to the people who need it for your project. If a breach ever affects you, we tell you and the authority as the law requires.
Children
The service is for adults and businesses. We do not knowingly collect data from anyone under 18.
Changes
We may update this policy. The date at the top shows the current version; material changes are announced on the site or by email.
Contact
gRaffRO.dev, Romania. Email contact@graffro.dev. To report abuse or a security issue: abuse@graffro.dev.