1. Who we are
The controller of your personal data is «PIN PE HARTA S.R.L. — denumirea legală completă» (hereinafter “Pin pe Harta”, “we”), CUI «CUI — ex. RO12345678», «Nr. Reg. Com. — ex. J40/1234/2026», with registered office at «sediul social — stradă, nr., oraș, județ, cod poștal».
For any question regarding data processing, you can contact us at «[email protected]».
2. What data we collect
- Account data: name, email address and password (stored encrypted), email verification status.
- AI assistant conversations: the messages you send to the assistant and the generated replies, linked to your account.
- In-app activity: searches, filters, viewed listings, favorites — when you are signed in or while using the platform.
- Analytics data (with consent): navigation and interaction events, linked to an account identifier and email address through the analytics tool.
- Technical data: IP address, device and browser type, access logs, required for security and operation.
We do not intentionally request special categories of data (e.g. health data). Please do not enter such data in your conversations with the assistant.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Account creation and management, authentication | Performance of contract — Art. 6(1)(b) |
| Providing the AI assistant and the search/valuation features | Performance of contract — Art. 6(1)(b) |
| Transactional emails (account confirmation, password reset) | Performance of contract — Art. 6(1)(b) |
| Usage analytics to improve the platform | Consent — Art. 6(1)(a) |
| Security, abuse prevention, technical logs | Legitimate interests — Art. 6(1)(f) |
We do not use your conversations or data to train our own AI models, and we do not sell them.
4. Who we disclose data to (processors)
To provide the service we use third-party providers that process data on our behalf, under data processing agreements (DPAs). Some of them are located outside the European Economic Area; transfers are based on the European Commission’s Standard Contractual Clauses or other adequate safeguards.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OpenRouter, Inc. | Routing requests to AI models (the conversational assistant and listing text analysis) and generating embeddings. | The content of messages sent to the assistant and the text of analyzed listings. | USA |
| PostHog, Inc. | Platform usage analytics (with consent only). | Account identifier and email address, navigation and interaction events. | USA / EU |
| Resend (Plus Five Five, Inc.) | Sending transactional emails (account confirmation, password reset). | Email address and the content of the transactional message. | USA |
| Mapbox, Inc. | Displaying interactive maps. | IP address and interactions with the map. | USA |
| Google Ireland Ltd. (Google Maps / Places) | Maps, geocoding, and location suggestions. | IP address and location search terms. | EU / USA |
| Railway Corp. | Hosting the application and database. | All data stored by the platform (at rest, on the provider’s infrastructure). | USA |
We may also disclose data to public authorities where required by law.
5. How long we keep data
- Account data: for the lifetime of the account and up to 30 days after its deletion.
- Assistant conversations: up to 24 months from the last activity, unless you delete them earlier.
- Technical logs: generally up to 12 months.
- Analytics data: according to the analytics tool’s retention period.
These periods are defaults and may be adjusted; we delete data when it is no longer needed.
6. Your rights
Under GDPR, you have the right to:
- access to your data (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure of data — the “right to be forgotten” (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of prior processing.
You can exercise these rights by writing to us at «[email protected]». We respond within the legal deadline of at most one month.
If you believe your rights have been infringed, you may contact National Supervisory Authority for Personal Data Processing (ANSPDCP): 28-30 General Gheorghe Magheru Blvd., Sector 1, postal code 010336, Bucharest, [email protected], https://www.dataprotection.ro.
7. Cookies and similar technologies
We use essential cookies for authentication and optional cookies/analytics only with your consent. Details in Cookies Policy.
8. Security
We apply appropriate technical and organizational measures (Art. 32 GDPR): encrypted connections (HTTPS), infrastructure-level encryption of data at rest, access control and logging. In the event of a security breach posing a risk to your rights, we notify the authority within 72 hours and, where appropriate, inform you as well.
9. Children
The service is intended for persons over 18 and is not directed at children.
10. Changes
We may update this policy. The current version is always published on pinpeharta.ro, with the date from which it applies shown at the top of the document.