This is an English translation of the Romanian original. The Romanian version is the legally binding one; if the two differ, the Romanian version prevails.
This policy explains what personal data we process as a controller, for what purposes, on what legal basis, how long we keep it, who we share it with and what your rights are, under Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018. We describe the categories of data the platform may process, including those that only appear when a feature is turned on.
1. Who we are
The controller is DIMAX.RO S.R.L., registered office at Bld. Racoțeanu nr. 216, Camera 1, Et. 1, Oraș Filiași, Județ Dolj, postal code 205300, Romania, registered with the Trade Register under no. J16/1920/2021, CUI 44650706 (“we”, “us”). Manifolio is a product of DIMAX.RO S.R.L.
For any question or request about personal data, write to privacy@manifolio.com. We have not appointed a data protection officer, because our activity does not fall under the cases in article 37 GDPR; requests are handled directly by the company’s management.
2. When we are the controller and when we are not
- We are the controller for the data of users who sign in to the admin or the Manifolio apps, for visitors to manifolio.com, for messages sent through the contact form or by email, for billing data, and for technical data used to secure and improve the Service.
- We are a processor for the data our customers put into Manifolio or collect through it from their sites, such as content, media files, form submissions and visit statistics. The Data Processing Agreement applies to that data, and the customer is the controller.
- If you visited a site that uses Manifolio or sent it a form, contact the owner of that site: they decide what happens to your data and have tools in the admin to find, export and delete the submissions sent from a given email address (section 10). If you write to us, we pass your request on to them without delay and point you to them.
3. What data we process, why, on what basis and for how long
The legal bases are those in article 6(1) GDPR: (b) performing the contract or taking steps before entering into it, (c) a legal obligation, (f) our legitimate interest, which we have weighed against your rights. We keep data for as long as the purpose requires; the periods below are those we normally apply and may be shorter. We keep data longer only where the law requires it or to establish, exercise or defend legal claims, for as long as that need lasts.
| Category | Data | Purpose | Basis | How long |
|---|---|---|---|---|
| Account | name, email address, password (only as a cryptographic hash), language, time zone, roles in organisations and sites, creation date | creating and managing the account, access to the Service | (b) | while the account exists; after it is closed, a grace period (currently 30 days), then deletion |
| Two-factor authentication | the authenticator app secret (encrypted), backup codes (only as hashes) and technical verification data | protecting the account | (b) and (f); art. 32 GDPR | while it is on; deleted with the account |
| Sessions | a fingerprint of the session token, IP address, browser and system, start, use and expiry times | keeping you signed in, your list of sessions, spotting unusual access | (b) and (f) | until sign-out or expiry (currently at most 30 days); expired rows are deleted periodically |
| Sign-in attempts and limits | the email address used, IP address, result, time, including for other sensitive actions (for example 2FA codes or confirming account deletion) | limiting abusive attempts and protecting accounts | (f); art. 32 GDPR | as long as needed for security, as a rule at most 90 days |
| Password resets and invitations | a fingerprint of the link, IP address of the request, creation, expiry and use times; for invitations: the address invited, the role, who invited | recovering access, joining a team | (b) | short-lived links; the rows remain while the account or organisation exists |
| Acceptance of the Terms | the version accepted, the boxes ticked (including the one for expressly accepted clauses, article 1203 of the Romanian Civil Code), whether it included the Data Processing Agreement, the time, IP address and browser, the organisation | evidence of the electronic conclusion of the contract | (b) and (c); (f) for legal claims | while the account exists; after it is deleted, the audit log keeps the version and time, without the IP address or email, as a rule for at most 5 years |
| Signed service order, if our team prepares the organisation before acceptance | the client company’s details, the signatory’s name and position, the signature, date, scope of the work, the signed document; who on our team recorded it | evidence of the order for the period before the Terms are accepted | (b) and (c) | while the organisation exists, stored privately in the EU and accessible only to our team; afterwards, only where the law requires it or to defend legal claims |
| Audit log | who made a change, what action, on which item, when and from which IP address; the email address of people invited | traceability of changes, security, investigating incidents, evidence in a dispute | (f); (b), towards the customer organisation | while the organisation exists; when an account or organisation is deleted, the rows remain pseudonymised (no IP address and no email) and are normally deleted 5 years after they were recorded |
| Service communications | email address, name, language, notification preferences, in-app notifications | invitations, password resets, security alerts, notices about the account and the Service, changes to legal documents, confirmations of GDPR requests | (b); (c) and (f) for mandatory notices | notifications, while the account exists; transactional emails are not kept by us after sending, beyond the technical record of delivery |
| News about the Service | email address and name of our customers’ users | to tell you about new features, changes and similar Manifolio services | (f); article 12(2) of Romanian Law no. 506/2004 | until you unsubscribe (from any message or by email) or close your account |
| AI features, only if an owner turns them on for the organisation | the owner’s consent (who, when, the version of the notice); for each request: the content sent and its context, which may contain personal data if the content does; we keep only data about the request (for example the action, model, usage, result and time) | the writing, translation and suggestions you ask for; evidence of consent; enforcing plan limits | (b) and (f) | the content sent is not kept by us; the consent and usage record, while the organisation exists; at the model provider, as set out in section 5 |
| API request log | the key used, path, status, duration, time; no visitor IP address | usage statistics for the customer, troubleshooting, security | (b) and (f) | as a rule 30 days; aggregated totals, longer |
| Content you create | the entries you create or change (with your internal identifier), versions, schedules, imports, uploaded files, API keys and webhooks created | running the Service for the organisation and traceability of team work | (b) | the content belongs to the organisation and follows its rules; after your account is deleted, the internal identifier remains without leading back to you |
| Exports and GDPR requests | type of request, status, times, archive size; for visitor requests: the masked email and number of submissions | fulfilling your and visitors’ rights, evidence that they were fulfilled | (c) (art. 12-22 GDPR) | archives, a short period (currently 7 days); request history, while the account or organisation exists |
| Billing, once online payments start | company name, tax details, contact person, plan, payments; card details are processed only by Stripe, as an independent controller, and we receive at most limited data (for example the card type and last 4 digits) | issuing invoices, accounting records, collecting payment | (b) and (c) | the period required by accounting and tax law (as a rule 5 years; 10 years for accounting registers) |
| The contact form on manifolio.com | name, email, company or site (optional), the message, the page, country and device type | replying to you and, at your request, taking steps before a contract | (b) and (f) | as a rule at most 2 years after the last correspondence, unless they become part of a contract |
| Correspondence and support | email address, name, the content of messages sent to our addresses and attachments | replying to you, handling requests, security reports and notices of illegal content | (f); (c) for GDPR and DSA requests | as a rule at most 2 years after the last correspondence, or as long as needed to defend legal claims |
| manifolio.com statistics | pseudonymised visits, without cookies (section 4) | understanding which pages are useful | (f) | raw events, as a rule 90 days; aggregated totals, as a rule 2 years |
| Security, operation and improvement of the Service | technical and usage data, such as IP address, request headers, error and performance logs, feature usage; where applicable, the __cf_bm cookie (section 12) | protecting against attacks and abuse, troubleshooting, measuring and improving the Service, aggregated statistics | (f) | raw data, as long as needed, as a rule at most 90 days (at infrastructure providers, under their policies); aggregated or anonymised data, without limit, since it is no longer personal data |
We do not sell personal data, do not use it for behavioural advertising and do not take decisions based solely on automated processing that produce legal effects for you. Providing account data is necessary to use the Service; without it, the account cannot be created.
4. Statistics without cookies
Our analytics script (t.js), used on manifolio.com and on customers’ sites, is designed to measure usage without cookies and without writing to the browser:
- a visitor is counted through a pseudonymous identifier, computed with a hash function from a random value that changes daily, the IP address, browser and site; the daily value is deleted, so the same person cannot be recognised on another day or on another site;
- the IP address is used only for that calculation and to determine the country; it is not stored;
- data such as the page path, the source of the visit, the country, device type, browser family and, if the site sends them, its own events and performance measurements may be kept;
- the script does not run if the browser sends a Do Not Track or Global Privacy Control signal.
5. Who receives the data
Data is accessible to people on our team who need it, under a duty of confidentiality, and to the providers that help us run the Service, as processors, under contract. The up-to-date list, with locations and safeguards, is on the Sub-processors page; we may change providers and update the list. At the date of this version, the main providers are:
- Cloudflare, Inc.: running the application, the network, file storage (in the EU), protection against abuse, and email (sending service emails and forwarding messages received at our addresses to the company’s mailbox);
- Supabase, Inc.: the database, hosted on Amazon Web Services in the Frankfurt region (Germany). Supabase acts as a processor under its data processing agreement; its support staff may access the infrastructure from outside the EU to operate the service. Whether the provider keeps backups, and for how long, depends on the plan used (see Sub-processors);
- Anthropic, PBC (United States): only if an owner has turned on AI features for the organisation, and only for requests started by a user. At the date of this version, under Anthropic’s commercial terms, data sent through the API is not used to train models, and its retention at Anthropic is limited (as a rule at most 30 days, with the exceptions set out in Anthropic’s policies, for example for requests flagged for breaching its usage policy or where the law requires it). Anthropic acts as a processor under its data processing agreement;
- Stripe Payments Europe, Ltd. (Ireland), only once online payments start (we will announce this in advance): it acts as an independent controller for the payment data it processes (card details, fraud prevention, know-your-customer and anti-money-laundering checks) and, where applicable, as a payment service provider authorised to carry out payment operations on our behalf, intermediating the financial relationship between us and our customers. Stripe’s privacy policy also applies to that data.
Data may also be received by our professional advisers (for example lawyers, accountants, auditors), under a duty of confidentiality, and by public authorities where the law requires it or to defend legal claims. Members of your organisation see your name, email and role, and owners and admins see the organisation’s audit log. If the Manifolio business is transferred, in whole or in part, to an affiliate or to another company (for example by merger, division or sale of the business), data may pass to it, and it will process the data in line with this policy; you will be informed.
6. Transfers outside the European Economic Area
Stored data is, as a rule, kept in the European Union. Requests pass through the Cloudflare network, which may process them in the data centre closest to the visitor, including outside the EEA, and some providers are US companies or have support staff outside the EEA.
Any transfer outside the EEA is made only with the safeguards in Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework, for certified providers) or the standard contractual clauses adopted by Decision (EU) 2021/914, with supplementary measures where appropriate. At the date of this version:
- Cloudflare: certification under the EU–US Data Privacy Framework and the standard contractual clauses in its data processing agreement;
- Supabase: the standard contractual clauses (modules 2 and 3), incorporated into its data processing agreement; stored data stays in Frankfurt;
- Anthropic: the standard contractual clauses (modules 2 and 3), incorporated into its data processing agreement;
- Stripe, once used: the EU–US Data Privacy Framework and the standard contractual clauses, under Stripe’s agreements.
A copy of the relevant safeguards can be requested at privacy@manifolio.com.
7. How we protect data
We apply technical and organisational measures appropriate to the risk, under article 32 GDPR, which we review and update over time. They include, for example:
- separating each customer’s data at several levels (in the application and in the database);
- encryption in transit and encryption at rest provided by our providers; additional protection for sensitive secrets;
- storing passwords, sessions and API keys only in derived form (hashes, fingerprints), never in clear text;
- two-factor authentication, limits on sign-in attempts and least-privilege access for our team;
- an audit log protected against modification, tracking our team’s actions;
- data minimisation, for example removing metadata embedded in images on upload (such as GPS location or camera model), keeping only what is needed to display them correctly;
- AI features off until an owner of the organisation turns them on;
- controlled, time-limited access to export archives.
No security measure is infallible, but we undertake to respond promptly to incidents and to inform you where the law requires it.
8. Your rights
You have the right to information and access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20) and to object (art. 21), including objecting at any time to processing based on legitimate interest and to news about the Service. You also have the right not to be subject to a decision based solely on automated processing (art. 22); we do not take such decisions.
You can exercise many of these rights yourself, in the admin (section 9). For any other request, write to privacy@manifolio.com. We reply within one month, which may be extended by two further months for complex or numerous requests, in which case we tell you. We may ask for additional information to confirm your identity and may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive, under article 12(5) GDPR.
You can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro, or with the authority in the state where you live or work, and you can go to court.
9. What you can do yourself, in the admin
On the admin’s Account and privacy page you can, at the date of this version:
- download your data (art. 15 and 20): an archive in a structured format (for example JSON and CSV) with your account data, memberships and roles, sessions, relevant activity in the audit log, notifications and preferences, acceptances of the Terms and other data linked to your account. The archive is normally ready within a short time and can be downloaded for a limited period, only with your account; the number of exports per day may be limited. Security data (for example the password or 2FA secret) is not exported;
- close your account (art. 17), after confirming your identity. The account is locked at once, sessions are closed and you leave your organisations. After the grace period (currently 30 days) we delete the account data; the organisations’ audit logs keep only pseudonymised rows. If you are the only owner of an organisation, you first transfer ownership or delete the organisation;
- see the history of your requests;
- rectify your data: your name can be changed in your account; for other changes, for example your email address, write to us.
Anyone who does not accept a new version of the Terms can still download their data and close their account.
10. Organisations and site visitors
Owners of an organisation can export the organisation’s data, transfer ownership and delete the organisation (section 12 of the Terms).
Owners and admins have tools for requests from their sites’ visitors: they can search by email address across form submissions on the organisation’s sites, export the results for the data subject and delete them, including the copies in the webhook history. t.js statistics are pseudonymised daily and cannot be linked to a person, so they cannot be found by email.
11. Children
Manifolio is a service for professionals; accounts are created only for people aged 18 or over. We do not knowingly collect children’s data; if you find out that this has happened, write to us and we will delete it.
12. Cookies and browser storage
What we use, on manifolio.com and in the admin, is described in the Cookie Policy. At the date of this version we use only strictly necessary or preference cookies and storage, which do not require consent; if we ever use others, we will ask for your consent first.
13. Changes
We may update this policy, for example when we change features, providers or practices, or when the law changes. The date and version at the top show the current version. When we change the policy in a way that matters, we tell users by email or in the admin before the change takes effect.