Privacy Policy

Who we are

Apptavio is a trading name of Fabrica de Sport SRL, a company registered in Romania:

• Registered office: Fundătura Crinului nr. 19, sat Vișan, com. Bârnova, 707041 Iași, Romania
• VAT / fiscal code (CUI): RO28556929
• Email: [email protected]

Fabrica de Sport SRL is the controller of the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Where we process data of people in the United Kingdom, the UK GDPR also applies.

We collect as little personal data as practical. We do not sell personal data, we do not use advertising trackers, and we do not build profiles of individuals for advertising.

Summary

• If you request a free app preview, we use your website address and email address to create your preview, send it to you and follow up about it.
• If you ask to talk to us from a preview page or book a call, we use the details you give us to get back to you.
• If you are a business contact we found in public sources, we may send you a small number of relevant business emails, where the law of your country allows it. You can object at any time and we will stop.
• If you open an app preview, we record anonymous usage events (for example which screens were viewed) with a random session identifier. We do not fingerprint devices.
• Our service providers (hosting, network security, email delivery, AI, scheduling) process data on our behalf under contract.

Data we collect and why

When you request a free app preview

When you use the preview request form we collect:

• your business website address;
• your email address and, if you choose to give it, your first name;
• an approximate country, derived from the country code our network provider attaches to your request or from your website's domain, and the language of the page you used;
• optional notes you add, and whether you opted in to receiving news from us (off by default);
• technical security data: a one-way hash of your IP address (never the address itself) and your browser's user agent, used to prevent abuse and apply rate limits.

Why: to analyse your public website, create your preview, have a person review it, email it to you and follow up on your request. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse of a free service (Art. 6(1)(f)). News and offers beyond your request are sent only if you opt in (Art. 6(1)(a)); you can withdraw consent at any time.

Follow-up about your preview: after we send your preview we may send at most two short follow-up emails about it — a reminder if you have not opened it, and an offer to talk if you have. Every email has a one-click unsubscribe link, and we stop as soon as you reply, contact us or unsubscribe.

When you ask to talk to us or book a call

If you use the "Let's talk" form on a preview page, we collect your name, email address, optional phone number, your preferred way of being contacted, a convenient time and any notes about the app you have in mind. We use them to contact you and discuss a possible project (Art. 6(1)(b) GDPR).

If you book a meeting through our scheduling page, the booking is made on Calendly, which processes the details you enter under its own privacy policy and shares the booking with us.

When we analyse a business website

To build a preview, our systems visit the business's public website in a limited and respectful way (a small number of pages, honouring robots.txt) and extract business information such as services, prices, opening hours, branding and images. This is mostly information about a business, but public pages may contain names or contact details of people who work there.

Legal basis: our legitimate interest in showing a business what an app for it could look like (Art. 6(1)(f) GDPR).

Business contacts for B2B outreach

We sometimes prepare a preview for a business proactively and contact the business about it. For this we may hold business contact data about people in their professional capacity:

• name and role (where available);
• business email address and business phone number;
• where we found the information and when;
• a record of emails we send and receive, and any objection.

Sources: the business's own website, public business directories and listings, and public professional profiles. We record the source of every contact so that we can tell you where your details came from (Art. 14 GDPR).

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) — offering a relevant service to businesses. Before contacting anyone we check that the address is a business address and that unsolicited business email is permitted under the electronic communications rules of the recipient's country; where those rules require prior consent, we do not send it. Every outreach email identifies us, explains why you are receiving it and contains a simple way to object.

Your right to object: you can object at any time, without giving a reason, using the link in any of our emails or by writing to [email protected]. We will stop and keep your address on a suppression list so that we never contact you again by mistake (Art. 21 GDPR).

When you view an app preview

App previews run on a separate, isolated demo domain. When you open a preview, the preview page sends simple usage events to us — such as "preview opened", "screen viewed", "feature explored" or "button clicked" — together with the device type (desktop or mobile).

• Events are linked to a random identifier created for that browser tab. It is not stored in a cookie and is not derived from your device or browser characteristics. We do not use fingerprinting.
• If your browser sends a "Global Privacy Control" or "Do Not Track" signal, we only record that the preview was opened, without an identifier.
• We use these events to understand whether a preview was useful to the business it was made for. We do not share them with advertising networks.

Legal basis: our legitimate interest in understanding how our previews are used (Art. 6(1)(f) GDPR).

When you browse apptavio.com

Our servers and network provider process technical data such as IP addresses and request logs to deliver the website, keep it secure and investigate abuse (Art. 6(1)(f) GDPR). See our Cookie Policy for the few strictly necessary cookies involved.

When you email us or become a client

We keep correspondence, project information and invoicing details needed to provide our services and to meet our legal, tax and accounting obligations (Art. 6(1)(b) and (c) GDPR).

Service providers (processors)

We use the following providers, who process personal data on our behalf and only on our instructions, under data processing terms:

We send our AI provider public website content and the business information needed for the task — not the contents of forms that it does not need. We choose AI providers whose commercial terms do not allow them to use our inputs to train their models.

App previews may load fonts from Google Fonts, which receives the visitor's IP address in order to deliver the font files.

International transfers

Some providers process data outside the European Economic Area, in particular in the United States. Where this happens, the transfer is based on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for certified providers) or on the European Commission's Standard Contractual Clauses.

How long we keep data

• Preview requests and related contact details: as long as needed to deliver and discuss your preview; if no business relationship follows, we delete or anonymise them.
• Preview usage events: up to 13 months, then deleted.
• AI working files (the intermediate steps used to generate a preview): up to 90 days.
• B2B contact data: reviewed regularly and deleted when no longer relevant.
• Suppression list: if you object or unsubscribe, we keep only your email address and the reason, for as long as necessary to make sure we never contact you again.
• Backups: kept for 14 days, then overwritten.
• Client and accounting records: for the periods required by Romanian tax and accounting law.

Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased;
• restrict processing;
• object to processing based on legitimate interests, and an absolute right to object to direct marketing;
• receive your data in a portable format, where applicable;
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email [email protected]. We respond within one month, as required by the GDPR, and may need to verify your identity.

Complaints

If you are unhappy with how we handle your data, please contact us first so that we can put it right. You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, Romania — www.dataprotection.ro. You may also complain to the authority in the country where you live or work; in the United Kingdom this is the Information Commissioner's Office (ico.org.uk).

Security

We protect personal data with access controls and two-factor authentication for our team, encryption in transit, hashed security data, strict separation of preview hosting from our main website, regular backups and audit logs of sensitive actions. No system is perfectly secure, but we take reasonable measures and review them regularly.

Automated decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. AI is used to draft preview concepts and emails; a person reviews every preview before it is sent.

Children

Our services are for businesses and are not directed at children.

Changes to this policy

We update this policy when our processing changes. The date at the top shows the latest version.