Privacy policy

VITESTRA S.R.L., tax ID (CUI) 52368278, Trade Register no. J2025062985003, Romania. General contact: contact@vitestra.com. For any question or request about your personal data: gdpr@vitestra.com.

This policy covers what we do with personal data as a controller: when you visit vitestra.com, when you write to us, when we work with your company, and when you use Finu.

Data our clients process using Vitestra: for example, the WhatsApp messages you send a business that runs a Vitestra agent. That business decides how your data is used; we process it only on its behalf, under a data processing agreement. Its own privacy policy applies, and the assistant links to it in its first message. If you contact us about that data, we pass your request on and help the business answer it.

• When you visit the site: IP address, browser type, the page requested and the time, in our hosting provider's technical logs. We use them to serve the site and protect it from abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• When you write to us: your email address, your name and whatever you choose to tell us. We use them to reply and, if you want, to discuss working together. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)), or our legitimate interest in replying (6(1)(f)).
• When we work together: your company's contact people and billing details. Legal basis: performing the contract (6(1)(b)) and our tax and accounting obligations (6(1)(c)).

We make no automated decisions that affect you, and we don't use your data for advertising.

For a firm's account on Finu, and for the messages people interested in Finu send to the Finu number (+40 751 366 519), we are the controller. For the data of a firm's customers (the conversations on the firm's number, requests, the customer list), the firm is the controller; we process it only on the firm's behalf, under the data processing agreement made with the firm, and the firm's own policy applies.

• The firm's account: the firm's name and its address <firm>.finu.ro, the name, phone number and role of the owner and of the team, and sign-in by SMS code. Legal basis: performing the contract (Art. 6(1)(b) GDPR).
• Messages to the Finu number: your phone number and what you write. We use them to reply and to help you sign your firm up. Legal basis: steps taken at your request before a contract (6(1)(b)), or our legitimate interest in replying (6(1)(f)).
• Connecting the firm's WhatsApp: the identifiers of the WhatsApp Business account and of the number, and the access key Meta issues, stored encrypted. We use it only so the firm's assistant can send and receive messages on the firm's number.

Our central part keeps phone numbers only as a cryptographic fingerprint, enough to route each message to the right firm; messages pass through it without being stored.

Each firm's data is on its own dedicated computer, in Germany (Hetzner). The central part runs on AWS in Frankfurt. finu.ro is hosted by Vercel (United States), sign-in is provided by Clerk (United States), WhatsApp by WhatsApp Ireland (Meta), and the language model is reached through OpenRouter (United States), with Google, without the content being kept; Cloudflare carries the traffic to the firm's computer. Transfers outside the EU rely on the EU-US Data Privacy Framework (DPF) or standard contractual clauses.

For as long as the firm uses Finu. When the owner closes the firm, the data stays for 30 days so the firm can change its mind, then it is permanently deleted, backups included; the disk's technical copies are gone within 7 days after that. Messages from people interested in Finu who do not sign their firm up: at most 90 days after the last message; backups keep them for at most 14 more days. If you sent STOP, we keep only your number, so we don't write to you again.

The owner closes the firm under Settings → Closing the firm. Any other request (a team member, someone who wrote to the Finu number) goes to gdpr@vitestra.com. Details are on the Data deletion page, linked in the site's footer.

This site uses no cookies, analytics, advertising pixels or other tracking. Fonts are served from our own domain, not by a third party.

• Site hosting: Vercel Inc. (United States).
• Email: our email provider, with data centres in the EU.
• Our accountant and public authorities, only where the law requires it.

We never sell or rent data. Vercel Inc. is certified under the EU-US Data Privacy Framework and processes the site's access logs (IP address and technical request data).

• Site logs: the short period set by our hosting provider.
• Correspondence: for as long as the conversation lasts, and at most three years after the last message, the general limitation period.
• Contracts, invoices and other accounting records (including a personal identification number, where an invoice carries one): as long as tax and accounting law requires.

You can ask for access to your data, its correction, erasure, restriction or portability, and you can object to processing based on our legitimate interest. Write to gdpr@vitestra.com; we reply within one month. You can also complain to Romania's data protection authority, ANSPDCP (www.dataprotection.ro).

The site is served over HTTPS only, and access to our email and infrastructure is limited to the Vitestra team.

When this policy changes, we publish the new version here with the date it takes effect.