Informativa sulla privacy
This document is published in English, which is the authoritative version. Any translation is provided for convenience only; in case of any discrepancy, the English version prevails.
1. Who we are
This Privacy Policy explains how Bellora S.R.L., a company registered in Romania (registration no. [COMPANY REGISTRATION NO. / CUI — fill in]), registered office [REGISTERED OFFICE ADDRESS, Romania — fill in] ("Bellora", "we", "us"), collects and uses personal data when you use the Bellora website and apps (the "Platform"). Bellora is the data controller for the personal data described here. For any privacy question, or to exercise your rights, contact us at privacy@bellora.pro.
2. The data we collect
Depending on how you use the Platform, we collect: • Account data — name, email address, phone number, password (stored only as a secure hash), profile photo, and your role (Client or Professional). If you sign in with Google, we receive your name, email address and Google account identifier from Google. • Professional data — business name and details, service locations and addresses (including geographic coordinates used for map search), services and prices, working hours, portfolio images, and the payout and identity information you give our payment provider (Stripe) during onboarding. • Location — if you allow it, your device's location, used only to show professionals near you and to help you pick an address on the map. It is sent with the search and is not saved to your account; the app keeps your last search area on your device until you sign out. You can refuse or withdraw location permission at any time in your device settings and search by address instead. • Booking data — the services you book or offer, appointment times, locations (including your address for home-visit bookings), and any free-text notes you add to a booking. • Payment data — deposit, payout, subscription and refund amounts and transaction records. Full card details are collected and stored by Stripe, not by us. • Content — reviews, ratings and uploaded images (profile, review and portfolio photos). The app accesses your camera or photo library only when you choose to add a picture. • Activity — favourites, waitlist entries, recurring bookings, referral codes and loyalty points. • Support and disputes — the content of support requests, and refund or dispute requests and their outcome. • Technical data — IP address, device type and app/browser information, including a record of your active sign-in sessions (IP address and device) so you can review and sign them out. Your sign-in tokens and app preferences are stored on your device. • Crash reports — if you accept analytics in the consent banner (web and app), error reports from the app (the error, the screen, device and app version) are sent to our error-monitoring provider. Error reports from our servers are collected regardless, to keep the Platform secure and working; they are configured not to attach your identity (such as your account details, IP address or cookies).
3. How and why we use your data (legal bases)
We use your personal data on the following legal bases under the GDPR: • To perform our contract with you (Art. 6(1)(b)) — creating your account, showing professionals near you, enabling bookings, processing deposits, payouts and refunds, and providing support. • For our legitimate interests (Art. 6(1)(f)) — keeping the Platform secure (including server error monitoring and session records), preventing fraud and abuse, enforcing our Terms, and improving our services — where these interests are not overridden by your rights. • With your consent (Art. 6(1)(a)) — your device's location (through the permission prompt), crash reports from the app, and any marketing communications. You can withdraw consent at any time: location in your device settings, crash reports and marketing through the consent banner or by contacting us. • To comply with legal obligations (Art. 6(1)(c)) — for example accounting, tax and anti-fraud record-keeping.
4. Who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who help us run the Platform, under contracts that require them to protect it: • Stripe — payment processing, deposits, payouts, refunds, subscriptions, professional onboarding (identity verification) and fraud prevention. • Google — sign-in, only if you choose to sign in with Google. • Sentry (Functional Software, Inc.) — error monitoring: crash reports from the app (with your consent) and error reports from our servers. • OpenStreetMap Foundation — map data. The map images in the app and website are loaded by your device directly from OpenStreetMap's servers, which therefore receive your IP address and the map area you view. When you look up an address, our servers send the address text or coordinates to OpenStreetMap's search service on your behalf — without your IP address — and keep the result for up to 7 days to limit repeat requests. • Our email provider — to send transactional emails such as verification codes, security alerts and booking updates. • DigitalOcean — hosting of our servers and database (Frankfurt, Germany). • Cloudflare — hosting and delivery of our website and web app. We also share the limited data necessary to complete a booking between the Client and the Professional involved (for example, the appointment details and, once a booking is accepted, the contact and location details each side needs). We may disclose data where required by law or to protect our rights or users' safety.
5. International transfers
Our servers and database are hosted in the European Union (Frankfurt, Germany). Some of our providers — Stripe, Google, Sentry, Cloudflare and our email provider — may process data outside the European Economic Area, including in the United States; the OpenStreetMap Foundation is based in the United Kingdom, which benefits from an EU adequacy decision. Where data leaves the EEA, the transfer is protected by an appropriate safeguard under the GDPR — the European Commission's Standard Contractual Clauses, an adequacy decision, or the EU-U.S. Data Privacy Framework where the provider is certified.
6. How long we keep it
We keep personal data only for as long as we need it: • Account data — for as long as your account is active. When you delete your account (in the app, or by contacting us) it is anonymised: your name, email address, phone number, photo and sign-in links are erased, all your sessions are ended, and the personal details on your bookings are scrubbed. The anonymised booking and payment records we must keep for accounting and legal reasons are retained for the required period. • Booking free-text notes and location details — the sensitive, free-text and location parts of a completed booking are automatically scrubbed a set number of months after the appointment; the financial and scheduling record needed for accounting is retained separately. • Device location — not stored on our servers; the search area saved on your device is removed when you sign out. • Sign-in session records (IP address and device) — deleted when you sign the session out or delete your account, and otherwise within a day after the session expires (at most 31 days after you last used it). • Verification, password-reset and email-change codes — valid for 15 minutes; deleted when used or replaced, and otherwise within a day after they expire. • Address lookups — cached for up to 7 days. • Crash and error reports — kept by our error-monitoring provider for a limited period set by its data-retention policy (typically 30–90 days). • Payment and tax records — for the period required by applicable accounting and tax law. When data is no longer needed we delete or anonymise it.
7. Your rights
Under the GDPR (and UK-GDPR if you are in the UK) you have the right to: • access the personal data we hold about you; • have inaccurate data corrected; • have your data erased in certain circumstances; • restrict or object to certain processing; • receive your data in a portable format; • withdraw consent at any time, where processing is based on consent. To exercise any of these, contact us at privacy@bellora.pro. You also have the right to complain to a data-protection authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or the authority in your country of residence.
8. Security
We take appropriate technical and organisational measures to protect your data — including encryption in transit, hashed passwords, access controls, and rate limiting. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authority of a data breach where the law requires.
9. Children
The Platform is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes and contact
We may update this Privacy Policy from time to time and will notify you of material changes through the app or by email. For any question about this policy or your data, contact Bellora S.R.L. at privacy@bellora.pro.