Privacy Policy
Effective date: October 2, 2026 · Version: 1.0
This policy explains what personal data SELFOIA collects, why, who else handles it, how long we keep it, and what rights you have. We have kept it as short as the law allows.
1. Who is responsible
1.1. SELFOIA S.R.L. is the "controller" of the personal data described here:
- registered office: Strada Gladiolelor 2, 040144 Bucharest, Romania;
- Trade Register J2025075767005, CUI / VAT RO52628580;
- email: .
1.2. For any privacy question or request, write to . Our founder, Denys Kharkovskyy, handles these personally. We are not required to appoint a Data Protection Officer and have not done so.
1.3. When we work on your app. During a paid engagement we may come across personal data of your app's users. For that data, you are the controller and we act only on your instructions, under our Data Processing Addendum. Your own privacy policy covers that data, not this one.
2. The short version
- We don't use cookies unless you switch them on (section 10).
- We collect only what we need to answer you, do the work and get paid.
- We don't sell your data, use it for advertising or profiling, or make automated decisions about you.
- Some of our providers are based in the US. We use legal safeguards for that (section 7).
- You can ask for a copy of your data, or ask us to correct or delete it, at any time.
3. What we collect and why
3.1. When you visit the website
| What | Why | Legal basis |
|---|---|---|
| Server logs kept by our host, Vercel: IP address, browser and device type, page requested, time, referring page | To deliver the website, keep it secure and fix errors | Our legitimate interest in running a secure website (Art. 6(1)(f) GDPR) |
| Vercel Web Analytics: page views, referring site, country, browser and device type. It uses no cookies. Visitors are counted with a temporary hash of the request, which is discarded within 24 hours. We only see totals. | To understand which pages are useful | Legitimate interest (Art. 6(1)(f)) |
| Vercel Speed Insights: page-load timings, the address of the page, and general browser and device information. It uses no cookies and is not used to identify you. | To keep the website fast | Legitimate interest (Art. 6(1)(f)) |
3.2. When you ask for a free check
| What | Why | Legal basis |
|---|---|---|
| App URL, the tool you built with, your email address, and your answers about your app (rough number of users, whether it takes payments, whether it stores personal data) | To do the free check and reply to you | Steps you asked us to take before a possible contract (Art. 6(1)(b)); legitimate interest in answering enquiries (Art. 6(1)(f)) |
| Scanner results you paste, and what worries you | Same as above | Same as above |
| Your ownership confirmation, and how you verified ownership if we ask (for example an email from your app's domain) | To make sure we share sensitive details only with the owner | Legitimate interest in protecting app owners and their users (Art. 6(1)(f)) |
| The page that referred you and the page the form is on (sent with the form) | To learn which pages bring enquiries | Legitimate interest (Art. 6(1)(f)) |
| Anti-spam signals: Cloudflare Turnstile checks technical browser signals such as IP address, browser and TLS details. A rate limiter allows up to 5 requests an hour from one visitor: it keeps a short-lived counter keyed to a salted one-way hash of your IP address. A second short-lived counter, keyed to a salted one-way hash of the email address typed into the form, lets us send at most 2 automatic replies to one address in 24 hours, so nobody can use the form to flood someone else's inbox. The counters store only these hashes, never the IP address or the email address itself. A hidden trap field and the time taken to fill in the form are checked on the server. | To stop spam and abuse | Legitimate interest in protecting the form (Art. 6(1)(f)) |
| Your optional research consent (unticked by default) | To include anonymised findings from your app in aggregate research | Your consent (Art. 6(1)(a)). You can withdraw it at any time. |
Please don't paste passwords, secret keys or your customers' personal data. If you do, we delete them and ask you to rotate the keys.
3.3. When you email us or book a call
- Email: your name, email address and what you write. We use it to reply and keep a record of our conversation. Legal basis: pre-contract steps or contract (Art. 6(1)(b)), or legitimate interest (Art. 6(1)(f)).
- Booking a call: we link to Calendly; we don't embed it. Calendly collects your name, email, the time you choose and any answers you give, on our behalf. The call runs on the video tool shown in your booking (Google Meet or Zoom). We don't record calls unless we ask you first and you agree.
3.4. When you buy a service
| What | Why | Legal basis |
|---|---|---|
| Name, company, email, billing address, country, VAT number | To make and perform the contract, and to issue invoices | Contract (Art. 6(1)(b)); legal obligation under Romanian tax and accounting law (Art. 6(1)(c)) |
| Payment details (card, bank) | To take payment. Stripe processes these; we never see your full card number. | Contract (Art. 6(1)(b)) |
| Location evidence for VAT (billing country, IP country, card country) | To apply the right VAT treatment | Legal obligation (Art. 6(1)(c)) |
| Your confirmation that you're buying for your business, and your acceptance of our terms | To prove what you agreed to | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) |
Stripe also processes some data as an independent controller, for example to prevent fraud and meet its own legal duties. See Stripe's privacy policy.
3.5. When you are our client
We keep your contact details, our emails, the authorisation form, reports and our working notes (the notes are deleted as section 8 says). Legal bases:
- performing the contract (Art. 6(1)(b));
- keeping records to deal with questions or legal claims (Art. 6(1)(f));
- accounting law (Art. 6(1)(c)).
We don't add you to a newsletter. After a free check we may send you one follow-up email about it, to ask whether you have questions. If you'd rather not get it, reply "stop" at any time and we won't send it. Legal basis: our legitimate interest in following up on a request you made (Art. 6(1)(f)).
3.6. Our research study, "State of AI-built apps 2026"
See section 9.
4. What we don't do
We don't sell or rent personal data.
We don't use your data for advertising or cross-site tracking.
We don't make decisions about you based solely on automated processing.
Anti-spam checks may block a submission that looks automated. If that happens to you, email us instead.
We don't knowingly collect data from children (section 12).
5. Where your data comes from
Mostly from you. Some data comes from our providers: Stripe (payment status), Cloudflare (anti-spam result) and Vercel (logs and statistics). For the research study, data comes from public app showcases and from the public pages of the apps themselves (section 9).
6. Who we share it with
6.1. Our providers ("processors"). They process data on our behalf, under contracts that follow Art. 28 GDPR:
| Provider | What it does for us | Where |
|---|---|---|
| Vercel Inc. | Hosting, server logs, Web Analytics, Speed Insights | USA and a global edge network |
| Cloudflare, Inc. | Turnstile anti-spam check | USA and a global network |
| Upstash, Inc. | Rate limiting (short-lived counters) | EU (Frankfurt) |
| Resend (Plus Five Five, Inc.) | Delivers form emails and automatic replies | USA |
| Calendly LLC | Call booking (link only) | USA |
| The video tool shown in your booking (Google Meet or Zoom) | Video calls | USA and a global network |
| Our email provider | Our mailbox and the files you send us by email | EU or USA |
| Our invoicing software | Issuing invoices | EU or USA |
| Our accountant in Romania | Bookkeeping and tax filings | Romania |
| Our password manager | Storing access details for test accounts and client projects | EU or USA |
| Our screen-recording tool | Recording report walkthroughs for clients | EU or USA |
| Anthropic (Claude), our AI assistant | Helps us review what's publicly visible about your app and the scanner results you send, and draft our reply, which a person checks. Used only under terms or settings that don't let Anthropic train on this content. | USA |
Where we name a type of provider rather than a company, you can ask us which company it is. For providers outside the EU, section 7 applies.
Cloudflare also uses some Turnstile data as an independent controller, to improve its bot detection.
6.2. Stripe (Stripe Payments Europe, Ltd., Ireland, with other Stripe group companies) processes payments. It acts partly as our processor and partly as an independent controller.
6.3. Contractors. Engineers who help us deliver a service may see client contact details and project information. They are bound by confidentiality.
6.4. Authorities and advisers. We disclose data when the law requires it: for example to the tax authority (ANAF), or when a court or authority orders it. We also share it with our lawyers and accountants when needed.
6.5. Business transfer. If our business is taken over, the data would pass to the new owner, under this policy.
6.6. Search tools. We use Google Search Console and Bing Webmaster Tools to see how our pages appear in search. We send them no data about our visitors.
7. Transfers outside the EU
Some providers above are based in the US or use global networks.
- Where a provider is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023.
- Otherwise, or in addition, we rely on the Standard Contractual Clauses approved by the European Commission.
You can ask us for a copy of the relevant safeguards.
8. How long we keep it
| Data | How long |
|---|---|
| Free-check requests, call bookings and our replies, if you don't become a client | 12 months after our last contact |
| Secrets or personal data sent to us by mistake | Deleted as soon as we notice |
| Anti-spam rate-limit counter, hashed IP address | Counts over a 1-hour window; deleted automatically within about 2 hours |
| Anti-spam rate-limit counter, hashed email address | Counts over a 24-hour window; deleted automatically within about 48 hours |
| Vercel server logs | The short period Vercel sets for our plan; we don't export them |
| Web Analytics visitor hash | Discarded within 24 hours; only totals remain |
| Client contracts, correspondence and reports | 3 years after the work ends, the general limitation period for claims under Romanian law. A contract that supports an invoice is kept as long as the invoice (last row). |
| Client code copies, database structure exports and our working notes | Deleted within 30 days of final delivery (for On-call CTO and Guard: of the end of the engagement), unless you ask us in writing to keep them longer |
| Invoices and accounting records | As long as Romanian accounting and tax law requires: currently up to 10 years after the end of the financial year they belong to |
| Research consent | Until you withdraw it, or until the research it covers is published |
9. Our research study, "State of AI-built apps 2026"
9.1. What it is. We plan to publish aggregate statistics about publicly available apps built with AI tools. For example: how many send basic security headers, how fast they load on phones, and how many expose server-only keys in the browser.
9.2. What we collect. We collect only what any visitor's browser receives:
- the app's public address, taken from public showcases;
- HTTP headers;
- public HTML and JavaScript;
- speed measurements.
We send no requests to any app's database, API or login. We don't create accounts, and we never use a key we find.
9.3. Secrets. We never store a secret in full. We record only its type, a short prefix (4 to 6 characters) and a one-way hash (SHA-256). The raw downloaded files are deleted as soon as they have been processed.
9.4. Personal data. An app's address can identify its owner, for example when a sole founder runs it. If we find a serious exposure, we also keep the security or contact address we use to warn the platform or owner. We don't use it for sales.
9.5. Legal basis. Our legitimate interest in researching and publishing the state of security in AI-built apps, and in warning owners about serious exposures (Art. 6(1)(f)).
9.6. Retention.
- Raw research data is stored encrypted and deleted within 30 days after the results are published.
- Disclosure contacts are deleted when the issue is closed.
- We publish only aggregates, never a named app or a row per app.
9.7. Opting out. If you own an app and don't want it included, email . We'll exclude it and delete what we hold about it.
9.8. Free-check and client data. Data from a free check or a paid audit goes into the study only if you tick the optional research box, and then only in anonymised, aggregated form.
10. Cookies and similar technologies
10.1. By default, this website sets no cookies and stores nothing in your browser.
10.2. The Turnstile check runs a script from Cloudflare on the free-check form that reads technical browser signals. It is strictly necessary to protect the form, so it doesn't need your consent under Romanian Law 506/2004. Cloudflare says Turnstile doesn't use cookies to collect or store information.
10.3. Other sites. Stripe and Calendly set their own cookies on their own pages when you go there. Their policies apply.
10A. Google Analytics (only with your consent)
10A.1. What it is. Google Analytics 4 helps us understand how visitors use the website. It loads only after you click "Accept" in our cookie banner. It then sets cookies (_ga and _ga_<ID>), which last up to 2 years. It records the pages you visit, how you arrived, and your device, browser and approximate location. Google uses your IP address only to work out that approximate location. Google says it doesn't log or store the IP addresses of visitors in the EU, Switzerland or the UK.
10A.2. Legal basis. Your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004). "Accept" and "Reject" are equally easy to choose. If you click "Reject", Google Analytics doesn't load and sets no cookies. You can change your mind at any time through "Cookie settings" in the footer. We remember your choice in your browser's local storage (one entry, selfoia-consent), so we don't ask on every page; it holds only "granted" or "denied" and stays until you change your choice or clear your browser data.
10A.3. Provider. Google Ireland Limited, with transfers to Google LLC in the US under the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback.
10A.4. Our settings.
- Event and user data kept for 2 months, the shortest period Google offers. After that, only aggregated reports remain.
- Google signals and advertising features switched off.
- Google's optional data-sharing settings switched off.
10B. PostHog (only with your consent)
10B.1. What it is. PostHog helps us see how visitors use the website, so we can make it clearer and fix what gets in the way. It loads only after you click "Accept" in our cookie banner. It then stores a random identifier in a cookie and in your browser's local storage (names starting with ph_), which last up to 1 year. It records the pages you visit, what you click, how far you scroll, where you came from, and your device, browser and approximate location, which it works out from your IP address.
10B.2. Session recordings. PostHog can also record a visit, so we can replay how the page behaved for you: mouse movements, clicks, scrolling and what the page showed. Everything you type into a form is hidden before it leaves your browser, and so is your email address on our confirmation screen. It records only this website. We watch recordings only to find and fix problems with the website.
10B.3. What we don't do with it. We don't use PostHog to identify you, build a profile of you or show you ads, and we don't connect it to your free-check request or your email address.
10B.4. Legal basis. Your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004). "Accept" and "Reject" are equally easy to choose. If you click "Reject", PostHog doesn't load and stores nothing. You can change your mind at any time through "Cookie settings" in the footer: PostHog then stops on that page and its identifier is deleted; only a note that you said no stays in your browser. We remember your choice in your browser's local storage (one entry, selfoia-consent, holding only "granted" or "denied").
10B.5. Provider and storage. PostHog, Inc. (USA) processes this data for us on its EU Cloud, so it is stored in the EU (Frankfurt, Germany). If PostHog transfers any of it outside the EU, the Standard Contractual Clauses apply (section 7).
10B.6. How long. Events are kept for 1 year and session recordings for 30 days, then deleted.
11. Your rights
11.1. Your rights. You have the right to:
- access your data and get a copy;
- correct it;
- delete it ("right to be forgotten");
- restrict how we use it;
- receive it in a portable format, or have it sent to someone else;
- object to our use based on legitimate interests, including the research study. We then stop, unless we have compelling reasons or need the data for legal claims;
- withdraw consent at any time, without affecting what we did before.
11.2. How to ask. Write to . We reply within one month. We may extend this by two more months for complex requests, and if we do, we tell you. We may ask you to confirm your identity. Requests are free, unless they are clearly unfounded or excessive.
11.3. Some data we must keep. Some data can't be deleted straight away because the law requires us to keep it, for example invoices.
12. Children
Our website and services are not meant for anyone under 18. We don't knowingly collect their data. If you believe a child has sent us personal data, tell us and we will delete it.
13. Security
We protect personal data with measures that suit a small company and are applied consistently:
- access limited to people who need it;
- multi-factor authentication on all our accounts;
- encrypted devices and storage;
- no personal data in application logs;
- deletion on the schedule in section 8.
Our Data Processing Addendum describes how we handle client data.
14. Complaints
14.1. If you think we have mishandled your data, please tell us first, and we'll try to put it right.
14.2. You can also complain to the Romanian data protection authority:
ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania anspdcp@dataprotection.ro · +40 31 805 9211 · www.dataprotection.ro
14.3. You can also complain to the data protection authority in the EU country where you live or work.
15. Changes to this policy
When we change this policy, we update the date at the top. If a change matters, we say so on the website, and we tell our clients by email.