Privacy policy
This document explains which personal data we process through start4.ro, for what purpose, and what control you have over it. It is written to be read, not skipped.
The controller
The controller is Start4 S.R.L., [indirizzo della sede legale], [numero di registro J../..../....], tax code [CUI / codice fiscale]. For anything concerning data, write to privacy@start4.ro.
What we collect
Account data: name, e-mail, phone, password (stored as a cryptographic hash). File data: identity document details, nationality, address, capacity as shareholder or director, registered-office documents. Company data: name, tax code, activity codes, invoices, expenses, accounting documents. Usage data: IP address, time of access, pages visited, messages sent to the conversational assistant.
We do not ask for special category data (health, beliefs, union membership) and ask you not to enter it in free-text fields.
Why we process it and on what basis
Performance of the contract — creating the account, drafting and filing the company file, keeping the accounts, invoicing. Without this data the service cannot be provided.
Legal obligation — retaining accounting and tax records, reporting to authorities, anti-money-laundering checks and client identification.
Legitimate interest — platform security, abuse prevention, service improvement, notices about important changes. Consent — marketing messages and non-essential cookies; consent can be withdrawn at any time, as easily as it was given.
Who we share it with
We do not sell personal data. We share it only with the following, strictly as needed:
- Google Ireland Ltd. (Firebase) — hosting, database and authentication (EU)
- Anthropic PBC — the Nexo AI conversational assistant (US, standard contractual clauses)
- Trade Registry and ANAF — filing of company files and tax returns, as required by law
- The electronic signature provider — issuing the digital certificate, if you request one
Each provider processes the data under a contract and only on our instructions.
Transfers outside the European Union
The conversational assistant is supplied by a US provider. The transfer relies on the standard contractual clauses approved by the European Commission. We suggest you do not type data into the chat that you would rather not send outside the EU — the assistant does not need it to answer you.
How long we keep it
Accounting and formation records are kept for the period the law requires, generally 10 years from the end of the financial year. Account data is kept while the account is active and for 30 days after closure, except what must be retained by law. Assistant conversations are kept for no more than 12 months.
Your rights
You have the right of access, rectification, erasure, restriction of processing, objection and portability. You can withdraw consent at any time, without affecting processing carried out beforehand.
Write to privacy@start4.ro and we will reply within 30 days. If you are not satisfied you may complain to the Romanian supervisory authority (ANSPDCP, Bd. Gheorghe Magheru 28-30, Bucharest) or to the authority in your country of residence.
Security
Data travels encrypted, internal access is limited to those who need it, and passwords are never stored in the clear. No system is invulnerable: if a breach occurs that may affect your rights, we will tell you and notify the authority within the legal deadlines.
Cookies and local storage
We use four categories, of which only the first works without your consent:
Strictly necessary — the sign-in session, the chosen language, the chosen theme, and the record of your cookie choices. Without them the platform does not work.
Preferences — small settings that keep the interface as you left it.
Statistics — anonymous traffic measurement, so we know which pages are useful.
Marketing — campaign measurement. We do not switch these on unless you accept them.
You can change your choice at any time from or by clearing the site data in your browser.
Minors
The platform is for adults. We do not knowingly collect data from minors; if we learn that we have, we delete it.
Changes
When we amend this document we update the date shown above and, if the change is significant, we tell you by e-mail or in the platform.