Privacy Policy

The privacy of your data is a priority. This document explains what personal data we process in connection with the toolfluxapp.com website, for what purposes, on what legal basis, and what rights you have under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

This policy covers the toolfluxapp.com website — the pages you are reading, the contact form and the digital assistant. The ToolFlux mobile application processes different data, for different purposes, and has its own policy: toolfluxapp.com/privacy.

1. The data controller

MORNINGSTAR SOFTWARE S.R.L., a company registered in Romania, tax code (CUI) 55437739, Trade Register no. J2026050102002, registered with the Oficiul Registrului Comerțului de pe lângă Tribunalul Vaslui. Data protection contact: support@toolfluxapp.com.

2. What data we collect

• Contact details: first name, surname, e-mail, phone and the message you send, when you complete the contact form or request a quote. If you only leave an e-mail address, that is all we hold, plus whether you asked for launch news.
• Conversations with the digital assistant: the message you send, together with the earlier messages in that conversation, is transmitted to our server so the assistant can answer, and from there to Google Gemini, which generates the reply. A copy is also kept in your browser (localStorage) so the conversation survives a page refresh. Please do not enter personal data about your staff into the assistant.
• Technical data: IP address, browser type, server logs — strictly for the security and operation of the site.
• Preferences: your chosen theme, language and cookie options (localStorage).

We do not collect special categories of data and we do not address minors.

3. Legal basis and purposes

• Performance of a contract / pre-contractual steps (art. 6(1)(b)): to respond to enquiries and quote requests.
• Legitimate interest (art. 6(1)(f)): the security and proper functioning of the site, and preventing abuse.
• Consent (art. 6(1)(a)): for the launch-news e-mails, and only if you tick that box. It is a separate choice from sending us your address — the form works exactly the same when you leave it alone — and you can withdraw it at any time from the unsubscribe link in any message, or by writing to us. The same basis covers any analytics tool, enabled only with your agreement.
• Legal obligation (art. 6(1)(c)): where the law requires it (e.g. tax obligations, on contracting).

4. Who we disclose data to (processors)

We use suppliers who process data on our behalf, under confidentiality obligations and in accordance with the GDPR:

• Google (Firebase / Google Cloud): hosting, database and authentication. The database and the server functions are both in europe-west4 (Netherlands), since 10 September 2026.
• Google (Gemini API): generates the digital assistant’s replies, from the text of your conversation.
• Zoho: delivers the e-mail notification raised by the contact form.

We do not sell your data. We disclose it to authorities only where the law requires it.

5. International transfers

Data is stored and processed in the European Union: both the database and the server functions that receive contact-form submissions and assistant messages are in europe-west4 (Netherlands). The functions moved there on 10 September 2026; before that they ran in the United States.

One exception remains. The digital assistant’s replies are generated by the Google Gemini API, which is not EU-pinned, so the text of that conversation does leave the EEA in transit. That transfer relies on the safeguards provided by the GDPR (standard contractual clauses and the EU–US Data Privacy Framework, to which Google LLC is certified).

6. How long we keep data

• Contact form data: 12 months from the date of the enquiry, or longer where a legal obligation requires it.
• Technical logs: short periods, typical for security purposes.
• Assistant conversations: the copy in your browser stays until you clear it. The copy sent to the server is kept only for as long as the request is being answered.

6a. Whether you have to give us this data

Nothing here is collected by law. The contact form needs your name, e-mail and message so that we can reply — without them we cannot, and that is the only consequence. Company and phone are optional. Everything else is stored by your browser to make the site work, and you can clear it at any time.

6b. Automated decisions and profiling

We do not make automated decisions producing legal or similarly significant effects, and we do not profile you. The digital assistant generates text and nothing more — it decides nothing about you, and its answers do not affect whether or how we deal with you.

6c. Data protection officer

We have not appointed a data protection officer. Our processing does not meet the thresholds in art. 37 GDPR that would require one. Any question about data protection reaches us at the address in section 10, and we answer it ourselves.

7. Your rights

Under the GDPR, you have the right to:

• be informed and to access your data;
• rectification (correction);
• erasure (“the right to be forgotten”);
• restriction of processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting processing already carried out.

You can exercise them by writing to support@toolfluxapp.com. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.

8. Cookies

Details of the storage we use and how to control it are in our Cookie Policy.

9. Security

We apply reasonable technical and organisational measures (encryption in transit and at rest, access control) to protect data against unauthorised access, loss or disclosure.

10. Changes

We may update this policy. The current version is marked by the date above.