Privacy policy

VITESTRA S.R.L., tax ID (CUI) 52368278, Trade Register no. J2025062985003, Romania. General contact: contact@vitestra.com. For any question or request about your personal data: gdpr@vitestra.com.

This policy covers what we do with personal data as a controller: when you visit vitestra.com, when you write to us, when we work with your company, and when you use Finu.

Data our clients process using Vitestra: for example, the WhatsApp messages you send a business that runs a Vitestra agent. That business decides how your data is used; we process it only on its behalf, under a data processing agreement. Its own privacy policy applies, and the assistant links to it in its first message. If you contact us about that data, we pass your request on and help the business answer it.

• When you visit the site: IP address, browser type, the page requested and the time, in our hosting provider's technical logs. We use them to serve the site and protect it from abuse. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• When you write to us: your email address, your name and whatever you choose to tell us. We use them to reply and, if you want, to discuss working together. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)), or our legitimate interest in replying (6(1)(f)).
• When we work together: your company's contact people and billing details. Legal basis: performing the contract (6(1)(b)) and our tax and accounting obligations (6(1)(c)).

We make no automated decisions that affect you, and we don't use your data for advertising.

For a firm's account on Finu, and for the messages people interested in Finu send to the Finu number (+40 751 366 519), we are the controller. For the data of a firm's customers (the conversations on the firm's number, requests, the customer list), the firm is the controller; we process it only on the firm's behalf, under the data processing agreement made with the firm, and the firm's own policy applies.

• The firm's account: the firm's name and its address <firm>.finu.ro, the name, phone number and role of the owner and of the team, and sign-in by SMS code. Legal basis: performing the contract (Art. 6(1)(b) GDPR).
• Messages to the Finu number: your phone number and what you write. We use them to reply and to help you sign your firm up. Legal basis: steps taken at your request before a contract (6(1)(b)), or our legitimate interest in replying (6(1)(f)).
• Connecting the firm's WhatsApp: the identifiers of the WhatsApp Business account and of the number, and the access key Meta issues, stored encrypted. We use it only so the firm's assistant can send and receive messages on the firm's number.

Our central part keeps phone numbers only as a cryptographic fingerprint, enough to route each message to the right firm; messages pass through it without being stored.

Each firm's data is on its own dedicated computer, in Germany (Hetzner). The central part runs on AWS in Frankfurt. finu.ro is hosted by Vercel (United States), sign-in is provided by Clerk (United States), WhatsApp by WhatsApp Ireland (Meta), and the language model is reached through OpenRouter (United States), with Google, without the content being kept; Cloudflare carries the traffic to the firm's computer. Transfers outside the EU rely on the EU-US Data Privacy Framework (DPF) or standard contractual clauses.

For as long as the firm uses Finu. When the owner closes the firm, the data stays for 30 days so the firm can change its mind, then it is permanently deleted, backups included; the disk's technical copies are gone within 7 days after that. Messages from people interested in Finu who do not sign their firm up: at most 90 days after the last message; backups keep them for at most 14 more days. If you sent STOP, we keep only your number, so we don't write to you again.

The owner closes the firm under Settings → Closing the firm. Any other request (a team member, someone who wrote to the Finu number) goes to gdpr@vitestra.com. Details are on the Data deletion page, linked in the site's footer.

The Finu app for Android and iOS is used by the team members of firms that use the Finu platform. Through the app we process the following data, as a processor for the firm you work for, or as the controller for your user account:

• Your phone number and name, to sign you in and recognise you as a member of the firm's team. Your sign-in code is sent to you by SMS by our authentication provider.
• The notification token and a random installation identifier, generated by your phone and by the system's notification service (Google Firebase Cloud Messaging on Android, Apple Push Notification service on iOS). We use them, together with the app version, only to send you notifications about your firm (for example, a request awaiting your decision). When you sign out, the installation is removed from the list of those that receive notifications.
• The content you write in the app (messages, decisions, changes to records), which belongs to the firm you work for and is kept in its account.

The app contains no ads, uses no analytics or tracking tools, and does not read your phone's location, contacts, photos or files. Data is sent encrypted (HTTPS).

You can turn notifications off at any time in your phone's settings. To delete your account and the data associated with it, follow the steps at https://finu.ro/stergere-cont or write to us at contact@vitestra.com.

This site uses no cookies, analytics, advertising pixels or other tracking. Fonts are served from our own domain, not by a third party.

• Site hosting: Vercel Inc. (United States).
• Email: our email provider, with data centres in the EU.
• Our accountant and public authorities, only where the law requires it.

We never sell or rent data. Vercel Inc. is certified under the EU-US Data Privacy Framework and processes the site's access logs (IP address and technical request data).

• Site logs: the short period set by our hosting provider.
• Correspondence: for as long as the conversation lasts, and at most three years after the last message, the general limitation period.
• Contracts, invoices and other accounting records (including a personal identification number, where an invoice carries one): as long as tax and accounting law requires.

You can ask for access to your data, its correction, erasure, restriction or portability, and you can object to processing based on our legitimate interest. Write to gdpr@vitestra.com; we reply within one month. You can also complain to Romania's data protection authority, ANSPDCP (www.dataprotection.ro).

The site is served over HTTPS only, and access to our email and infrastructure is limited to the Vitestra team.

When this policy changes, we publish the new version here with the date it takes effect.