Privacy Policy

The short honest version: we run this site on as little personal data as possible, because that’s the same discipline we sell.

1. Controller

The controller is Leonard Irimia. Disclosura is operated by Leonard Irimia, a private individual, as a pre-registration project. Responsible for content and GDPR controller: Leonard Irimia. Data-protection contact: contact@disclosura.eu. Telephone: +40758382337 — a voicemail line, not a live desk: leave your message and we answer by email, within 2 business days. If you have no internet access, say so in the message and we reply by post or phone. The operating company will be registered after the first sales. Its full details (legal entity, registered address, registration number, VAT ID) will be published on this page, with a changelog entry, when that happens.

2. What we collect and why (GDPR Art. 6(1) bases in brackets)

Analytics — none. This site currently loads no analytics or tracking script at all, and sets no cookies of any kind. That is why you see no cookie banner. If we later add a cookieless, EU-hosted counter, the changelog will say so before it happens.
The free check. Your 8 answers are processed in your browser (localStorage) and are not sent to our servers. The kit page reads them from your browser and asks you to run the check again if they are missing. They reach us only if you ask for your result by email or for the sample PDF; then they travel with that request to personalize what you receive [contract]. A “delete my answers” button exists on the check page.
Email. Optional (waitlist, free result PDF); required for Kit delivery [contract]. Marketing emails only with your explicit opt-in [consent], one-click unsubscribe. Every form and every email — the waitlist, your check result, the Kit delivery email with your personal link — is processed and sent by our own server (Hostinger), from contact@disclosura.eu; no third-party form, newsletter or email service.
Payments. Handled by Stripe (through Link) as merchant of record; we never see card numbers. After payment, Stripe sends our server your email address, the amount and currency, your country and the checkout language, which we use to deliver the Kit and keep the order record [contract; legitimate interest — the invoice is issued by Stripe/Link]. Stripe acts per its own terms.
Support. Email to contact@disclosura.eu is read and, where it is on-script, answered first by our AI support agent (an automated system built on Claude by Anthropic). Every agent-written email says so in its first line; reply “HUMAN” at any time and Leonard Irimia reads your message personally. The agent may grant refunds; it never refuses one on its own — a person confirms every refusal. To draft replies, the text of your email is processed by Anthropic PBC (USA) as our processor under its Data Processing Addendum with EU Standard Contractual Clauses; Anthropic deletes API inputs and outputs within 30 days and does not use them to train models. [contract for buyers; legitimate interest for pre-sale questions]
Widget. The widget serves a static script and does not track your visitors, set cookies, or collect their personal data. Our host keeps standard web-server access logs under its own retention policy, for capacity and abuse prevention [legitimate interest]. Since widget 1.2.0 the widget also sends, each time the notice is rendered, one request to our server containing only the customer site’s hostname, the page path (query string removed), the language shown and the widget version — no cookie, no IP address, no user agent and nothing that identifies the visitor. We keep it so the site operator can download a dated “record of display” from their kit page; it is switched off with data-log="off" on the script tag [legitimate interest of the operator in a technical log].

3. Retention

Support emails and their replies: 24 months after the last contact, then deleted. Order records (payment confirmation from Stripe, delivery log, refund log): 10 years (Italian Civil Code art. 2220 — the longer of the Italian and Romanian periods). Marketing emails, and the stored duty profile where you asked for your result: until unsubscribe or deletion request. Check answers in your browser: until you clear them.

4. Your rights

Access, rectification, erasure, portability, objection, and complaint to your supervisory authority. Write to contact@disclosura.eu; we answer within 30 days.

5. Processors

Stripe / Link (payments, as merchant of record) and Hostinger (hosting, email, the forms and Kit delivery — all on our own server), and Anthropic PBC (USA — drafts support replies under its Data Processing Addendum with EU Standard Contractual Clauses; deletes inputs and outputs within 30 days), each under their GDPR data-processing terms. No other processor.

6. Our promises

No sale of data. No advertising trackers. No dark patterns. If we ever add a processor, the changelog will say so before it happens.