Privacy Policy

This policy is short because we don't do much with your data. There are no accounts, no newsletters, no analytics and no advertising on this site. The only personal data we hold is what you send us when you get in touch. Here is exactly what happens to it.

1. Who we are

Sofdio is run by WINCIRQUE S.R.L., a company registered in Romania. Whenever this policy says “we”, “us” or “Sofdio”, it means WINCIRQUE S.R.L. as the controller of your personal data:

• WINCIRQUE S.R.L., Strada Vaselor 48, Et. P, Ap. 1, Sector 2, Bucharest, Romania
• Trade registry number: J40/18470/2023
• Fiscal identification code (CUI): 48882571
• Contact: info@sofdio.com. Email is the fastest way to reach us, so we don't publish a phone number.

2. What we collect, and why

The contact form

When you use the contact form we collect your name and email address. Those two are required. Your company, a note on what the process costs you today, and your message are optional. We use all of this for one thing: replying to your inquiry and preparing a quote if the conversation continues.

The legal basis is Article 6(1)(b) of the GDPR, which covers steps taken at your request before a contract. For the odd case where we follow up on an inquiry that went quiet, we rely on our legitimate interest in running a business (Article 6(1)(f)). We don't add you to any list and we don't send follow-up marketing.

The pricing calculator

The calculator on our pricing post runs entirely in your browser. The numbers you type stay in your browser tab (session storage) so the contact form further down the page can pick them up. Nothing is sent to us until you choose to submit the form, and the stored numbers are cleared when you close the tab.

Spam protection

The form is protected by Cloudflare Turnstile, a human-verification check, plus a hidden field that bots tend to fill in. Cloudflare processes your IP address and some browser signals when you submit the form, and it acts as its own controller for that data. Their notice is here: Cloudflare Turnstile privacy notice. Submissions that look like bot traffic are thrown away without being stored.

Network, server logs and email

Like every website, ours keeps technical logs through its network and hosting providers: IP addresses and timestamps, used for security and to keep the site running. If the conversation continues over email, our own mailbox then holds a copy of what you sent and what we replied. Those emails are personal data as well, and the retention rules in section 5 apply to them.

3. What we don't do

• No analytics or tracking scripts.
• No advertising or social media pixels. The only third-party script the site loads is the Turnstile check on the contact form.
• No cookies are set by our own code, and we use no analytics, advertising or preference cookies. Our network provider, Cloudflare, may set a short-lived strictly necessary security cookie when its bot checks are active (for example __cf_bm, which expires after 30 minutes of inactivity). Because only strictly necessary cookies are involved, there is no cookie banner.
• No profiling and no automated decisions about you. We don't sell, rent or share your data with anyone for their own purposes.
• No newsletters. If that ever changes, this page changes first.

4. Who else processes your data

We use a handful of providers to run the website. They process data on our instructions, with one exception noted below:

• Vercel Inc. hosts the website and keeps its server logs.
• PlanetScale Inc. runs the database where contact form submissions are stored.
• Cloudflare, Inc. runs the network in front of the site (DNS, CDN and TLS) and provides the Turnstile human-verification check on the form. For network delivery it processes request metadata, including your IP address, on our instructions. For Turnstile it decides how it handles your data, which is why its privacy notice is linked above.
• Zoho provides the mailbox behind info@sofdio.com. Mailbox data is hosted in Zoho's EU data center.

Some of these providers are based in the United States, so some processing happens outside the European Union. Where personal data leaves the EEA or the UK, it goes to organisations certified under the EU–US Data Privacy Framework, including its UK extension, or is otherwise protected by standard contractual clauses. We keep data inside the EU wherever that option exists, and our mailbox is one example.

5. How long we keep it

• Inquiries that don't become clients. Contact form submissions and the email correspondence around them are deleted or made anonymous 12 months after our last contact with you.
• Client records. Once we work together, project correspondence, proposals and invoices are kept for up to 10 years, because Romanian accounting and tax law requires it.

6. Your rights

Under the GDPR you can ask to see the personal data we hold about you, have it corrected or deleted, restrict or object to its processing, and ask for a portable copy. Email info@sofdio.com and we'll sort it within a month.

You can also complain to a supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), and in the UK it is the Information Commissioner's Office ( ico.org.uk). We'd rather hear about a problem directly and fix it first, but the choice is yours.

7. Security

Data travels encrypted, the database is accessed with tightly scoped credentials, and only the people who need your data to reply to you can see it. If a breach ever affects your data, we'll tell you and the relevant authority without undue delay, as the law requires.

8. Changes to this policy

We may update this policy now and then. The current version, and its date, are always published on this page.

Not sure about something before you even write to us? This page and our Terms & Conditions should cover it, and info@sofdio.com answers the rest.