Privacy Policy

1. Introduction

This Privacy Policy explains how PONTIO S.R.L. ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the Pontio website, the Pontio mobile application, and related services (collectively, the "Service").

Pontio is a service marketplace that connects consumers ("Consumers") with service providers ("Providers"). The mobile app uses the identifiers app.pontio on Android and app.pontio.Pontio on iOS. Pontio is currently in pre-launch, and public bookings are not yet available.

This Privacy Policy is an information notice about how we process personal data when you use Pontio. Where a specific feature relies on your consent, we will ask for that consent separately.

2. Definitions

For the purposes of this Privacy Policy:

• "Personal data" means any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, as defined in Art. 4(2) GDPR.
• "Controller" means the entity that determines the purposes and means of the processing (Art. 4(7) GDPR).
• "Processor" means an entity that processes personal data on behalf of a controller (Art. 4(8) GDPR).
• "Sub-processor" means a third party engaged by a processor or controller to carry out specific processing on the controller's behalf.
• "Independent controller" means a third party that determines the purposes and means of processing independently, even when receiving personal data through our integration.
• "Data subject" means the identified or identifiable natural person to whom personal data relates — in the context of the Service, typically a Consumer, a Provider, or a website visitor.
• "Service" has the meaning given in Section 1 above.
• "ANSPDCP" means the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, Romania's supervisory authority for data protection.

3. Data Controller

The data controller responsible for your personal data is:

4. Data We Collect

We collect only the data necessary to operate the marketplace and fulfill our obligations to you.

The table below describes general account and marketplace data. Provider pre-registration before launch has its own data categories in Section 12 and retention criteria in Section 13.

5. Data We Do NOT Collect

We want to be transparent about data we explicitly do not access or store in the mobile app:

• Precise GPS location (we do not request location permissions)
• Camera access or unselected photos (the mobile app uses the OS photo picker)
• Usage statistics or crash reports, unless you opt in (see Section 4; collection is off by default and can be switched off at any time in Settings)
• Advertising identifiers (Apple's IDFA or Android's advertising ID)
• Contact list, call logs, or SMS
• Biometric data (facial, fingerprint, voice, or similar)
• Health, political, religious, or other special-category data under Art. 9 GDPR

6. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b) GDPR) — Processing necessary to provide the Service: account creation, steps you request to prepare a provider profile before launch, booking management, payment facilitation, push notifications for booking updates.
• Legitimate interest (Art. 6(1)(f) GDPR) — Marketplace integrity: fraud prevention, review authenticity, platform security (Firebase App Check attestation — which uses Google reCAPTCHA on the Pontio web application — and Cloudflare Turnstile), pre-launch marketing-attribution measurement. Our legitimate interests do not override your fundamental rights; you have the right to object on grounds relating to your particular situation (see Section 18).
• Legal obligation (Art. 6(1)(c) GDPR) — Retention of booking and payment records for tax and accounting obligations after account deletion, and compliance with lawful requests from competent authorities.
• Consent (Art. 6(1)(a) GDPR) — Optional processing such as social login via Google or Apple, usage statistics and crash reports in the mobile app, joining the pre-launch waitlist, and optional provider launch news and tips. Acknowledging this notice is not consent to marketing. Where you give consent, you may withdraw it at any time (see Section 18).

Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 implementing GDPR, and Romanian Law no. 506/2004 on electronic communications privacy. Retention of accounting and fiscal records is carried out in accordance with Romanian Accounting Law no. 82/1991.

7. Third-Party Services (Sub-processors)

We share data with the following third-party services that act as our sub-processors to operate the platform:

Google services (Firebase and reCAPTCHA) are governed by Google's data processing terms; Google's use of reCAPTCHA is additionally governed by the Google Privacy Policy and Google Terms of Service. Cloudflare is governed by its standard data processing addendum. Resend publishes its data processing addendum. MeiliSearch is self-hosted and data does not leave our infrastructure. A copy of the relevant transfer safeguards (for example, the applicable Standard Contractual Clauses) can be requested by contacting us at [email protected].

8. Independent Controllers

The following services act as independent data controllers (not sub-processors) for the personal data they receive through our integrations. Their processing is governed by their own privacy policies, which you should review:

• Stripe — processes payment card data and billing information for card payments. Stripe acts as an independent controller for payment data it processes.
• Stripe Connect — processes bank account, tax identifier, and KYC documents for Provider payouts.
• Google Sign-In (Google) — email, name, avatar URL for social login.
• Apple Sign-In (Apple) — email (optionally via Apple's private-relay address) and name, for social login in the iOS app.

9. Sharing Between Consumers and Providers

When a Consumer and a Provider interact through the Service (for example, by initiating a Booking), certain data is shared between them to allow the service to be delivered:

• From the Consumer to the Provider: display name, profile photo (if any), the details of the service requested, the service address (including any access notes), scheduling information and any notes the Consumer adds to the Booking request, and any questions the Consumer asks about the service.
• From the Provider to the Consumer: display name, profile photo (if any), service description and pricing, the Provider's publicly available ratings and reviews, answers to the Consumer's questions and, once a Booking is confirmed, the Provider's phone number and business address.
• Payment data is not shared between Consumers and Providers. Payments are handled by Stripe as an independent controller.
• After a Booking is completed, each party may leave a review of the other. Reviews are subject to the moderation and authenticity rules in our Terms of Service.

Consumers and Providers are each independent controllers for the personal data they learn about the other party through the Service and must use that data only for the purpose of the Booking, unless a separate lawful basis applies.

10. Questions and Booking Notes

The Service does not currently include an in-app chat. Consumers can ask a Provider a question about a service and add notes to a Booking request. The following applies to that text:

• Questions, answers and booking notes are stored on our infrastructure (Firebase Firestore). Booking notes are accessible to the Consumer and the Provider of that Booking. A question and its answer may be shown on the service page, where other signed-in users can see them together with the name of the Consumer who asked. We do not routinely read this text.
• We may access, review, or moderate this text where we reasonably believe this is necessary to prevent fraud or abuse; to comply with a legal obligation or a lawful request from competent authorities; to respond to a user report; or to enforce our Terms of Service.
• This text is retained according to the rules in Section 13.
• Sharing personal contact information, payment details, or other data off-platform in order to circumvent the Service is prohibited under our Terms of Service and may result in account measures.

11. Cookies, localStorage, and Similar Technologies

We use a small, limited set of browser storage technologies on the Pontio website. We do not use advertising cookies such as Google Analytics or Meta Pixel.

The Pontio web application — a separate surface from this website, used for provider sign-up and account features (for example at join.pontio.app) — uses one additional third-party technology, described below, that does not run on this website.

• Cloudflare Web Analytics — a privacy-preserving measurement tool. It sets no cookies, stores no identifiers on your device, does not fingerprint you, and does not track you across sites; we see only aggregate statistics (page views, referrers, countries). Legal basis: legitimate interest (Art. 6(1)(f) GDPR); because it stores nothing on your device, no ePrivacy consent is required.
• Cloudflare Turnstile — Turnstile is a bot-protection challenge that may set short-lived cookies in your browser to verify that your waitlist submission is not made by an automated bot. Turnstile is considered strictly necessary for the security of the Service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); corresponding ePrivacy basis: "strictly necessary" under Romanian Law no. 506/2004.
• Language preference cookie (lang) — when you select a site language, we set a lang cookie for up to one year so the correct locale loads on return visits. Strictly necessary for the site's bilingual function.
• Attribution localStorage (__pontio_waitlist_attribution_v1) — if you arrive at pontio.app through a marketing link that contains UTM parameters or a referral code, we store those parameters in your browser's localStorage. When you submit the waitlist form, we attach them to your submission so we can measure which marketing channels convert. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — measuring pre-launch channel performance. You can clear this at any time through your browser's site-data controls.
• Google reCAPTCHA (Pontio web application only) — the Pontio web application uses Google reCAPTCHA Enterprise to verify that requests come from a genuine browser (this powers Firebase App Check on that application), and Google reCAPTCHA when you sign in with a phone number, to confirm the request is not automated. reCAPTCHA examines signals from your browser and device and may set cookies to do this. It runs on the Pontio web application, not on this website, which uses Cloudflare Turnstile only. See the Google Privacy Policy and Google Terms of Service referenced in Section 7 for how Google uses this data. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); corresponding ePrivacy basis: "strictly necessary" under Romanian Law no. 506/2004.

If we introduce additional third-party analytics or advertising technologies in the future, we will update this section, provide an appropriate consent mechanism where required by law, and give you the ability to manage your preferences.

12. Website, Waitlist, and Provider Pre-registration Processing

When you visit pontio.app or submit the waitlist form, we process a limited set of data specifically for the pre-launch phase:

• Waitlist email address — collected to notify you when bookings open. Legal basis: consent (Art. 6(1)(a) GDPR). Stored in Cloudflare D1 (EU region). Deleted on request to [email protected].
• Attribution parameters — as described in Section 11 above.
• Turnstile token — bot-protection token verified server-side against Cloudflare before a waitlist submission is accepted.
• IP address — transiently observed by Cloudflare during form submission for fraud prevention; not stored in our waitlist database.

Provider pre-registration before launch

On the separate Pontio web application, a provider can start a draft and submit it for review before bookings open. We process the name and email address; service names, descriptions, categories, indicative prices and selected photos; service coverage (Bucharest sectors or Ilfov localities); weekly availability; and records of the Terms acceptance, final declarations and optional marketing choice. We use these details to save and review the draft, prepare the provider's profile and services for launch, and contact the provider about their registration. The requested profile preparation and related account processing rely on steps taken at the provider's request before entering a contract (Art. 6(1)(b) GDPR).

Firebase Authentication handles the account; Firebase Firestore stores the profile, services, availability and declaration records; Firebase Storage stores selected photos. Cloudflare Workers hosts the web application. Google reCAPTCHA and Firebase App Check process browser and security signals to protect registration under our legitimate interest in platform security (Art. 6(1)(f) GDPR). For unfinished drafts, Resend receives the recipient email address and transactional recovery link so the provider can resume. We do not collect bank details, payment data or identity documents in this pre-registration flow.

A submitted profile remains private and pending until it has been reviewed and launch activation is enabled. It does not appear to customers during pre-registration. The separate optional marketing choice covers launch news and tips under consent (Art. 6(1)(a) GDPR); it does not affect messages needed about the registration. Accepting the Terms or acknowledging this notice does not grant marketing consent.

13. Data Retention

• Provider pre-registration before launch — We keep pre-registration data while it is needed to review the registration and prepare the profile for launch. If you withdraw your request or the data is no longer needed for these purposes, we delete it. You can request deletion at [email protected]. Only information strictly necessary to meet a legal obligation or resolve a complaint may be kept separately, with restricted access, under the applicable legal basis.
• Active accounts — All profile data retained while the account is active.
• After account deletion — Your sign-in account is deleted immediately, and the deletion of your profile, consumer/provider records, notification tokens, notifications, waitlist entries, questions about services, quote requests, published services and availability (for Providers), and your uploaded photos and documents starts at the same time. If a step fails, it is retried automatically.
• Legal retention — Bookings, payments, and reviews are retained for tax, accounting, and legal obligations for up to 10 years in accordance with Romanian Accounting Law no. 82/1991 and related compliance requirements. These records keep an internal account identifier so they remain consistent for audit, which means they are pseudonymised rather than anonymous. About 7 days after account deletion, your name on them is replaced with "Deleted user" and your email address, phone number and profile photo are removed. The service address and the notes you wrote on a Booking are removed once the Booking is completed, cancelled, declined or expired, and in any case no later than about 30 days after account deletion. Review text is kept, shown under "Deleted user".
• Questions and booking notes — questions about a service, and their answers, are kept until the account of the Consumer or the Provider involved is deleted. Booking notes are kept with the Booking and removed as described in the Legal retention item above.
• Waitlist — waitlist emails are retained until you ask us to unsubscribe you or until we notify you of launch and you no longer wish to receive communications.
• Security logs — operational security logs are retained for up to 12 months.

14. Security Measures

We implement the following measures to protect your data:

• All network traffic is encrypted via TLS 1.2+.
• Firebase App Check attestation on every API call (Play Integrity on Android, AppAttest on iOS).
• Firestore security rules enforce per-user ownership on all collections.
• Firebase Storage rules enforce per-user path isolation with file size and type limits.
• Payment secrets are stored only in Firebase Functions Secret Manager (never on-device).
• Local session data is excluded from Android auto-backup and device-to-device transfer.
• Administrative access to production systems requires multi-factor authentication.
• Access to personal data is limited to personnel who need it to operate the Service.

15. Security Incident Procedure

We maintain procedures to detect, investigate, and respond to security incidents affecting personal data. In line with Art. 33 and Art. 34 GDPR:

• Where a personal-data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify ANSPDCP without undue delay and, where feasible, within 72 hours after becoming aware of the breach.
• Where a personal-data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the breach to the affected data subjects without undue delay, in clear and plain language, describing the nature of the breach, the likely consequences, and the measures taken or proposed to address it.
• Communications about breaches will include a point of contact, including our email address [email protected].
• We maintain an internal register of all personal-data breaches, including their facts, effects, and remedial action taken, in line with Art. 33(5) GDPR.

16. Account Deletion

You can delete your account at any time from Settings → "Delete my account" within the app.

• Confirmation: Requires typing "DELETE" to confirm (double-confirmation). If you have not signed in recently, you will be asked to sign in again first.
• Timing: Your account is deleted immediately — there is no cooling-off period, and it cannot be recovered. Removal of the associated data starts at the same time, and pseudonymisation of the records we must keep follows on the schedule in Section 13.
• What is removed: User profile, consumer/provider record, notification tokens and device IDs, notifications, waitlist entries, questions about services, quote requests, published services and availability (for Providers), uploaded photos and documents, and the Stripe Connect account (deleted, or disabled if it still holds a balance).
• What is retained: Bookings, payments, and reviews — for legal, tax, accounting, and dispute-handling obligations. About 7 days after deletion your name on them is replaced with "Deleted user" and your email address, phone number and profile photo are removed; see Section 13 for the details.
• Bookings: If a Provider deletes their account, their active Bookings are cancelled, any payment is refunded and the Consumers are notified. If a Consumer deletes their account, their existing Bookings are not cancelled automatically.

17. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — You can view your data in-app via the profile screen.
• Right to rectification — You can edit your data in-app via profile edit.
• Right to erasure — You can delete your account from Settings → Delete Account.
• Right to data portability — Not yet available as a self-service feature. Manual requests can be made via [email protected].
• Right to withdraw consent — Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where technically available, you can withdraw consent through the same in-app setting or feature used to give it; alternatively, you may contact us at [email protected].
• Right to object — Where we process your personal data on the basis of our legitimate interests under Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims. To exercise this right, contact us at [email protected].
• Right to restriction of processing — Contact us at [email protected].
• Right not to be subject to automated decisions (Art. 22 GDPR) — see Section 19 below.
• Right to lodge a complaint — You may lodge a complaint with your local supervisory authority. For Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) at www.dataprotection.ro.

18. How We Handle Your Rights Requests

In line with Art. 12(3) GDPR, we will respond to requests to exercise your rights without undue delay and in any event within one month of receiving the request. That period may be extended by up to two further months where necessary, taking into account the complexity and number of the requests. Where we extend the period, we will inform you within the first month of receipt, together with the reasons for the delay.

We may request specific information from you to confirm your identity before responding to a request, in order to prevent unauthorized disclosure of personal data. If we refuse to act on a request, we will inform you without delay and at the latest within one month of receipt, including the reasons for not acting and the possibility of lodging a complaint with ANSPDCP or seeking a judicial remedy.

Communications and actions taken under Articles 15 to 22 GDPR are provided free of charge, save where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request, in accordance with Art. 12(5) GDPR.

19. Automated Decision-Making and Profiling

We do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22 GDPR. In particular, decisions such as suspending an account, removing Content, or limiting access to a feature are reviewed by humans before they take effect or are subject to human review on appeal.

We may use limited profiling for operational purposes — for example, displaying Providers in a ranked order in search results, flagging suspicious activity for human review, or prioritizing which messages are surfaced in the app. Such profiling does not, on its own, produce legal or similarly significant effects on you. Where applicable, we describe the main parameters of ranking in our Terms of Service.

20. Marketing Communications and Opt-Out

We do not currently run a marketing programme beyond sending waitlist-related updates to the email address you provided when joining the waitlist. These updates are about the Pontio launch, major product milestones, and ways to help us test the Service.

• Opt-out: Every waitlist-related email contains an unsubscribe link. You may also unsubscribe at any time by contacting [email protected].
• Right to object to direct marketing: Under Art. 21(2) GDPR, you have an absolute right to object at any time to the processing of your personal data for direct-marketing purposes.
• Transactional communications: Certain communications are necessary for the performance of these Terms (for example, booking confirmations, security alerts, legal notices) and cannot be opted out of while you have an active account.

21. Children's Privacy

Pontio is not intended for children. Where processing is based on consent in connection with information society services offered directly to a child, such processing is lawful only if the child is at least 16 years old, or if consent is given or authorised by the holder of parental responsibility as required by applicable law. When you register with an email address in the mobile app, you are asked to confirm that you are at least 16 years old. If we learn that personal data has been collected in breach of this rule, we will delete it without undue delay.

22. International Data Transfers

Where personal data is transferred outside the EEA, we rely on a lawful transfer mechanism under Chapter V GDPR, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or the EU-US Data Privacy Framework, as applicable to the relevant recipient:

• Google (Firebase, reCAPTCHA) — transfers are covered by the EU-US Data Privacy Framework, where Google LLC is certified.
• Stripe — transfers are covered by the EU-US Data Privacy Framework, where Stripe is certified, supplemented by Standard Contractual Clauses as applicable.
• Cloudflare — where we use Cloudflare's EU data locality features, data is processed within the EU. Where transfers outside the EEA are necessary, they are covered by Standard Contractual Clauses.
• Apple — where used for social login, Apple acts as an independent controller under its own transfer safeguards.

You may request information about the safeguard used for a specific transfer, and a copy of the relevant safeguard where available, by contacting us at [email protected].

23. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the app and updating the "Last updated" date at the top of this page. Where a change materially affects your rights, we will provide advance notice by email where we have your contact details or by prominent in-app notification. The updated policy will apply from its stated effective date.

24. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: