Platform privacy policy

For registered users (Client / Publisher), version updated: 27 July 2026

This English version is provided for convenience. In case of any discrepancy, the Romanian version prevails.

1. The controller and the DPO

2. Scope

This policy covers the processing of the personal data of users with an active account on the Platform, regardless of the assigned role (Client or Publisher), from the moment of registration and throughout the use of our services.

3. Data processed

3.1 Account identification data

• Email, password (stored as a bcrypt hash, never in clear text).
• First name, last name or trade name (a pseudonym is accepted for journalists/bloggers).
• Phone number (optional, for critical notifications).
• Encrypted 2FA token (if you enable two-factor authentication).

3.2 Invoicing data

• Company name, tax ID, Trade Register number.
• Registered office address (street, city, county/sector, postal code, country).
• VAT number (RO, or non-RO EU validated through VIES).
• IBAN for issuing invoices and refunding amounts.
• Additional data required by ANAF e-Invoice (the sector for Bucharest, etc.).

3.3 Transactional data

• Order history: target publication, date, amount, status, associated payment.
• Wallet transactions: top-ups, deductions, refunds.
• Card payments: only the payment token issued by the processor (Netopia Payments or LibraPay); we do NOT store card numbers or CVV.
• Card saved for subscriptions (card on file): the recurring charging token issued by the processor, plus the card brand, the last 4 digits and the expiry date, exclusively for the automatic renewal of active subscriptions. The full card data stays with the processor.
• Invoices issued: number, date, amount, invoiced items (kept 10 years according to art. 25 of the Fiscal Code).

3.4 Content data

• Articles uploaded manually or through the AI Article Generator.
• Images, Word documents, PDFs associated with orders.
• Briefs for AI (prompts, keywords).
• Messages exchanged through the platform chat (between Client and Admin or Client and Publisher).

3.5 Usage data

• Login logs (IP, User-Agent, timestamp, status).
• Actions in the panel (visiting publications, filtering the catalog, placing an order).
• Interface preferences (language, display mode).

3.6 Publisher data (in addition)

For users with the Publisher role, we additionally process:

• The list of registered publications (URL, categories, prices, offers).
• Publication metrics (Domain Authority, Ahrefs traffic, indexing).
• Payment requests with amount, date, own invoice issued.

3.7 Data from Google Search Console (optional, only at your request)

If you choose to connect a project to Google Search Console (the "Connect with Google" button on the project page), the platform receives from Google, through the official Search Console API, with read-only rights (scope webmasters.readonly):

• The list of Search Console properties your Google account has access to, used only to pick the one belonging to the project.
• The Google Search performance data of the chosen website: clicks, impressions, CTR and average position, by day, by query and by page.
• The email address of the Google account used for the connection, so that we can show you which account the link was made with.
• The access key issued by Google (refresh token), stored encrypted and used only to read the data above.

We use this data exclusively to show you, in your account, the evolution of your Google traffic and recommendations for your own website. We do not use it for advertising, we do not sell it and we do not pass it on to third parties; human access to it is limited to the assistance you request and to troubleshooting. You can stop the connection at any time from the project page ("Disconnect"): we revoke the key with Google and immediately delete the imported data. You can also revoke access from your Google account (myaccount.google.com/permissions). The use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. PSK Intelligence's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes of processing

5. Legal basis (GDPR)

6. Recipients and processors

Your data is accessed by the following categories of recipients:

6.1 Processors (under a data processing agreement, DPA)

• Hostriver SRL (Romania), cPanel/LiteSpeed hosting.
• CloudFlare Inc. (USA, under SCC + Data Privacy Framework), CDN, DDoS protection.
• SmartBill / FacturaServer (Romania), issuing invoices compliant with tax legislation.
• ANAF (Romania), e-Invoice transmission according to Government Emergency Ordinance 120/2021.
• Netopia Payments (Romania), bank card payment processing; for subscriptions it stores the card (card on file) and issues the recurring charging token.
• LibraPay / Libra Internet Bank (Romania), bank card payment processing.
• Anthropic PBC (USA, under SCC), AI Article Generator (Claude model).
• OpenAI LLC (USA, under SCC), AI Title Generator (GPT model).
• Google LLC (USA, under SCC + Data Privacy Framework), anonymous Analytics statistics, if you accept cookies; Search Console API, the performance data of your website, only if you connected the project (3.7).
• Sendgrid / Resend (USA / EU), sending transactional emails.
• Ahrefs Inc. (Singapore), Domain Authority metrics for publications.

6.2 Recipients (on the basis of a legal obligation)

• ANAF, for invoices and tax reporting (D394, D300, e-Invoice).
• Judicial authorities (police, prosecutors, courts), upon legal request.
• ANSPDCP, in case of data protection investigations.
• External auditors, under a confidentiality clause.

6.3 Other users of the platform

Certain data may be visible to other users in a relevant context:

• Publishers see the company name and the content of the article placed by the Client (necessary for publication).
• Clients see the names of the publications and the Publishers' offers (necessary for the catalog).
• The email, phone number and invoicing data are NOT visible to other users.

7. International transfers

Certain data is transferred outside the European Economic Area (EEA):

• USA: CloudFlare, Google, Anthropic, OpenAI. All under Standard Contractual Clauses (SCC) approved by the European Commission. Google and CloudFlare additionally benefit from the EU-US Data Privacy Framework (decision 2023/1795).
• Singapore: Ahrefs. There is no EU adequacy decision for Singapore; the transfer is made under SCC.

On request, we can provide a copy of the standard contractual clauses applicable to each transfer.

8. Retention period

9. Your rights

Under the GDPR (art. 15-22) and Law 190/2018 you have the following rights:

• Access (art. 15): to receive confirmation that we process data about you, a copy of it, the purposes and the recipients.
• Rectification (art. 16): correcting inaccurate data directly from the "Account" menu or by request to the DPO.
• Erasure ("right to be forgotten", art. 17), except for mandatory data kept by law (invoices, security logs, AML).
• Restriction of processing (art. 18), temporary, until certain requests are clarified.
• Portability (art. 20): receiving data in a structured format (JSON/CSV), for transfer to another controller.
• Objection (art. 21), to processing based on legitimate interest or direct marketing.
• Not to be subject to an automated decision (art. 22), see section 10.
• Withdrawal of consent (art. 7(3)), at any time, for newsletter, marketing, cookies.
• Complaint to ANSPDCP, see section 12.

Requests are sent to contact@psk.ro. We reply within 30 days (extendable by 60 days for complex requests, with notice). For repeated or manifestly unfounded requests we may charge a reasonable fee or refuse, according to art. 12(5) GDPR.

10. Automated decisions

The Platform includes some automated processes, but without significant legal effects on the user:

• Tax ID validation through the ANAF / VIES API.
• VAT calculation based on jurisdiction and VIES status.
• Anti-fraud filters (throttling, detection of suspicious behaviour).
• Suggestions of similar offers in the catalog (recommendation).

We do not use behavioural profiling for decisions that produce legal effects (refusal of contract, refusal of access). Any account suspension decision is preceded by human review.

11. Data security

We implement technical and organizational measures:

• Enforced HTTPS (TLS 1.2+, HSTS preload).
• Bcrypt hashing for passwords (never stored in clear text).
• Two-factor authentication (2FA), recommended for all accounts.
• Sessions with CSRF token rotation and automatic expiry.
• Anti-brute-force throttling on sensitive routes.
• Card payments through a PCI-DSS certified gateway (Netopia Payments / LibraPay); we do not store card numbers.
• Daily encrypted backup, 30-day retention.
• Regular dependency updates (composer audit).
• Database access restricted to whitelisted IPs only.
• Incident response plan with notification within 72 hours according to art. 33 GDPR.

12. Complaint to ANSPDCP

You have the right to lodge a complaint with the Romanian supervisory authority:

13. Changes

Changes to this policy are announced by email and by notification in the panel at least 30 days before they apply, except for changes required by law, which take effect upon publication. The current version is indicated in the header.