Privacy policy

Controller

The controller is QuickExit, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, US. Privacy contact: contact@stiriai.ro. We have not appointed a data protection officer. This policy describes what stiriai.ro actually collects.

Newsletter

If you subscribe, we store your email address and the time of the signup in the Supabase table subscribers. The legal basis is your consent (GDPR Article 6(1)(a)). We use it only to send the StiriAI letters. We do not sell it and we do not attach it to a public profile. We keep it while the subscription is active. You can withdraw consent or ask for deletion at contact@stiriai.ro. Withdrawal does not affect the lawfulness of the processing already done.

Partnership form

The forms on /publicitate and /advertise store your name, company, email, website if you send one, the package you choose, the message, the language of the form, and the fact that you agreed to be contacted. The row goes into partner_inquiries. The legal basis is the steps before a contract (Article 6(1)(b)) and our legitimate interest in answering a business request (Article 6(1)(f)). We do not publish these rows and we do not sell them. We keep them for the partnership conversation and delete them when you ask.

Affiliate clicks

A link of the form /go/slug sends you to a partner and writes a row in affiliate_clicks: the slug, the time, the page path on stiriai.ro or the external hostname (never the query string), the country code if Vercel sends one, a shortened user agent, and a salted SHA-256 hash of the IP address. We do not store the raw IP. The legal basis is our legitimate interest in measuring partnerships and limiting abuse (Article 6(1)(f)). We intend to keep these rows for no more than 12 months. Automatic deletion is not running yet. Write to contact@stiriai.ro and we delete the rows we can match. Because the IP is hashed with a secret, we usually cannot search by IP. The time and the page help.

Analytics

We use Vercel Web Analytics. It does not set a cookie and it does not give us a visitor profile we store in our database. The legal basis is our legitimate interest in knowing which pages are read (Article 6(1)(f)). There is no advertising cookie and no consent banner, because this measurement does not use a non-essential cookie. Details are in the cookie policy.

Cookies that are strictly necessary

Public pages do not set a cookie. The editorial area at /admin sets a Supabase session cookie only after an editor signs in. The private partner summary can set an httpOnly cookie named stiriai_partner_admin on /admin/parteneri, only after a valid administrator token, for eight hours. It is marked Secure when the site is served over HTTPS. These cookies are strictly necessary for those closed pages. They are not set for readers.

Theme

The light or dark theme is stored in the browser's localStorage, under the key theme. It is not a cookie and it is not sent to our server.

Recipients

Supabase stores the database and the article images. Vercel hosts the site, keeps the usual server logs, and provides the cookieless analytics. An affiliate partner receives only the visit to that partner's own tracking URL. We do not send the partner your name, your email, or the IP hash. We do not sell personal data. We do not make a decision based solely on automated processing that produces a legal effect on you.

Transfers

QuickExit, LLC is established in the United States. Supabase and Vercel may process data in the United States. Where GDPR Chapter V applies, we rely on the standard contractual clauses those providers offer. We do not claim a separate certification of our own.

Your rights

You can ask for access, rectification, erasure, restriction, or a portable copy, and you can object to processing based on legitimate interest. You can withdraw newsletter consent at any time. Send the request to contact@stiriai.ro. We may ask you to show that you control the email address. You can also lodge a complaint with ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro.

Security

The inquiry and click tables have row level security enabled and no public read policy. The server uses a service key that is not in the browser. No method of storage is perfect.