Privacy policy

What personal data TECH INGRAINED SRL processes through the Tech Ingrained platform, why, with whom it is shared, and for how long it is kept.

Version of 2026-10-06

1. Who we are

The controller is TECH INGRAINED SRL, fiscal code RO55566270, Trade Register no. J2026053736008, registered office Bd. Pipera Nr. 1 V/B, Bl.11, Parter, Ap.13, Voluntari, Jud. Ilfov, email office@techingrained.com, telephone +40 750 450 930. Write to office@techingrained.com with any question about your data.

2. What data we process

• Account: name, email address, company name, password (only as a hash), role in the account.
• Sign-in and security: IP address, browser, sign-in sessions, a log of the actions taken in the account.
• Billing: legal name or name, fiscal code or personal code, registration number, address, billing email and telephone, optionally bank and IBAN, invoices and payments (the payment processor's reference; card details never reach us).
• Waiting list: company, name, email, optionally telephone, language, and the IP address the form was sent from.
• The messages you send us, by email or through the contact form on the home page: your name, email address, company and the message.
• Data from the calls the agents answer, on behalf of our clients: the caller's number, the transcript, the summary, the call's events, messages taken, the audio recording (only when the client has turned recording on) and caller memory (only when the client has turned it on).
• The documents clients upload to their agents' knowledge base.

3. Why, and on what basis

We send no marketing, sell no data, and make no automated decisions with legal effects on you. The emails we send are about your account: password resets, invoices and payments, service notices and, if you asked, the waiting-list invitation.

• To provide the service you ordered and run your account (Article 6(1)(b) GDPR).
• For invoicing, accounting and other legal obligations (Article 6(1)(c)).
• For security, to prevent abuse and fraud, and to maintain and improve the service (legitimate interest, Article 6(1)(f)).
• To answer the messages you send us, by email or through the contact form (legitimate interest, Article 6(1)(f), or, when you ask about the service, steps before entering into a contract, Article 6(1)(b)).
• To tell you, once, that a number has come free, if you joined the waiting list (consent, Article 6(1)(a)); you can withdraw at any time, from the link in the message or by writing to us.
• Call data and clients' documents are processed by us as a processor, only to provide the service and as the client instructs; the legal basis is determined by the client, who is the controller of that data.

4. Who receives the data

We use these providers (processors), only as far as the service needs:

• Google Cloud (Google Ireland Ltd.): the Gemini language model, for the agents' answers and for summaries; storage of audio recordings, in a private store in the European Union (Belgium).
• ElevenLabs: speech recognition and speech synthesis during calls.
• Anthropic: a fallback language model, used when the main model does not answer.
• MailerSend: sending the platform's emails.
• SmartBill: issuing invoices, including in the RO e-Factura system.
• NETOPIA Payments: card payments; card details are entered on its secure page. If Stripe is also offered at checkout, it processes the payment on the same terms.
• Our telephony provider in Romania, for numbers and carrying calls.
• Google Analytics (Google Ireland Ltd.): statistics about the public pages, only if you accepted the analytics cookies (section 9).
• Google Ads (Google Ireland Ltd.): measuring our advertisements — which one brought a request for a quote —, only if you accepted the cookies (section 9).

5. Transfers outside the European Economic Area

ElevenLabs and Anthropic process data in the United States. Transfers rely on the standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework, with additional security measures. Our platform runs on our own infrastructure in Romania.

6. How long we keep data

• Account data: while the account exists, and 90 days after it is closed.
• Invoices and accounting records: 10 years, as the accounting law requires.
• Audio recordings: the period the client sets for its account (90 days by default), after which they are deleted.
• Transcripts, summaries and messages: while the account exists, unless the client asks for earlier deletion.
• The waiting list: until an account is created or the person leaves the list.
• Messages sent by email or through the contact form: as long as needed to answer them and for the conversation that follows.
• Security logs: for as long as they are needed to keep the platform secure and to defend legal claims.

7. Your rights

Send requests to office@techingrained.com. We answer within one month; for complex requests this may be extended by two months, and we will tell you so.

• the right of access, and to receive a copy;
• the right to rectification and to erasure;
• the right to restriction of processing and to data portability;
• the right to object, including to processing based on legitimate interest;
• the right to withdraw consent, without affecting processing before the withdrawal;
• the right to complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro).

8. If you called one of our clients

The business you called is the controller of the call data and decides what is kept. Contact that business to exercise your rights; we help it respond. You can also write to us at office@techingrained.com and we will point you the right way.

9. Cookies and browser storage

We use the cookies strictly needed for signing in, and the browser's local storage for preferences: the language, the theme, and your answer to the question below. These need no permission, because the site does not work without them.

The strictly necessary cookies are set only once you sign in to the platform: "__Host-orchestrator_session" keeps the session open (up to 12 hours), "__Host-ao_refresh" renews it without signing in again, and "orchestrator_csrf" stops another site sending a request in your name. A visitor to the public pages receives none of them.

With your permission we also use Google Analytics 4 (Google Ireland Limited), to see how many people look for us and which pages they read. It puts the cookies _ga and _ga_<identifier> in your browser, kept for up to two years, and receives your IP address, from which it derives an approximate location and which it does not store. The data is kept for 14 months.

Also with your permission — given separately, under "Marketing" — we use Google Ads (Google Ireland Limited), to know which of our advertisements brought a request for a quote. It puts "_gcl_au" in your browser, kept for up to 90 days, and, from the doubleclick.net domain, the "IDE" cookie, kept for up to 13 months, with which Google ties your visit to a click on an advertisement and can show you our advertisements on other sites. This is advertising: if you arrived here from an advertisement, Google learns that you arrived. We neither buy nor sell data about you.

The two permissions are separate: you may accept analysis without advertising, or the other way round, from the question on your first visit or at any time afterwards, from "Cookies" in the page footer.

Until you accept, nothing of Google Analytics or Google Ads is loaded: no cookie is set and nothing is sent. If you refuse, the site works the same. You may change your mind at any time, either way, from "Cookies" in the page footer.

The NETOPIA Payments logo in the page footer is loaded from NETOPIA's servers, which may record the request.

10. Security

How we protect data is described in the GDPR policy.

11. Changes

We update this policy when our processing changes; the version in force is that of 2026-10-06. Significant changes are announced by email.

This is a translation; the Romanian version prevails.