PLAN OF ACTION S.R.L., Aleea Alexandru 34, Etaj 4, Ap. 9, Sector 1, 011824 Bucharest, Romania · Trade register J40/3444/2021 · CUI 43805497. Privacy enquiries: our protected contact form or the registered postal address above. We have not appointed a data protection officer, as we are not legally required to do so.
PRIVACY POLICY
Privacy policy.
This policy explains which personal data we process when you visit plan-of-action.com or contact us, why we do so, and which rights you have under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018. Last updated: 31 October 2026.
1. CONTROLLER
Who is responsible.
2. VISITING THE WEBSITE
Hosting and server logs.
When you open this website, your browser automatically transmits technical data: IP address, date and time, requested page, referrer, browser type and operating system. This data is required to deliver the website securely and to defend against attacks (Art. 6(1)(f) GDPR – legitimate interest in a stable, secure website). Log data is deleted or anonymised within a short period, generally no later than 30 days, unless needed to investigate a security incident.
The website is hosted through Lovable Labs Incorporated, Boston, Massachusetts, USA. Lovable's published data processing agreement provides for EU Standard Contractual Clauses for relevant international transfers. The current subprocessor list is maintained in Lovable's Trust Center. These are the safeguards described in the published agreement, not confirmation that an agreement has been concluded for this account. [BITTE PRÜFEN: AVV/DPA mit Lovable für dieses Konto abgeschlossen und Standardvertragsklauseln anwendbar?] [BITTE PRÜFEN: aktuelle Lovable-Unterauftragsverarbeiter, insbesondere Cloudflare und Google Cloud, anhand der Trust-Center-Liste bestätigen.]
Fonts are hosted on our own server; no connection to Google Fonts is made.
Providing personal data is neither required by law nor by contract. Without the technical access data the website cannot be delivered; without your contact details we cannot answer your enquiry.
3. CONTACT FORM AND EMAIL
When you write to us.
If you use our contact form or email us, we process the data you provide (name, email address, optional phone number, area of interest, message) to answer your enquiry and, where applicable, to prepare or perform a contract (Art. 6(1)(b) GDPR) or on the basis of our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). Form messages are delivered to our mailbox via the email service of Lovable Labs Incorporated; our mailbox uses Gmail (Google). Messages to our legal-notice email address are forwarded by Cloudflare Email Routing (Cloudflare, Inc., USA) to our Google (Gmail) mailbox. [BITTE PRÜFEN: Google Workspace mit AVV oder privates Gmail-Konto?] Please do not send passwords, payment details or special categories of data.
Self-hosted spam protection (ALTCHA)
Our public contact forms use the open-source ALTCHA proof-of-work widget, delivered from this website. Your browser performs a small calculation and our server checks the signed result before sending a message. ALTCHA creates no cookies and uses neither local storage nor session storage. The spam check does not send data to ALTCHA or any other third-party CAPTCHA provider. No consent is requested for this check.
To limit abuse, our server briefly processes your IP address and derives a keyed hash. Only that hash and request counters are held in temporary server memory, for at most one hour; they are not written to a database or persistent spam-protection log. Entries are removed when their retention period ends or the running instance restarts. Proofs expire after ten minutes; hashes of consumed proofs are held in memory until expiry to reject reuse. We also check an empty hidden field, a minimum three-second interval and message validation. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in protecting the contact service from misuse and spam. Ordinary hosting logs described above are separate from these short-lived spam-protection counters.
We delete enquiries once they are fully handled, unless statutory retention duties (e.g. commercial and tax records under Romanian law, generally up to 10 years) or a business relationship require longer storage.
4. COOKIES AND EXTERNAL MEDIA
Only with your consent.
Necessary storage: we store your privacy choice in your browser's local storage (key “poa-consent”) so that the banner does not reappear. This is strictly necessary for the service you request (Art. 5(3) ePrivacy Directive as implemented by Romanian Law no. 506/2004; Art. 6(1)(c) and (f) GDPR). We do not add analytics, advertising or tracking cookies in the website code. [BITTE PRÜFEN: Ist „Visitor analytics“ in den Lovable-Projekteinstellungen ausgeschaltet? Der Status konnte nicht ausgelesen werden.] Lovable describes its optional visitor analytics as cookie-free and without browser storage; this description does not confirm whether it is enabled for this website. If enabled, its processing and applicable legal basis must be reviewed and disclosed before relying on a statement that no analytics is used.
Embedded videos (Adilo): some pages contain videos from Adilo, a service of BigCommand LLC (USA). The video is only loaded after you consent, either in the cookie banner or by clicking “Load video”. Adilo then receives your IP address and technical browser data and may set cookies. Legal basis is your consent (Art. 6(1)(a) GDPR). Data may be transferred to the USA; please note that a level of protection equivalent to the EU may not be guaranteed and US authorities may access the data (Art. 49(1)(a) GDPR where no other safeguard applies).
You can withdraw or change your consent at any time with effect for the future: .
5. RECIPIENTS
Who receives data.
We share personal data only with the processors named above, with professional advisers bound to confidentiality (e.g. accountants), or where we are legally obliged to do so. We do not sell personal data and do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.
6. YOUR RIGHTS
What you can request.
- Access to your data (Art. 15 GDPR)
- Rectification (Art. 16) and erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Withdrawal of consent at any time, without affecting earlier processing (Art. 7(3))
- Complaint to a supervisory authority (Art. 77), in Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro – or the authority in your EU country of residence.
To exercise your other rights, use our protected contact form or write to our registered office.
7. SECURITY AND CHANGES
Keeping data safe.
This website is transmitted exclusively via TLS encryption (HTTPS). We may update this policy when our services or the law change; the current version is always available on this page.
8. PRIVACY QUESTIONS
AI-assisted policy answers.
If you choose to ask a question below, your question and the published privacy policy are sent through Lovable AI Gateway to OpenAI to generate an answer. Do not enter personal, sensitive or confidential information. Processing is based on Art. 6(1)(f) GDPR, our legitimate interest in responding to voluntarily submitted questions about our privacy practices. We do not save questions or answers in our own database; they remain in this page's memory until you leave or reload. Technical hosting and gateway request logs are separate. [BITTE PRÜFEN: AI Gateway/OpenAI processing terms, international-transfer safeguards, and gateway log retention applicable to this account.] The same self-hosted ALTCHA check, minimum three-second interval and temporary hashed-IP protection described in section 3 apply, with a separate limit of five questions per hour per running instance. AI answers may contain errors and do not constitute legal advice or resolve requests to exercise your rights. You may instead use our protected contact form.
ASK ABOUT PRIVACY
Your privacy questions.
POLICY ANSWER
—