Privacy Policy — Zephren

1. Data Controller

ZEPHREN S.R.L., registered office at B-dul Libertății, no. 38, ap. 4, Bușteni, Prahova county, Romania. Company ID (CUI): 54561142 | Trade Registry: J2026027529009.
Data Protection Contact: legal@zephren.ro.

Data Protection Officer (DPO): ZEPHREN is not legally required to appoint a formal DPO under Art. 37 GDPR (fewer than 250 employees, and its core activity does NOT consist of large-scale systematic monitoring or processing of special categories of data). Nevertheless, we have designated a dedicated contact person for all GDPR requests, reachable at legal@zephren.ro, with a guaranteed response within 30 days (Art. 12(3) GDPR). Should ANSPDCP formally request the appointment of a certified DPO, we will comply within the indicated timeframe.

2. Categories of personal data processed

The ZEPHREN calculation program and VerificAI process the following data categories:

• Auditor account data: email, password (stored as bcrypt hash), name, company, UI preferences.
• Auditor professional data: MDLPA certification number, category I/II, signature image, stamp image.
• End client data (audit subject) (entered by the auditor with the explicit consent of their client): name, surname, email, phone, building address, GPS coordinates, cadastral number, land registry, building photographs, utility bills.
• Project technical documentation uploaded for verification (VerificAI): written and drawn documents — drawings, sections, technical reports, product datasheets. These may contain data concerning third parties, i.e. persons other than you (names and contact details of the developer, of the designers and of the economic operators, the construction address, the information in the drawing title block), as well as commercially sensitive information. You upload them in your capacity as a certified project verifier, under your contract with your client; they are transmitted to the AI model provider for analysis (see section 4) and are not stored on Zephren servers once the request has been processed.
• Project verification log: verification report number and date, project name, developer, designer, verified requirement. It is saved locally, in the browser of your device and — when you are signed in — it is also mirrored to your account on Supabase servers in the European Union, so that it survives a browser cleanup or a move to another computer. The mirror is visible only to you (row-level isolation, tied to your account), can be exported and is deleted together with your account. The local copy is erased automatically when a different account signs in on the same device and disappears if you clear the site data in your browser. The log may contain third-party data (developer, designer, construction address); for these you remain the controller and Zephren processes them as a processor, under the Article 28 GDPR agreement.
• Site diary and site supervisor's minutes (VerificAI, site supervisor function): dated entries, free text and, optionally, photographs; minutes on determining stages and reception list participants (name, role) and a conclusion. May contain third-party data — workers, contractor representatives, other participants — that you enter yourself, as site supervisor; you remain the controller for these, and Zephren processes them as a processor (Art. 28 GDPR), same as the log above. Deleted together with the verified project file.
• CPD record (continuing professional development): course attended, provider, date, number of hours and, if you upload it, proof of attendance — stored in a separate private bucket, isolated per account. You declare these yourself, as part of your own professional compliance record.
• Practice-renewal file (VerificAI): certification expiry date, professional liability (RCP) insurer and policy number, policy expiry date, insured amount, and the checklist of documents in the renewal file. Data you declare about yourself — no third-party data.
• Site photographs (audit module, "field mode"): building photographs taken or uploaded on site, converted and stored as WebP, or JPEG on browsers without WebP support, in a private bucket separate from the rest of the application, capped at 200 photographs per project. Deleted together with the project they belong to and included in the platform's backups.
• Audit Calendar visits and notification "read" state: the site visits you schedule (date, time, building address, type, notes) and the "read" flags on deadline notifications, synced across your devices. Visits may contain your client's address. Both are visible only to you (row-level isolation, on your account) and are deleted together with your account.
• Products tracked for the declaration of performance (RTE) (VerificAI): product name and code, whether a declaration of performance (DoP) exists, and your own notes. Generally no third-party personal data.
• Payment data: VAT ID (B2B Romania), VAT number (B2B EU), billing address. Card data is processed exclusively by Stripe and is not stored by Zephren.
• Technical data: IP address, user-agent, authentication logs and a device identifier — a randomly generated number created and kept in your browser, which tells your devices apart when projects are synchronised and, when a trial is started (the thirty-day trial of the calculation program, or the thirty-day VerificAI one), serves to prevent abuse. It is not derived from the characteristics of your equipment and does not allow you to be recognised on other websites. Also to prevent trial abuse, VerificAI keeps a non-reversible form (salted hash) of your IP address: in the trial record, the one from your first sign-in after registration; in your account, the one from your latest sign-in (it is overwritten at each sign-in) — not the address itself, which cannot be recovered from it, and nothing is read from your device to obtain it. All of these are processed for security and fraud prevention.
• Trusted devices (two-step verification), on both products — the calculation software and VerificAI, each with its own account and records (trust in one product does not carry over to the other): if two-step verification is active on your account and, after entering the code, you tick “Remember this device for 30 days”, we keep, linked to your account, the cryptographic fingerprint (SHA-256) of a random secret generated in the browser of the chosen device — not the secret itself —, the identifier of the authentication factor you confirmed with, the date it was remembered and the expiry date. We do not keep a device name, the IP address or any characteristics of your equipment. The purpose is a single one: not to ask you for the code on that device for 30 days after confirmation; password changes and security settings still require the code, while the payment portal no longer does, since 2 October 2026. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — you request the feature yourself, by ticking the box — and account security (Art. 6(1)(f)). Retention: after 30 days the record no longer exempts you from the code and is deleted automatically within 7 days of expiry; it is deleted earlier the next time a device is remembered on your account, when the password is changed, when an authentication factor is removed or added, and when the account is deleted. At most 20 devices per account, the oldest leave first. Changing your password withdraws trust from all devices at once. About the cookie and the browser’s local storage: Cookie Policy.
• Link between the VerificAI account and the calculation software account (designer’s summary): if you ask the VerificAI designer’s summary to show the CPE projects of your calculation software account, we keep in the calculation software account the identifier of the linked VerificAI account and the date of linking. When the two accounts have the same e-mail address, the link is made without any further step and is kept only in the browser; otherwise, when linking, we verify the password of the calculation software account or the two-step verification code — neither the password nor the code is kept. The browser also keeps a copy of the link in its local storage (see the Cookie Policy). Purpose: letting the summary see the account’s own CPE projects — not those of the team. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — you request the feature explicitly. Retention: until unlinking or until the calculation software account is deleted. On “Unlink the account”, the link on the server is deleted if the session of the linked calculation software account is open in the browser; if it is not, the link is undone only in the browser, and the record on the server remains until you sign in to that account and press “Unlink the account” again, or until you delete the calculation software account — the application tells you so at the moment of unlinking. If you delete the VerificAI account, only its identifier remains on the server, with no other data; the identifier left after the VerificAI account is deleted is deleted together with the calculation software account or upon unlinking. The data is included in the export of your data.
• Context of a report: when you submit a report through the feedback form, we automatically attach the page and step you were on, the application version, a few signals about what happened just before (no text written by you) and a screenshot. Sensitive fields — passwords, personal ID numbers, IBANs, the building address, the beneficiary, contact details — are blanked out before the screenshot is taken, so they never enter the image. The screenshot is shown to you before sending and you can decline it with a single click. We do NOT collect your IP address or location.
• Support tickets created automatically from the AI assistant conversation (the calculation program and VerificAI): when the assistant cannot solve a problem, the problem is recorded automatically as a ticket, with the text of the conversation (your questions and the assistant's answers), the account email address (if you are signed in), the plan, the product, the page and step you were on, the reason for recording, a few signals about what happened just before, the application version, the browser type (user-agent) and the ticket number. No screenshot is attached. In the calculation program, the ticket is linked to your account if you are signed in; in VerificAI it is recorded without a link to the account, with the email address only. Purpose: solving the reported problem and fixing the product. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for users with an account, and the legitimate interest in solving reported problems (Art. 6(1)(f)) for visitors without an account. Retention: 24 months after the ticket is closed (section 5). Tickets linked to the calculation program account are included in the data export; when that account is deleted, the tickets linked to it or bearing its email address are deleted.

Zephren DOES NOT collect Personal Identification Numbers (CNP) through the application interface and does not store them in its database. If an MDLPA submission requires the CNP, the auditor enters it directly in the submission document, outside the application.

3. Processing purposes and legal grounds (Art. 6 GDPR)

• Contract performance (Art. 6(1)(b)) — providing energy calculation, CPE generation, audit reports, and project storage; assistance through the AI assistant and the support tickets created automatically (section 2).
• Legal obligation (Art. 6(1)(c)) — fiscal document retention 10 years (Romanian Fiscal Code), eFactura ANAF transmission, compliance with Mc 001-2022 and Law 238/2024.
• Consent (Art. 6(1)(a)) — optional marketing communications; analytics cookies, storage on your device and identification of the person within analytics tools (see section 3.bis).
• Legitimate interest (Art. 6(1)(f)) — fraud prevention, information security, performance monitoring, and improving the calculation program via pseudonymised usage statistics (document type, energy class, EP, building typology, county — without address, name or cadastral data; the rows remain linked to your account, so they are included in the export and the erasure of your data).

3.bis What happens if you reject analytics cookies

The “Reject all” button in the cookie banner has a precise effect, which we prefer to state rather than let you assume:

• Nothing is stored on your device for analytics purposes — no cookie, no entry in your browser’s local storage — and nothing already stored there is read.
• You are not identified: no user profile is created, your account is not linked to the measured activity, and on a later visit you cannot be recognised as the same person.
• Error monitoring (Sentry) stays fully off — there, rejection means exactly what it appeared to mean before.
• Aggregate measurement continues: we still count visits and actions in the application (which pages are opened, where a flow is abandoned, which usability errors occur), so that we know what works and what needs fixing.

Technically this is possible because the analytics provider (PostHog, EU Cloud Frankfurt) computes on its own servers a temporary hash-based identifier, derived from elements of your request (IP address, user agent) and from a value that rotates daily. The hash serves only to avoid counting the same session twice on the same day; it is never returned to your device and does not allow tracking across days or across sites.

Legal basis, in two distinct layers. The obligation to obtain consent for cookies comes from Art. 5(3) of the ePrivacy Directive 2002/58/EC, transposed in Romania by Art. 4 para. (5) of Law no. 506/2004, and covers the storing of information in the user’s terminal equipment and the gaining of access to information already stored there. The cookieless mode does neither, so that obligation does not apply to it. What remains is the processing of the hash on the provider’s servers, which is carried out on the basis of legitimate interest, Art. 6(1)(f) GDPR — our interest in knowing how our own product is used, with minimal impact on you precisely because you are not identifiable. This is the same basis we rely on for our own visit counter.

You may object at any time to this processing based on legitimate interest (Art. 21 GDPR) by writing to legal@zephren.ro. Independently of that, if your browser sends the Do Not Track signal, we honour it and measure nothing at all.

4. Recipients (sub-processors)

Data is transmitted to the following sub-processors that have signed (or are about to sign) Data Processing Agreements (DPA) according to GDPR Art. 28:

• Vercel Inc. (US + AWS EU regions) — application hosting and serverless functions; Vercel Web Analytics — aggregated visit measurement without cookies and without any identifier stored on the device (which is why no consent is required — ePrivacy Art. 5(3) does not apply), which sees the IP address like any web request and is not linked to your account.
• Supabase Inc. (US + AWS EU configurable) — authentication, PostgreSQL database, storage.
• Stripe Payments Europe Ltd. (Ireland) — payment processing, subscriptions, invoicing.
• Anthropic Inc. (California, US) — AI assistant, OCR for invoices/CPE, automatic document import and, in VerificAI, analysis of the project documents you upload (drawings, sections, technical reports — including the third-party data and the commercial information they contain, as described in section 2). Under Anthropic commercial terms for the API, the content submitted is not used to train models and is deleted within a maximum of 30 days. Exception: if Anthropic's automated safety systems flag a request as a possible violation of its Usage Policy, the content of that request (inputs and outputs) may be retained for up to 2 years and the automated classification scores for up to 7 years; Anthropic may also retain content for as long as required by law. Transmission takes place only upon your explicit upload action; if the documentation contains personal data of third parties, you are the one who establishes the basis for that disclosure in the legal relationship with your client.
• Cloudflare Inc. (US + EU edge — Frankfurt, Amsterdam) — DNS, Turnstile bot protection at forms, Web Application Firewall; Cloudflare Web Analytics — aggregated visit measurement without cookies (same regime as Vercel above); Cloudflare Workers AI — turns the text of the questions you ask the normative assistants (the calculation program and VerificAI) into numeric vectors, so we can find the relevant fragments of legal acts. It receives only the question text (and, in VerificAI, the requirement and the dossier's object name) — never the uploaded documents and never your account data.
• Resend Inc. (US, EU-west-1 Ireland infrastructure) — transactional and marketing email delivery (account confirmations, payment notifications, support, newsletter). We use open and click tracking (an invisible pixel and redirected links) to measure deliverability and engagement, on the basis of legitimate interest (Art. 6(1)(f) GDPR). You can block open tracking by disabling image loading in your email client and unsubscribe at any time from any marketing email (unsubscribe link in every email).
• Sentry Inc. (US, Irish jurisdiction DPA) — real-time application error monitoring; personal data is automatically scrubbed before transmission (CNP, email, phone, IBAN are masked).
• PostHog Inc. (EU Cloud, Frankfurt) — product analytics and session recordings to improve user experience; all inputs are masked (passwords, emails, VAT IDs). If you accepted analytics cookies, the processing includes cookies and identification of your account; if you rejected them, it runs in the cookieless mode described in section 3.bis — no storage on your device, no profile and no link to your account.
• UptimeRobot (Cyprus) — uptime monitoring of public endpoints (only public URLs, no user data).
• Gotenberg (Render Inc.) (US/EU infra) — DOCX → PDF document conversion (optional, only if the user does not use the Microsoft Office Online alternative).
• Microsoft Corp. (US) — optional, for DOCX preview via Office Online. Can be disabled (the application uses Gotenberg alternatively).
• SmartBill (Intelligent IT SRL) (Romania) — electronic invoicing + eFactura ANAF transmission.
• Google LLC (US) — optional OAuth authentication, Workspace for communications at @zephren.ro addresses. (Web fonts are no longer loaded from Google since 7 September 2026: we host them ourselves, so Google no longer sees your IP address when pages open.)
• PVGIS (Joint Research Centre EU), OpenMeteo (Germany) — public climate and solar data.
• Nominatim (OpenStreetMap Foundation) (United Kingdom / EU infrastructure) and Overpass API (Germany) — geocoding of the building address you enter and, respectively, querying public context data (neighbouring buildings, geometry). Geocoding no longer leaves your browser directly: it goes through our own service, which forwards only the address to Nominatim — not your account data and not the beneficiary's — and keeps a temporary cache of results (address, coordinates), to reduce the number of requests sent to the public service. Overpass is still queried directly. Both are free public services, without a data-processing agreement (DPA) and without a processor relationship: they process under their own policies, and we cannot impose terms. The query never leaves on its own — only on an explicit action of yours.

International transfers to entities outside the EU/EEA are carried out based on one of the following safeguards, in order of preference:

• (a) EU-US Data Privacy Framework (DPF) adequacy decision of 10 July 2023 — for US sub-processors actively certified on dataprivacyframework.gov/list (Anthropic, Vercel, Sentry, Microsoft, Google, Cloudflare and Resend are certified).
• (b) Standard Contractual Clauses (SCC) adopted by EC Decision 2021/914, Module 2 (controller → processor), for non-EU sub-processors without DPF certification.
• (c) Transfer Impact Assessment (TIA) documented per EDPB Recommendations 01/2020 (post Schrems II — CJEU C-311/18), with supplementary measures where necessary. TIAs are available on request via legal@zephren.ro.

5. Data retention period

• Active auditor account: for the contract duration + 3 years of inactivity.
• Audit projects + CPE: 10 years (professional archiving obligation), then anonymization (name, email, phone, address are replaced with "[ANONYMIZED]").
• Invoices and fiscal records: 10 years (Romanian Fiscal Code).
• Access logs: 12 months.
• Feedback form submissions: 24 months after the report is closed. Attached screenshots are deleted with them.
• AI assistant conversations: 6 months.
• Support tickets created automatically from AI assistant conversations: 24 months after the ticket is closed. The conversation text copied into the ticket follows this period; the conversation kept separately is deleted after 6 months (the «AI assistant conversations» row).
• Marketing data (consent): until consent withdrawal.
• Trial device identifier (both products: the thirty-day trial of the calculation program, the thirty-day VerificAI one): 90 days from the end of the trial, after which it is deleted automatically. The trial record itself remains (start date, end date, the certification number you declared), without the identifier. The basis for this period is Art. 5(1)(e) GDPR: the purpose for which it was collected — preventing trial abuse — is exhausted once the trial ends.
• VerificAI free-trial record (the register of trials used and of trial re-grants): the normalised email address (the form used for comparison: lower case, without «+something» suffixes and, for Gmail, without dots) is kept after the account is deleted as well, for 24 months from deletion, with no link to the account, after which the row is deleted automatically. The purpose is to prevent abusive repetition of the trial period, i.e. obtaining a new free trial by deleting the account and signing up again with the same address. The legal basis is our legitimate interest, Art. 6(1)(f) GDPR; you may object (Art. 21 GDPR) by writing to legal@zephren.ro. The technical fingerprint linked to the trial (device identifier and IP hash) is cleared after 90 days: from the end of the trial for accounts that had a trial, and from the latest sign-in for VerificAI accounts that never had one.
• Record of certification numbers used for a trial: kept for an indefinite period, but with no link to you. When your account is deleted, the account identifier is removed from that record and only the certification number and the date it was used remain. The basis is Art. 17(3)(e) GDPR — retention remains necessary for the establishment or exercise of a legal claim, here our right not to grant a second free trial to the same certification number.
• Site diary, minutes, CPD record, practice-renewal file, site photographs and products tracked for the declaration of performance: until the project or file they belong to is deleted, or the account is deleted — there is no separate automated retention period distinct from the project's or account's lifetime.

The periods that are applied automatically — access logs, AI assistant conversations, closed reports and tickets, the trial device identifier and the VerificAI free-trial record — are enforced by runs that areat least weekly, so the actual deletion may take place up to seven days after the period has elapsed.

6. Data subject rights (Art. 15-22 GDPR)

You have the right to:

• Access (Art. 15) — obtain a copy of the data we hold about you. Direct download from "My account → Personal data", the «Download data (JSON)» button, in the application.
• Rectification (Art. 16) — edit incorrect data directly from your account.
• Erasure / "Right to be forgotten" (Art. 17) — request account deletion and data anonymization from "My account → Personal data", the «Delete account» button.
• Restriction of processing (Art. 18) — during the resolution of a complaint.
• Portability (Art. 20) — full export in JSON format.
• Objection (Art. 21) — to processing based on legitimate interest or marketing.
• Complaint to ANSPDCP — www.dataprotection.ro.

Exercising your rights is free of charge, within a maximum of 30 days from the request. Send the request to legal@zephren.ro.

6.bis Automated decisions and artificial intelligence (Art. 22 GDPR + AI Act 2024/1689)

ZEPHREN does NOT make automated decisions with legal effect or similarly significant impact on you (Art. 22 GDPR). All artificial intelligence functions (invoice/CPE OCR, envelope suggestions, narrative report generation, chat assistant) are ASSISTIVE — the output is reviewed and signed manually by the MDLPA-certified auditor, who assumes full professional responsibility for the final result.

Per EU Regulation 2024/1689 (AI Act) Art. 50, we explicitly inform you:

• AI functions are visually labeled with "AI-assisted" in the interface.
• Outputs may contain inaccuracies; human review is mandatory before use in official documents (CPE, audit).
• The AI model provider has a DPA signed per Art. 28 GDPR and does NOT train models on data submitted via the API.
• Further details in the internal "AI Use Policy", available on request via legal@zephren.ro.

7. Security measures

• Mandatory TLS 1.2+ encrypted transmission.
• At-rest encryption on Supabase servers (AES-256).
• Row-Level Security (RLS) — users can access exclusively their own data.
• JWT authentication with automatic refresh.
• Rate limiting and CORS allowlist on all API endpoints.
• Strict Content Security Policy (CSP), HSTS, X-Frame-Options DENY.
• Anomaly monitoring (Sentry) with alerts in case of security incident.
• Checking your chosen password against public lists of breached passwords, using thek-anonymity method: the password never leaves your device. Its cryptographic hash is computed locally, and only the first five characters of that hash are sent to the third-party service (Have I Been Pwned) — not enough to reconstruct the password or to identify you. The service returns every hash starting with those five characters (hundreds of them), and the match is performed in your browser. As with any web request, the service sees your device's IP address. The check is purely informative: it does not block account creation, and its result is neither transmitted nor stored.

8. Breach notification

In case of a security breach with risk to your rights, Zephren notifies ANSPDCP within 72 hours (Art. 33 GDPR) and, if there is high risk, also the affected data subjects (Art. 34 GDPR) by email.

9. Minors

The Service is intended exclusively for professionals (MDLPA-certified energy auditors or those in the certification process). We do not knowingly collect data about minors under 16.

10. Changes to this policy

Changes to this policy are published on this page, with the effective date and the version history. When you sign in, the application records in your account the version of the policy in force. We recommend that you review this page periodically.

11. Contact

Privacy questions: legal@zephren.ro.
ZEPHREN S.R.L., Bd. Libertății nr. 38, Bușteni, Romania.