Privacy policy

The controller is the entity operating the Utilaro platform. Company identity (legal name, registered office, company ID) will be published here as soon as registration is complete.

In the meantime, for any personal data request (access, rectification, erasure, etc.), contact contact@utilaro.com.

We process only what is needed to run the marketplace and comply with the law.

• Account data: email, password (hashed), display name, profile type.
• Profile data: first/last name, phone, country; for companies — legal name, VAT/CUI, address, website.
• Billing data: address, VAT/CUI, billing email; Stripe identifiers (customer/subscription), never the full card number.
• User content: listings, images, requests, inquiries, reviews.
• Technical data: IP address, browser type, security logs, cookies (see Cookie policy).
• Usage data: pages viewed, search filters, in-app notification events.

We process data under one or more GDPR bases.

• Contract performance (Art. 6(1)(b)): account, listings, inquiries, reservations, plan/extra/promotion payments, in-app notifications.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product improvement, aggregated analytics.
• Legal obligation (Art. 6(1)(c)): responding to authorities, retention where required.
• Consent (Art. 6(1)(a)): non-essential cookies or marketing, if you opt in.

We do not sell personal data. We may share it with:

• Infrastructure providers (hosting, auth, database — Supabase) as processors.
• Stripe, for payments, subscriptions, VAT invoices, and the billing portal (card data is processed by Stripe, not by us).
• Vercel, for site hosting; Google Analytics and Vercel Analytics/Speed Insights only after analytics cookie consent.
• Meta (Facebook Pixel), for measuring and targeting Utilaro ads, only after marketing cookie consent.
• Resend, for transactional email (account confirm, password reset, notifications).
• Other users as needed (public listing details, seller type, messages you send).
• Public authorities when required by law.
• Professional advisers (legal, accounting) under confidentiality.

Data may be stored or processed in the EEA or, if a provider is outside the EEA, under appropriate safeguards (standard contractual clauses, adequacy decision, etc.).

We keep data as long as needed for the purposes above: while the account is active and for a reasonable period after closure for security, disputes, and legal duties.

Deleted listings may remain in backups for a limited time.

Under GDPR you may request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent where applicable.

Send requests to contact@utilaro.com. We respond within legal timeframes. You may also lodge a complaint with the Romanian Data Protection Authority (ANSPDCP).

We apply reasonable technical and organisational measures (HTTPS, access control, role-based policies). No internet transmission is 100% secure; please use strong passwords.

The service is not directed to people under 18. We do not knowingly collect data from children.

We may update this Policy. The “Updated” date shows the current version. For material changes we may post a notice on the site.