Skip to content

Last updated: 30 September 2026

Privacy Policy

What personal data mhlsq.ro collects, why, who processes it and what rights you have.

Data controller

Under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018, the controller of the personal data collected through this website is:
  • Name: Alexandru Mihalașcu (natural person, not a registered company)
  • Location: Bucharest, Romania
  • Email: alex@mhlsq.ro
  • Phone/WhatsApp: +40 752 571 265
  • Website: https://mhlsq.ro

Data I collect

Only what is needed to reply to you, plan a project or keep the site working.

Contact form

  • Name, email address and, optionally, phone number.
  • The subject and message you write, including anything you share about your project.
  • The date and time of the submission.

AI assistant (chat)

  • Your messages are sent to an AI provider (Groq, or Google Gemini as a fallback) to generate replies. Do not share sensitive data in the chat.
  • The conversation is saved (text only, up to the last 60 messages) only if you answer "Yes, save it" when the chat asks. Otherwise nothing is stored on the server.
  • If you ask the assistant to send a project request and confirm it, your name, email, optional phone and project description are stored like a contact form submission.

Direct communication

  • Emails, LinkedIn or WhatsApp conversations and meeting notes related to our work.

Usage data

  • Google Analytics 4 measures visits (pages viewed, session length, traffic source, device type, approximate region), only after you accept analytics cookies.
  • Technical server logs kept by the hosting provider (Vercel) to deliver pages and investigate errors.

Purposes and legal bases

  • Replying to your message and preparing an offer: steps taken at your request before a contract (Art. 6(1)(b) GDPR).
  • Delivering a project we agree on: performance of the contract (Art. 6(1)(b) GDPR).
  • Analytics cookies and saving chat conversations: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004), which you can withdraw at any time.
  • Keeping the site secure and preventing spam or abuse (rate limits, technical logs): legitimate interest (Art. 6(1)(f) GDPR).
  • Keeping records required by law (for example, accounting documents): legal obligation (Art. 6(1)(c) GDPR).

How long I keep data

  • Contact messages, project requests and saved chat conversations: up to 18 months from the last message, unless we are working together or the law requires longer.
  • Google Analytics data: 26 months, then deleted automatically by Google.
  • You can ask for deletion at any time at alex@mhlsq.ro.

Who processes data for me

These providers act as processors under their data processing terms. Some are located outside the European Economic Area (see "International transfers").

Vercel Inc.

Hosting and delivery of the website; technical logs.

Google (Firebase / Cloud Firestore)

Stores contact messages, project requests, saved chat conversations and portfolio content.

Google Analytics 4 (Google LLC)

Visit statistics, only with your consent. Google signals and ad personalisation are disabled.

Groq Inc. and Google (Gemini API)

Generate the AI assistant replies from the messages you send in the chat.

Resend

Delivers the email notification I receive when you send a contact form or project request.

Gmail, Notion

My email inbox, where I reply to messages, and project planning notes.

International transfers

Some of the providers above (Vercel, Google, Groq, Resend) may process data in the United States. These transfers rely on the safeguards the providers offer under GDPR Chapter V: certification under the EU-U.S. Data Privacy Framework or the European Commission Standard Contractual Clauses.

Security

  • HTTPS encryption for all traffic.
  • Firestore security rules: contact messages and chat conversations can only be read from the admin dashboard.
  • The admin dashboard requires Google sign-in with an authorised account.
  • Only I have access to personal data.

Your rights

Under GDPR and Law 190/2018 you have the right to:
  • access the data I hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have your data deleted (Art. 17);
  • restrict processing (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interest (Art. 21);
  • withdraw your consent at any time, without affecting processing done before the withdrawal (Art. 7(3));
  • lodge a complaint with the supervisory authority (Art. 77).

Supervisory authority

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP):
  • Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
  • Email: anspdcp@dataprotection.ro
  • Website: https://www.dataprotection.ro

Cookies

Details about every cookie and storage key are in the Cookies Policy.

Children

This website is not aimed at children under 16 and I do not knowingly collect their data. If you believe a child has sent me personal data, write to me and I will delete it.

Automated decisions

No decision with legal or similarly significant effects is made about you by automated means. The AI assistant only answers questions; any collaboration is decided by me.

Changes to this policy

I update this policy when the site starts using a new provider or collects new data. The date at the top shows the latest version.