Privacy policy

Last updated: 16 October 2026

This policy explains what personal data we collect through the Notaro.ro platform, for what purpose, who we disclose it to, how long we keep it and what rights you have over it. The platform does not collect your CNP (national identification number) or any other data from your identity document.

The data controller and the designated contact

The controller of your personal data is CYBERSOFT DEVELOPMENT S.R.L., registered at Bucureşti Sectorul 2, Strada SILOZULUI, Nr. 19, BIROUL NR 6, Etaj 2, fiscal code RO47609213, registration number J40/2520/10.02.2023. For any request concerning your personal data, or to exercise your rights under the GDPR, write to notaro.prod+gdpr@gmail.com. This is the single address designated for such requests. We have not appointed a Data Protection Officer, as our processing does not fall within the cases where Art. 37 GDPR requires one. Requests concerning personal data should be sent to the address given above.

What data we collect

We collect the data you give us directly (name, email, phone) when you create an account and when you book, plus technical data (IP address, device type) generated automatically as you use the platform. We do not collect your CNP (national identification number) or any other data from your identity document — see “Identity-document data”.

How we use the data

We use the data to create your account, process your bookings with notary offices, send you confirmations and reminders, pre-fill the documents for an appointment with your name, phone number and email and the appointment details, and improve the platform. The notary office may confirm your contact details for an appointment by phone or in person; we record who confirmed them, when and how, without keeping a separate copy of the details.

Legal basis for processing

We process data on the basis of performing our contract with you (your appointments and the documents pre-filled for them, Article 6(1)(b) GDPR), your consent (marketing communications) and the legal obligations that apply to notarial activity, including the notary's duty to verify your identity.

Identity-document data

Notaro does not collect or keep your CNP (national identification number), the series and number of your identity document, your home address or any other data from your identity document. The notary verifies your identity at the office, from the original document. For an appointment, the notary office can generate documents through the platform (for example applications or forms) pre-filled only with your name, phone number and email, the appointment date and service, and the office's details. Identity-document fields stay empty and are completed at the office. These documents are kept for the period listed under “Data retention” and then deleted automatically. Please do not send photos or copies of your identity document through chat unless the notary office explicitly asks for them. If you send them at the office's request, the notary office is the controller of that data, and Notaro hosts them for the office; the files are kept and deleted like any other conversation attachment (see “Data retention”).

Who we disclose data to

We disclose the data strictly necessary to the notary office you choose for your appointment. We use the following providers, which process data on our behalf and only for the service they provide to us: • Supabase: hosts the database, accounts, files and server functions. The data is stored in the European Union. • Vercel: hosts the website (Frankfurt region) and keeps short-lived technical request logs, including your IP address. • Resend: sends the platform's emails, such as confirmations, reminders, invitations and receipts. • seven.io (Germany): sends verification codes by SMS when you sign in with your phone number. • Stripe: processes notary offices' subscription payments. Clients do not pay anything through Notaro. • Expo and Google Firebase Cloud Messaging: deliver notifications to your phone in the mobile app. A notification contains the office name, the service and the appointment time, never the content of chat messages. • hCaptcha (Intuition Machines): checks that you are not a robot when you sign in, register, reset your password or use the contact forms. • Anthropic: when this feature is used, automatically classifies the description of your request after names, contact details, CNPs and addresses have been replaced. The processing takes place in the European Union. • OpenFreeMap and Photon (komoot): display the maps and look up the addresses or places you type. Some of these providers are based outside the European Economic Area, mainly in the US. For them, transfers rely on the standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework, as applicable. We do not sell your data and we do not pass it to third parties for marketing.

Data retention

We keep your data for as long as your account is active and, after that, only as long as needed for the purpose it was collected for or as long as the law requires. The platform applies these periods automatically: • Documents generated for an appointment: 7 days after the appointment ends. • Finished appointments (completed, cancelled or no-show), with their conversations, attachments and reviews: 3 years from the appointment date. • Contact details an office records for a phone booking: as long as you have a non-cancelled appointment at that office within the appointment retention period (3 years). Once there is none left, they are deleted after 30 days. They are also deleted when the office leaves the platform. • Notes and tags an office keeps about you: as long as you have an appointment at that office within the appointment retention period (3 years). Once there is none left, they are deleted, but not earlier than 30 days after the note was written. They are also deleted when you delete your account or the office leaves the platform; for phone bookings, together with the contact details. • Messages, reviews and notifications you delete: 30 more days, then permanently deleted. • In-app notifications: 12 months. • Uploaded files no longer attached to any message: 30 days. • Data export requests: 30 days. The archive with your data expires after 72 hours. • The pseudonymised description of your request, used for automatic classification: 90 days. • Messages sent through the contact form: 24 months from receipt, then anonymised. • Enquiries offices send through the "For notaries" form: anonymised 24 months after receipt once the discussion has ended, and in any case after 36 months. • The audit log and the record of erasure requests: 7 years, so we can prove we met our legal obligations, including accounting ones. Personal data in the log is reduced to internal identifiers. Notarial acts and the documents the notary office downloads are kept by the office in its own archive, as notarial law requires.

Security

We apply technical and organisational measures to protect your data, including role-based access control, tenant isolation between offices, and an audit log of privileged access.

Cookies and local browser storage

We only use cookies and browser storage that are strictly necessary for the platform to work or for a service you asked for. Under Article 4(5) of Romanian Law 506/2004 these do not require your consent, which is why we do not show a cookie banner. We do not use analytics or advertising cookies. • Account session cookies (Supabase): keep you signed in. You cannot sign in without them. • Language cookie (NEXT_LOCALE): remembers the site language. • The "sidebar_state" cookie: in the office portal, remembers whether the side menu is open or closed, for 7 days. • Session storage (sessionStorage): keeps the steps of a booking or of an office registration while the tab is open, including what you typed in the form, so you do not lose it if you sign in halfway through a booking. It is cleared when you close the tab. • Local storage (localStorage): in the office portal, remembers display preferences on that device (collapsed sections, calendar view, notification sound) and a draft of an office registration, deleted after use. Maps use images from OpenFreeMap, and address search uses the Photon service. Your browser sends them requests (including your IP address), but these services do not set cookies. On the sign-in, registration and password-reset pages and in the contact forms we use hCaptcha to protect against bots. On those pages your browser loads a script from hCaptcha, which receives your IP address and technical information about your device and may store data in your browser only for this check. It is part of the security of the service you asked for. You can delete cookies and stored data at any time in your browser settings. Deleting the session cookies signs you out.

Data sent through the contact form

When you write to us through the contact form we process your name, email address and, optionally, your phone number and subject, together with the content of your message, in order to answer you. The legal basis is our legitimate interest in answering the questions you put to us, and pre-contractual steps taken at your request. We collect only the data needed for that purpose; please do not include sensitive data such as a CNP, identity-document series and number, or health information. We keep these messages for at most 24 months from receipt, after which they are deleted or anonymised.

Phone bookings without an account

If you call a notary office and it books an appointment for you without a Notaro account, the office records your name and phone number in Notaro and, if you want an email confirmation, your email address. The notary office is the controller of this data, and Notaro hosts it for the office. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Only the office you called can see this data, and it is used only for your appointments at that office, including confirmations and reminders. We do not use it for marketing and do not show it to other offices. To access, export or delete your data, contact the notary office, which can export or delete it directly in Notaro. You can also write to us at the contact details at the top of this page, and we will pass your request to the office.

Notes and tags offices keep about clients

A notary office where you have an appointment can keep short notes and tags about you in Notaro (for example “prefers morning appointments” or “company”), to organise its work with clients. The notary office is the controller of these notes, and Notaro hosts them for the office. The legal basis is the office's legitimate interest in organising its relationship with its clients (Article 6(1)(f) GDPR); you can object at any time by contacting the office. Only that office's staff can see the notes. We do not look at them in our normal work, do not show them to other offices and do not use them for marketing. Offices are asked not to record a CNP, health data or other sensitive data. The notes are not included in the copy of your data you download from “My account”, because the office is responsible for them. You still have the right to see them: ask the office, which can export them directly from Notaro and must answer within one month. You can also write to us at the contact details at the top of this page, and we will pass your request to the office.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection. You can download a copy of your data and request deletion of your account directly from “My account”. Each right is explained in detail on the “Data protection (GDPR)” page. For any request, write to notaro.prod+gdpr@gmail.com.

Supervisory authority

If you are unhappy with how we process your data, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. General Gheorghe Magheru 28-30, Bucharest.