Privacy policy

1. Who is responsible for your data

STL EMBEDED CREATIONS SRL, tax ID 42512332, VAT RO46686340, trade register no. J2020001305120, registered at str. Kovari 75, Cluj-Napoca, jud. Cluj, 400217 ("Symbiote", "we"), is the controller of personal data for the website and for Symbiote accounts. For any question about your data, write to [contact email].

2. What data we process

• Your account: your name, email, password (stored only as a hash, we cannot read it), company name and chosen language.
• What you do in the app: brands, sites, content, settings and team members; for connected accounts (Google, Meta and others) we store only the access token, encrypted.
• Free tools: the address you check is read at the time of the check and not saved. If you ask for the report by email, we keep the email, the address checked and the report sent; if you tick the marketing consent, we also keep the consent text, your IP address and browser as proof.
• Anonymous statistics: which tool was opened or used and where the visit came from (UTM parameters, referring site), with no visitor identifier.
• Security: your IP address and browser when you sign in, and a log of important actions in the account.
• Payments: processed by Stripe; we never see or store card details.

3. Why, and on what legal basis

• To provide the service you asked for (the account, the tools, the reports): performance of a contract (Art. 6(1)(b) GDPR).
• Invoicing and accounting: legal obligation (Art. 6(1)(c)).
• Security, abuse prevention, anonymous statistics and product improvement: our legitimate interest (Art. 6(1)(f)).
• Marketing tips by email: only with your consent (Art. 6(1)(a)), which you can withdraw at any time from the unsubscribe link.

4. Your customers' data

When you use Symbiote for your brands' contacts, subscribers, reviews or leads, you (or your client) are the controller of that data, and we process it only on your instructions, as a processor (Art. 28 GDPR). You are responsible for the legal basis, for example your newsletter subscribers' consent or the rules for emails to businesses. We sign a data processing agreement (DPA) on request.

5. Who we share data with

We work with providers that process data on our behalf, under contract. We do not sell personal data.

• DigitalOcean: hosting of the app, databases and files, in the Frankfurt data centre (EU).
• Brevo: sending emails.
• OpenAI: generating text and images with AI; we send only what your request needs. Transfers to the US rely on the European Commission's standard contractual clauses.
• Stripe: payments and subscriptions.
• Google, Meta, LinkedIn and the other platforms you connect: only the data needed to read your statistics or publish to your account.

6. How long we keep data

• Account data and what you created in the app: while the account is active. When the account is closed we delete it, except what the law requires us to keep.
• Invoicing records: for the period required by accounting law (currently 10 years).
• Sign-in session: at most 30 days.
• The emailed report and the marketing consent: until you withdraw your consent or ask us to delete them.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw your consent at any time. Write to [contact email] and we will answer within one month. If you are not satisfied, you can complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the authority in your country.

8. Security

Connections use HTTPS, passwords are stored only as hashes, tokens for connected accounts are encrypted, and access within an account is limited by role and by brand.

9. Cookies

We use a single, strictly necessary cookie for the sign-in session. The details are in the cookie policy.

10. Children

Symbiote is for businesses and professionals and is not aimed at anyone under 16.

11. Changes

When we change this policy we update the date above; for important changes we also tell you by email.