Log inGet Started

Privacy Policy

Contents

1. Who is responsible for your data

EconoBeats (www.econobeats.com) is operated by BARBU ROBERT-FLORIAN PERSOANĂ FIZICĂ AUTORIZATĂ, registered in Romania, fiscal identification code (CUI) 52399410, registered with the Trade Register under number F2025031472006, professional seat at Str. Principală nr. 30, sat Delureni, comuna Valea Mare, jud. Vâlcea, Romania, e-mail contact@econobeats.com. The same identification data appear at the top of the Terms of Service.

We are the controller of the personal data described in this policy, within the meaning of Regulation (EU) 2016/679 (GDPR). This policy explains what we process, why, for how long, who else touches the data and what you can ask us to do.

We have not appointed a data protection officer, because we do not fall within any of the cases listed in Article 37 GDPR. For anything concerning your data, write to contact@econobeats.com; the message reaches the person who decides on it.

2. What data we process and where it comes from

Most of what we hold comes directly from you, when you create an account, buy a subscription, set your preferences or write to us. The rest reaches us in other ways: the billing details you type on Stripe's payment page and the state of your subscription come to us from Stripe, your IP address is sent by your browser with every request, and technical logs are produced by the servers themselves.

  • Account data — your e-mail address, which is required, and your name, which is optional. Your password is never stored in a readable form: authentication is handled by Supabase, which keeps only a cryptographic hash of it. Neither we nor anyone else can read it back.
  • Subscription data — the plan you bought (1, 3 or 12 months), the status of the subscription, the end of the period you have paid for, whether you have cancelled, and your Stripe customer identifier. Card details never reach EconoBeats: payment happens on a page hosted by Stripe.
  • Billing data — the billing name and the billing address you enter on Stripe's payment page, the country, and, if you buy as a legal person or in the exercise of a profession, the name of the business and its VAT identification number. Stripe collects them there, keeps them on your customer record and passes them to us for the invoice. We ask for them because an invoice has to carry them.
  • Order data — on our own checkout page, before you are taken to Stripe, you choose whether you buy as an individual or as a legal person or in the exercise of a profession, which decides only the data that goes on the invoice, and you tick the box in which you expressly request immediate access to the platform and acknowledge that, once access starts, you lose your right of withdrawal. We store that request and that acknowledgment, with the date and time you gave them, with the Stripe payment session, and we confirm them in the order confirmation e-mail.
  • Preferences — the interface language and the region you select on the site, and the alert settings you choose for individual indicators.
  • Messages you send us — the name, e-mail address and text you submit through the contact form, and anything you write to us at our published addresses.
  • Newsletter — if you have a subscription, you receive the Market Outlook newsletter at the e-mail address of your account and we collect no other data for it; if you ask us to stop sending it, we keep a note of that request. If you do not have a subscription and sign up through the form on the public site: your e-mail address, the status of the sign-up, the form you signed up from, the date you signed up, the date of confirmation where there is one, and an internal identifier for the record.
  • Technical security data — your IP address, used for the anti-bot check on public forms and for the limits on how often the same form can be submitted.
  • Server and security logs — the providers that host the platform and the authentication (Vercel and Supabase) keep technical logs of requests, errors and sign-in events, which contain the IP address, the moment and what was called. We use them for nothing other than running and securing the service, and we do not copy them into our own database.

We do not buy personal data from anyone and we receive none from data brokers or advertising networks. We use no analytics tools, no advertising, no tracking pixels and no social-network buttons. We build no profiles and we do not track your behaviour on the site.

3. Why we process your data and on what legal basis

  • Creating and running your account — e-mail address, optional name, password hash, confirmation of your address. Basis: performance of the contract, Article 6(1)(b) GDPR.
  • Selling and administering the subscription — plan, subscription status, end of the paid period, cancellation, Stripe customer identifier, and the order data described in section 2. You choose the plan and the invoicing option, and give the express request and acknowledgment, on our own checkout page; the secure payment page where you enter your card and the billing portal where you manage or cancel the subscription are hosted by Stripe. Basis: performance of the contract, Article 6(1)(b) GDPR, and, for keeping the record of your express request and acknowledgment and confirming them to you by e-mail, compliance with our legal obligations under Government Emergency Ordinance no. 34/2014 on consumer rights, Article 6(1)(c) GDPR.
  • Giving access to member content — the status of your subscription, checked on our server every time you open a members' page, so that access follows what you have paid for. Basis: performance of the contract, Article 6(1)(b) GDPR.
  • Your preferences — language, region and the per-indicator alert settings, so the platform behaves the way you set it. Alert e-mails are not sent yet: today we only store the setting you chose, and we will describe those messages here before the first one goes out. Basis: performance of the contract, Article 6(1)(b) GDPR.
  • Service e-mails — confirmation of your address, password reset, the welcome message, the order confirmation (which sets out your plan, the price, the renewal date and how to cancel, and confirms your express request for immediate access and your acknowledgment that you lose the right of withdrawal, with their date and time), notice of any price change at least 30 days before it applies, and messages about your subscription or a change of plan. Basis: performance of the contract, Article 6(1)(b) GDPR.
  • Invoicing, accounting and tax records — your billing name and billing address, the name of the business and its VAT identification number if you buy as a legal person or in the exercise of a profession, your e-mail address, your name if you have given one, the plan and the amount paid. Basis: performance of the contract and compliance with our legal obligations, Article 6(1)(b) and (c) GDPR, in particular the Accounting Law no. 82/1991 and the Fiscal Code.
  • Handling withdrawal, refund and complaint requests — e-mail address, subscription, billing and payment data, and the content of your request. Basis: performance of the contract and compliance with our legal obligations, Article 6(1)(b) and (c) GDPR.
  • Answering messages sent through the contact form — name, e-mail address, message. Basis: steps taken at your request before entering into a contract, Article 6(1)(b) GDPR, or our legitimate interest in replying to you, Article 6(1)(f) GDPR.
  • The Market Outlook newsletter, for subscribers — the e-mail address of your account. The newsletter is part of what your subscription includes, and we send it to that address. Basis: performance of the contract, Article 6(1)(b) GDPR. You can stop receiving it at any time, free of charge, by writing to newsletter@econobeats.com; section 11 gives the details.
  • The Market Outlook newsletter, for readers without a subscription — the e-mail address and the other details listed in section 2, if you sign up through the form on the public site. Basis: your consent, Article 6(1)(a) GDPR, together with Article 12 of Law no. 506/2004; you may withdraw your consent at any time.
  • Keeping the platform and its users safe — your IP address, used by the anti-bot check on public forms and by the limits on form submissions, together with a check of a newly chosen password against public lists of leaked passwords, where that service answers. Basis: our legitimate interest in preventing automated abuse and fraud and in keeping the network and the information secure, Article 6(1)(f) GDPR, read with Recitals 47 and 49.
  • Running and securing the servers — the request, error and sign-in logs described in section 2. Basis: our legitimate interest in operating the service and investigating incidents, Article 6(1)(f) GDPR.
  • The daily backup of the database — a copy of our own tables: account, subscription, billing and invoicing records, newsletter addresses, contact messages and the anti-abuse counters. Your password is not in the copy: it stays in the authentication system's own area, which the copy does not cover. Basis: our legitimate interest in being able to restore the service and your data after an incident, Article 6(1)(f) GDPR.

What you have to give us. The e-mail address is necessary to create the account. The payment data and the billing name and address you enter on Stripe's page are necessary for the subscription and for the invoice; without them the contract cannot be concluded or performed. The box on our checkout page in which you expressly request immediate access and acknowledge that you thereby lose your right of withdrawal must be ticked for the order to be placed. Your name and the alert settings are optional, and nothing happens to your access if you leave them out. The Market Outlook newsletter comes with the subscription; asking us to stop sending it does not affect your access either.

The checkbox at signup. When you create an account you confirm that you accept the Terms and this policy, including the rule in the Terms that EconoBeats may be used only by persons aged 18 or over. That confirmation is a contractual acknowledgement, not consent to data processing: the processing needed for your account and subscription, including sending the Market Outlook newsletter to subscribers, rests on the contract between us, and signing up to the newsletter list for readers without a subscription is never part of that checkbox. The separate box you tick on our checkout page, in which you expressly request immediate access to the platform and acknowledge that you thereby lose your right of withdrawal, is not consent to data processing either: it is the express request and acknowledgment that consumer law requires for the right of withdrawal to be lost when digital content is supplied immediately (art. 16 letter m) of Government Emergency Ordinance no. 34/2014), and we keep a record of them, with their date and time, as described in section 2.

No profiling, no automated decisions. We take no decisions about you by automated means that produce legal effects or similarly significant effects, and we create no profiles. The only automatic step is the server-side check of your subscription status, which decides whether a members' page opens for you. It is an access control and nothing else.

4. Who else processes your data

We work with a small number of service providers. Most of them act only on our instructions and only for what we ask of them; two of them also decide on part of the processing themselves. Before a provider processes data for us, we conclude the data processing agreement it offers under Article 28 GDPR.

Providers acting on our instructions

  • Supabase — database, authentication and file storage, and the authentication and error logs that go with them. Data hosted in the European Union, in Frankfurt, Germany.
  • Vercel — hosting of the website and the platform, and the request and error logs it keeps. Data hosted in the European Union, in Frankfurt, Germany.
  • Resend — delivery of transactional e-mails, such as the confirmation of your address, the password reset, the order confirmation and the messages about your subscription.
  • Cloudflare — DNS for the domain and the Turnstile anti-bot widget shown on the public forms.
  • Google Workspace — the mailbox behind contact@econobeats.com, so any e-mail you send us is stored there.
  • GitHub — the daily copy of the database is stored there as a private artifact, which GitHub keeps encrypted at rest, for 90 days.

Providers that also act as controllers in their own right

  • Stripe (Stripe Payments Europe) — payments by bank card, the secure payment page on which you enter your card and confirm the payment, the payment session in which your express request and acknowledgment, with their date and time, are stored, the collection of the billing name, address and VAT identification number for the invoice, and the billing portal from which you manage or cancel your subscription. For the payment it makes for us, Stripe acts on our instructions; for its own legal duties, such as preventing fraud and money laundering and keeping records of payments, it decides for itself and is a controller. Its own privacy notice is at stripe.com/privacy.
  • SmartBill — invoicing. The invoice for each payment is issued in SmartBill and sent to the e-mail address of your account. SmartBill processes the data needed to issue and send it on our instructions, and also keeps, on its own account, the records required of an invoicing provider. Its privacy notice is published on smartbill.ro.

One outbound call carries no personal data. When you choose a password, our server asks the Pwned Passwords service, run by Have I Been Pwned, whether that password appears on public lists of leaked passwords, sending only the first five characters of a one-way fingerprint of it and nothing that identifies you or your account. We therefore do not list that service as a recipient of your personal data; section 7 explains how the check works.

Beyond these, we disclose data only where the law obliges us to, for example to a public authority acting within its powers, or to our accountant and, if it ever becomes necessary, to a lawyer defending a claim. We do not sell your data and we do not share it for anyone's marketing.

5. Transfers outside the European Union

Supabase and Vercel store the data in Frankfurt, but both are companies headquartered in the United States whose staff may access data in order to provide support. Stripe, Resend, Cloudflare, Google and GitHub are also headquartered in the United States. Some processing therefore involves a transfer of personal data outside the European Economic Area.

For each such recipient we rely either on the adequacy decision for the EU–US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795, where the recipient is certified under that framework, or on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with an assessment of the circumstances of the transfer. You can write to contact@econobeats.com to find out which mechanism applies to a given recipient and to obtain a copy of the safeguards in place.

The leaked-password check described in section 4 also reaches a service outside the European Union, but it transfers no personal data: the request carries a fragment of a one-way fingerprint and no identifier of any kind.

6. How long we keep your data

  • Account and subscription data — for as long as your account exists. There is no button for closing the account today: write to contact@econobeats.com and we delete the account and its data within 30 days, except what we must keep for accounting and tax purposes. Cancelling the subscription is a different thing: it stops the payments and ends access at the end of the paid period, but the account and its data stay until you ask us to delete them.
  • Accounting records relating to your payments, including the billing name and address, the VAT identification number and the invoices — 5 years, counted from 1 July of the year following the financial year in which they were drawn up, under Article 25 of the Accounting Law no. 82/1991.
  • The record of your express request for immediate access and of your acknowledgment that you lose the right of withdrawal, with their date and time — for as long as the subscription exists and, after it ends, for a further 3 years, the general limitation period under the Romanian Civil Code, because it is our proof if a withdrawal or a refund is disputed.
  • Messages from the contact form and e-mail correspondence — 12 months after the matter is closed.
  • Newsletter — for readers without a subscription, the data listed in section 2 for as long as you remain on the list; after you unsubscribe we keep the address and the record of your request for a further 12 months, as proof that we acted on it. For subscribers, the newsletter uses the account address, which we keep as account data, and a request to stop the newsletter is kept for as long as the account exists.
  • IP addresses used for the anti-bot check and the rate limits — we keep one counter per address and form, in windows from a few minutes up to one hour. A daily clean-up deletes these records once they are older than 30 days.
  • Server and security logs kept by Vercel and Supabase — for the period each provider applies under our plan, which we do not extend; write to us if you want to know the current period.
  • The daily database backup — 90 days, after which it is deleted automatically.

Where a request or a dispute is pending, we keep the data concerned until it is resolved, plus the period in which a claim can still be brought.

7. How we protect your data

  • Traffic between your browser and the platform is encrypted, so nobody on the way can read it.
  • Your password is never stored in a form anyone can read: only a one-way fingerprint of it is kept, by Supabase Auth. No one at EconoBeats can read it.
  • When you choose a password, our server asks a public service whether that password appears on lists of leaked passwords. We send only the first five characters of a one-way fingerprint — never the password, and nothing that identifies you. If the service does not answer, we let the password through rather than block you, so the check makes a leaked password less likely, not impossible.
  • We send a confirmation link to your e-mail address when you create an account, and the address has to be confirmed before the account can be used.
  • The database is reached only from our server, each table has its own access rules inside the database, and there is no database connection in your browser.
  • Access to member content is decided on our server, from the status of your subscription, not in your browser.
  • The login cookie cannot be read by any script in your browser and, in production, travels only over an encrypted connection.
  • The public forms — signup, login, contact and newsletter — are protected by the Cloudflare Turnstile anti-bot check and by limits on how often they can be submitted from the same IP address.
  • A copy of the database is made every day and stored as a private GitHub artifact, which GitHub keeps encrypted at rest, for 90 days, so that the service and your data can be restored after an incident. We add no encryption of our own on top of GitHub's. The copy covers our own tables, listed in section 3, and not your password.

For readers who want the mechanism: HTTPS on all traffic, row level security on every table, password hashing by Supabase Auth, httpOnly and Secure cookies, a k-anonymity range query against the Pwned Passwords API, and storage-side encryption at rest for the daily dump.

No measure makes any system absolutely safe. If a personal data breach occurs, we assess it, notify the supervisory authority where the law requires it and inform you directly where the breach is likely to put your rights and freedoms at high risk.

8. Your rights and how to exercise them

  • Access — to be told whether we process data about you and to receive a copy of it, together with the information in this policy (Article 15 GDPR).
  • Rectification — to have inaccurate data corrected and incomplete data completed (Article 16 GDPR).
  • Erasure — to have your data deleted where one of the situations in Article 17 GDPR applies, for example when it is no longer needed for the purpose it was collected for.
  • Restriction — to have the processing frozen while a dispute about accuracy or lawfulness is being settled (Article 18 GDPR).
  • Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where this is technically feasible (Article 20 GDPR).
  • Objection — to object to processing based on our legitimate interest (Article 21(1) GDPR), and to object at any time to direct marketing, in which case we stop immediately (Article 21(2) and (3) GDPR).
  • Withdrawal of consent — where processing rests on your consent, in practice the Market Outlook newsletter list for readers without a subscription, you can withdraw it at any time. Withdrawal does not affect the lawfulness of what was done before it (Article 7(3) GDPR).

To exercise any of these rights, write to contact@econobeats.com. It helps if you write from the address linked to your account, but that is not a condition: any clear request is valid, whatever channel it arrives by. Where we cannot reasonably tell who is asking, we may ask you for additional information to confirm your identity, and we ask for nothing beyond what is needed for that.

We answer without undue delay and in any case within one month of receiving the request. Where the request is complex or where there are several of them, we may extend that period by a further two months, and we tell you within the first month if we do. Exercising your rights is free of charge.

9. Complaining to the supervisory authority

If you consider that we process your data unlawfully, you can lodge a complaint with the Romanian supervisory authority, at any time and independently of any request you have made to us:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (A.N.S.P.D.C.P.), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania. Telephone +40.318.059.211 and +40.318.059.212, fax +40.318.059.602, e-mail anspdcp@dataprotection.ro, website www.dataprotection.ro.

You may also go to the competent courts. We would, of course, prefer that you write to us first, so that we have a chance to put things right.

10. Cookies

We use only cookies that are strictly necessary for the service you have asked for. We set no analytics, statistics, advertising or marketing cookies of any kind, and no third party places such cookies through our site. These are all of them:

  • sb-* — the login cookie, set by Supabase, our authentication provider. It keeps you signed in and tells the server which session a request belongs to. No script in your browser can read it, and in production it travels only over an encrypted connection. It survives closing the browser, so that you are not signed out every time, it is refreshed while you keep using the platform, and it lasts up to 400 days. Deleting it signs you out.
  • eb_locale — remembers the interface language you selected, English or Romanian. Lifetime: one year, which we are shortening, as explained below.
  • eb_region — remembers which regional data set you chose to view. Every available region is open to every subscriber, at the same price and with the same access, whatever country you are in. Lifetime: one year, which we are shortening, as explained below.

In addition, the public forms are protected by the Cloudflare Turnstile widget. The widget sets no cookie on our domain and writes nothing to our site's storage in your browser. The check itself runs inside a frame loaded from Cloudflare's own domain, challenges.cloudflare.com, and there Cloudflare may store or read technical information in your browser strictly in order to run the security check on that form and keep track of its state. Cloudflare does not publish a Turnstile-specific list of these items with their lifetimes; it describes what Turnstile collects in its Turnstile privacy addendum. They are not used for advertising, statistics or tracking. If you block them, the check may fail and the form cannot be submitted.

Why you do not see a cookie banner. Under Article 4(6)(b) of Law no. 506/2004, which implements Article 5(3) of Directive 2002/58/EC, consent is not required for storing or reading information in your device where it is strictly necessary in order to provide the information society service you have expressly requested. The login cookie exists only because you asked to sign in, the other two only remember a choice you made on the page, and we set nothing else — so there are no optional cookies for you to accept or refuse. We are also open about the two points where supervisory guidance is stricter than our present settings: a login cookie that survives the browser session and an interface cookie that lasts a year are not treated as automatically exempt. Rather than ask you to accept cookies we do not need, we are shortening the language and region cookies, adding a visible choice at sign-in for keeping you signed in, and putting a short note next to the language and region switchers saying that your choice is stored in a cookie. If we ever set a cookie that is not strictly necessary, we will ask for your consent before setting it.

You can delete or block cookies at any time from your browser settings. Deleting the sb-* cookie signs you out; deleting eb_locale or eb_region returns the site to its default language and region; blocking cookies altogether means you cannot sign in.

11. The newsletter

The Market Outlook newsletter reaches two groups of readers, on two different legal bases.

Subscribers

  • Part of the subscription. The Market Outlook newsletter is part of what your subscription includes. We send it to the e-mail address of your account for as long as your subscription is active, on the basis of the contract, Article 6(1)(b) GDPR. You do not need to sign up separately, and we collect no other data for it.
  • How you stop it. Free of charge, at any time, by writing to newsletter@econobeats.com or contact@econobeats.com. We act on the request without undue delay; stopping the newsletter does not affect your access to the rest of the platform, and we keep a note of your request so that we respect it.
  • When the subscription ends. We stop sending you the newsletter once the paid period ends, unless you have also signed up separately through the form on the public site.

Readers without a subscription

  • Consent. If you do not have a subscription, you receive the Market Outlook newsletter only if you have asked for it through the form on the public site. Creating an account and accepting the Terms and this policy does not put you on this list.
  • How you sign up. Signing up takes a single step: you enter your e-mail address in the form on the public site and submit it. We do not send a confirmation e-mail, so the address is added on the strength of that one action.
  • What we store. The address, the status of the sign-up, the form you signed up from, the date you signed up, the date of confirmation where there is one, and an internal identifier for the record.
  • Basis. Your consent, Article 6(1)(a) GDPR, together with Article 12 of Law no. 506/2004 and Article 6 of Law no. 365/2002 on electronic commerce, which allow commercial communications by e-mail only with prior express consent.
  • How you unsubscribe. Free of charge, at any time, by writing to newsletter@econobeats.com or contact@econobeats.com; we remove your address from the list without undue delay. Withdrawing your consent does not affect the lawfulness of what was sent before.

If we use a specialised e-mail provider to send the newsletter, we name it in section 4 before it receives any address.

12. Age

Under the Terms, EconoBeats may be used only by persons aged 18 or over, and you confirm that when you create your account. We do not ask for a date of birth and we do not verify age, so we cannot detect a breach of that rule by ourselves. If we learn that an account belongs to a person under 18, we close it and delete the data, keeping only what the law requires us to keep. If you are a parent or guardian and believe this has happened, write to contact@econobeats.com and we will deal with it.

13. Changes to this policy

We may update this policy, for example when we add a feature, change a service provider or when the law changes. The current version is always the one published on this page, and it carries the date of its last update below. Where a change materially affects how we use your data, we announce it on the platform and by e-mail to the address linked to your account before it takes effect.

This policy is published in English and in Romanian.

Last updated: 27 September 2026.