This policy tells you what personal data we process when you use einvestitii.ro, why, how long we keep it, who we share it with and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Romanian law (Law no. 190/2018 implementing the GDPR, and Law no. 506/2004 on privacy in electronic communications).
1. Who is responsible for your data
The controller of your data is (being completed), with its registered office at (being completed), unique registration code (being completed). For any question or request about your data, write to us at zmentaro@gmail.com.
2. What data we process, why and on what legal basis
| Situation | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| You visit the site | IP address, browser, pages requested, date and time | displaying pages, security, preventing abuse | legitimate interest in having a secure site (point (f)) |
| You create an account | email address, password (only its encrypted hash), confirmation that you are at least 18, version of the Terms accepted | creating and managing the account | contract (point (b)); proof of consent: legal obligation and legitimate interest (points (c), (f)) |
| You sign in with Google or Telegram | from Google: account identifier, confirmed email address, first name, photo; from Telegram: identifier, first name, username | password-free sign-in | contract (point (b)) |
| You fill in your profile | display name, @username, photo, cover image, bio, links, country, topics | public profile and the community | contract (point (b)) |
| You answer the welcome questions | experience, goals, interests, age group, how you heard about us | personalising the feed and internal statistics | consent (point (a)); the answers are optional |
| You use personal tools | watchlists, alerts, saved items, notifications, settings | making the tools work | contract (point (b)) |
| You publish in the community | posts, comments, images (without EXIF and location data, which we remove), votes, polls, predictions, points, follows, blocks, edit history | hosting and displaying content, moderation | contract (point (b)); moderating breaches of the Community Rules: contract and legitimate interest (points (b), (f)); moderating illegal content: legal obligation under the DSA (point (c)) |
| You read and react in the feed | topics read, “Not interested” choices, muted accounts | ordering the “Top” feed (details in Moderation and the Digital Services Act (DSA)) | contract (point (b)); you can choose “Latest” at any time |
| You buy a subscription | plan, billing details (name, address, company and tax code, where applicable), payments, invoices, consents given at payment | concluding and performing the contract, invoicing, accounting | contract (point (b)); legal obligation (point (c)) |
| You join the waiting list for the subscription | email address, chosen plan, the billing details you fill in | letting you know when payments open, so that you do not have to fill in your details again | consent (point (a)), which you can withdraw at any time from your account |
| You withdraw from the contract | date, amount, days used, truncated IP address | the refund and proof of withdrawal | legal obligation (point (c)) |
| You receive emails | email address, template, date, delivery result | account emails, and the alerts and digests you chose | contract (point (b)) |
| You subscribe to the newsletter | email address, date, wording of the consent, language, truncated IP address | news and offers, including from partner brokers | consent (point (a)), which you can withdraw at any time with one click |
| You invite friends | your code, who came through it, encrypted hashes of the networks you connect from (not IP addresses) | granting free days and preventing abuse | contract (point (b)); legitimate interest in preventing fraud (point (f)) |
| You report content or are reported | reported content, reason, decision, name and email address (in the DSA form), truncated IP address | handling notices, giving statements of reasons, appeals | for illegal content, legal obligation under the DSA (point (c)); for breaches of the Community Rules, contract and legitimate interest (points (b), (f)) |
| Account security | log of sign-ins and important changes (with IP address and browser), encrypted hashes of known devices | protecting the account, the “Sign-in from a new device” email, investigating abuse | legitimate interest (point (f)) |
| You write to us | your email address and what you write | replying to your message | legitimate interest (point (f)) or contract (point (b)) |
| You accept statistics or advertising cookies | online identifiers, interactions with the site and with ads | usage statistics, campaign measurement, ads | consent (point (a)), see the Cookie Policy |
You need to give us your email address and a password (or a Google or Telegram account) to have an account, and your billing details to buy a subscription. All other data is optional.
We do not ask for and do not want sensitive data (health, religion, political opinions). Please do not publish such data about yourself or others.
3. What is public
Your public profile shows your display name, @username, photo, cover image, bio, links, the date you joined, your number of followers and of accounts you follow, the likes you have received, your points and your level. Your country and topics are shown by default, but you can hide them. Your watchlist, your prediction score and your prediction history are shown only if you make them public yourself, from Account → Profile → “What your profile shows”.
Posts and comments are public. Posts with enough content and active profiles may appear in search engines. Votes in polls and predictions are anonymous.
4. Automated decisions and profiling
We order the “Top” feed according to your interests and we automatically filter spam and scams. None of this processing produces legal effects concerning you. Any automated block can be reviewed by a person on request. Stock verdicts are calculated by a model, but they are about companies, not about you.
5. Who we share your data with
We do not sell your data. We share it only with the providers that help us run the site (processors, under a contract in line with Article 28 GDPR), with authorities when the law requires it, and with other controllers only in the cases below:
- Hosting and email: Hostinger International Ltd., Cipru, where the site, the database and the mailboxes are hosted.
- Cloudflare: protecting the site, the Turnstile anti-bot check on forms and, where applicable, the approximate country derived from the IP address.
- Bunny.net: where we use it, delivering the site's images and files (CDN).
- The payment processor (being completed): payments and card details, which we never see.
- Google and Telegram: only if you sign in with them (independent controllers).
- Have I Been Pwned: we check whether a new password appears in public data breaches. We send only the first 5 characters of the password hash, never the password or your email address.
- TradingView: only after you press “Chart” or “Show live price” on an asset page, your browser connects to TradingView, which receives your IP address and your browser's technical data.
- News source websites: some news images load directly from the source's website, which sees your IP address.
- Statistics and advertising partners (for example Google, Meta, TikTok): only if you give your consent in the cookie banner.
- ANAF (the Romanian National Agency for Fiscal Administration): invoices, through RO e-Factura (the Romanian national e-invoicing system), where the law requires it.
- Authorities and courts: when we are legally obliged to (for example, ASF, the Romanian Financial Supervisory Authority; the police; the public prosecutor's office; ANCOM, Romania's Digital Services Coordinator; ANSPDCP, the Romanian data protection authority).
- A buyer of the business: if the site is taken over by another company, the data passes to it with the same safeguards, and you are informed.
When you go to a broker's website through an affiliate link, the broker learns that you came from us. We do not send them your account data.
6. Transfers outside the EU
Some providers (for example Cloudflare, Google, Meta, TradingView) may process data in the United States or in other countries outside the EU. For certified providers, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework. For the others (for example TikTok, which is not certified), we rely on the European Commission's standard contractual clauses. We add the safeguard used for each partner to the list above when we enable that partner. To get a copy of the safeguards, write to us.
7. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and profile | for as long as you have an account |
| Unconfirmed accounts | 7 days, then they are deleted |
| Server logs (IP addresses, pages requested) | up to 30 days |
| Security log (IP addresses, browser) | 90 days |
| Bell notifications | 60 days |
| Log of emails sent | 30 days |
| Triggered price alerts | 90 days |
| “Beat the estimate?” votes | 7 days after the results are reported (only the anonymous totals and your accuracy remain) |
| Poll votes | 180 days after the poll closes (the totals and scores remain) |
| Reports of comments, posts, profiles and arguments | 180 days |
| Log of moderation decisions | 1 year |
| Daily activity (for statistics) | 400 days |
| News stories and their comments | 30 days without activity or 90 days, then they are deleted together with their comments |
| DSA notices and appeals | 3 years from the decision, to defend ourselves in any disputes and to answer requests from authorities |
| Invoices and accounting documents | as long as financial and accounting law requires (usually 5 years, and 10 years for ledgers) |
| Contract withdrawal data | 5 years, as supporting documents for the refund (Accounting Law no. 82/1991) |
| Newsletter consent | for as long as you are subscribed and for 3 more years, as proof |
| Waiting list for the subscription | until you buy the subscription, leave the list or delete your account |
| Answers to the welcome questions (experience, goals, interests) and network hashes for invitations | for as long as you have an account |
| Messages you send us | until the matter is resolved and for 3 more years, in case of complaints |
| Versions of the documents you have accepted | for as long as you have an account |
What happens when you delete your account
We delete your profile, watchlists, saved items, alerts, notifications, posts (with images and history), votes, predictions, points, follows and the logs linked to the account. Comments remain as “Comment deleted”, with no text and no author, so that discussions are not broken. We keep only what the law requires us to keep (invoices, withdrawals, DSA notices), unlinked from the account, for the periods above.
8. Your rights
- Access and portability: download a copy of your data from Account → My data → “Download file” (JSON format).
- Rectification: correct your data in your account or write to us.
- Erasure: delete your account from Account → My data, or ask us to erase your data.
- Restriction, for example while we check a dispute about the accuracy of your data.
- Withdrawing consent, at any time, without affecting what was done before: for the newsletter, through the link in the email or in your account; for cookies, through “Cookie settings”, the link in the site footer (it appears when we use cookies that require your consent).
- Not to be subject to a decision based solely on automated processing that significantly affects you: ask for a review by a person.
Right to object: you can object at any time to processing based on our legitimate interest by writing to us at zmentaro@gmail.com. You can also object at any time to the processing of your data for direct marketing, including the newsletter.
We reply within one month at most (which may be extended by two months for complex requests, in which case we will tell you). We may ask for proof that you are the account holder. You have the right to lodge a complaint with ANSPDCP (the Romanian data protection authority), B-dul G-ral Gheorghe Magheru nr. 28-30, București, dataprotection.ro.
9. Minimum age
The site is intended for people aged 18 and over. We do not knowingly ask for or keep data about minors. If you find out that a minor has an account, write to us and we will delete it.
10. How we protect data
The connection is encrypted (HTTPS, with HSTS), passwords are stored only as encrypted hashes, uploaded images are stripped of metadata, team access is limited, and IP addresses are truncated or encrypted where we do not need them in full. If a personal data breach occurs that puts you at risk, we will tell you, as the GDPR requires.
11. Changes to this policy
When we change something important, we tell you in advance by email and in your notifications. The current version and previous versions are on this page.
Document versions
The date from which each version applies and what changed.
- Version 1 in force