Privacy Policy

This policy explains what personal data Cittago collects when you visit our website or get in touch, why we process it, who we share it with, and the rights you have. We keep it in plain language on purpose.

1. Who is responsible for your data

The data controller is Cittago S.R.L., a company registered in Cluj-Napoca, Romania. Our full company registration details are available on request. You can reach us any time at or +40 734 190 106 for anything related to your data.

2. What we collect

• Information you give us — your name, email, phone number, company and message when you use a contact or booking form, subscribe to our newsletter, or email us directly.
• Exposure-scanner data — the website address you submit to the email-exposure checker, the scan's findings, and the name and email you leave in order to receive the report. We keep an internal copy of the report so we can answer follow-up questions about it; delivering the report is a service you requested (Art. 6(1)(b)).
• Usage data — with your consent, anonymised analytics about how pages are used (for example pages viewed and approximate region), so we can improve the site.
• Technical data — standard server logs (IP address, browser type, timestamps) kept briefly for security and to keep the site running.

We do not knowingly collect special categories of data, and we do not buy or sell personal data.

3. Why we process it, and our legal basis

• To reply and provide services — because you asked us to, or to take steps before entering a contract (GDPR Art. 6(1)(b)).
• To send the newsletter — on the basis of your consent, which you can withdraw at any time (Art. 6(1)(a)).
• To keep the site secure and improve it — on the basis of our legitimate interest in running a safe, useful website (Art. 6(1)(f)), and your consent for non-essential analytics.

4. Cookies and analytics

We use a small number of essential cookies to run the site, and — only if you accept — analytics cookies to understand usage. You control this through the cookie banner and your browser. See our Cookie Policy for the full list.

5. Who we share it with

We share data only with service providers who help us operate — for example our email/newsletter platform, hosting provider and analytics tool — and only what they need to do their job, under contract. We may also disclose data where the law requires it. Where a provider processes data outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

5b. The AI chat assistant ("Alexia")

The chat on this site is answered by an experimental AI assistant. It only appears once you have accepted cookies, and your conversation is stored in your own browser so it survives while you move between pages.

What is sent, and where. The messages you type, plus the address of the page you are on, are sent to Groq, Inc. (United States), which generates the reply. This is a transfer outside the European Economic Area, safeguarded by the European Commission's Standard Contractual Clauses. Before anything leaves our server we automatically strip out anything that looks like an email address or a phone number.

What is never sent to the AI. If you choose to leave your contact details, they are collected by an ordinary form and go straight to our team by email — they are never passed to the AI provider.

Review. Because the assistant is experimental, we read conversations in order to improve it. Please do not type personal, confidential or sensitive information into the chat. If you ask us to email you a copy of a conversation, we send it only to the address you provide for that purpose.

The legal basis is our legitimate interest in offering and improving a support tool on our own website. Alexia's answers are generated automatically and can be wrong; see the Terms.

6. How long we keep it

We keep enquiry and client data for as long as needed to answer you and to meet legal or accounting obligations, then delete or anonymise it. Newsletter data is kept until you unsubscribe. Server logs are kept for a short period only.

7. Your rights

Under the GDPR you can ask us to give you access to your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time without affecting what came before. To exercise any right, email . You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro).

8. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS) and access controls. No method of transmission is perfectly secure, but we work to keep the risk low.

9. Children

Our website and services are intended for businesses and adults. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above always reflects the current version.

11. Contact

Questions about your privacy? Write to — Cittago S.R.L., Cluj-Napoca, Romania.