Privacy policy

This is a translation of the Romanian text, provided for convenience. In case of any difference of meaning, the Romanian version prevails, as the language in which the contract is concluded.

Updated on 6 October 2026.

Who processes the data

The Comunicate.eu platform is operated by ARC MEDIASOFT SRL, registered office at Aleea Botorani nr. 6, bl. V83, sc. 3, et. 5, ap. 79, sector 5, Bucharest, Romania, tax identification code RO32431001. For any question about your data, write to contact@comunicate.eu.

What data we collect and why

Account data — email address, name, password in irreversibly hashed form, preferred language. Without these we cannot create the account. Basis: performance of the contract.

Sign-in with Google — if you sign in with Google, we receive from Google your name, email address and Google account identifier, only to authenticate you. Basis: performance of the contract.

Organisation data — company name, tax and billing details, bank details for publishers. We use them to issue invoices and make payments. Basis: performance of the contract and legal tax obligations.

Site credentials — the user name and application password for the WordPress sites you register. They are encrypted with AES-256-GCM and never appear in readable form in the interface, in logs or in reports. We use them solely to publish the articles you order. Basis: performance of the contract.

Content — the articles, images and documents you upload, email to us for import or give us through a Google Drive link. For email import we also keep the sender's address and name, so that we know whose article it is and whom to reply to. The content stays yours; we store it, prepare it for publication and transmit it to the sites you choose. If other people appear in the content, you choose what data about them you include and you need a legal basis for it. Basis: performance of the contract.

Texts processed by artificial intelligence services — on import and when you ask for it, we send to artificial intelligence services of external providers the content meant for publication: the title and text of the article, its description and, when you order writing, the topic, the brand name, the promoted address and the information you give us for the article. We use them to suggest the search engine title and description, the summary, the tags and the alternative texts of images, to suggest the matching campaign type and, when you order writing, to suggest the structure and write the draft. We do not send the images: alternative texts are suggested from the text around them.

The providers do not receive your account data (email address, name, password), the organisation data, billing and payment details, addresses, the contact details in your client record, the site credentials or the IP address. Nor do we send them any identifier of your account. They do, however, receive everything written in the text of the article. If the article includes names, phone numbers or email addresses, for example a "Press contact" line, these reach the provider as well. When the article is the body of an email, the signature at its end may also be part of the text. Please do not put in articles personal data you do not want published.

What comes out is a suggestion: you see it on the article and can change it. If you have turned on automatic publication of articles received by email, the fields filled in this way go out with the publication without you seeing them first. We take no decisions with legal effects on you based on these suggestions. Basis: performance of the contract, for the writing you order, and our legitimate interest in preparing articles for publication quickly, for the rest (art. 6(1)(b) and (f) GDPR). You may object at any time to processing based on our legitimate interest by writing to contact@comunicate.eu (art. 21 GDPR).

Texts of organisations in the "Public Interest Press Releases" programme do not go through artificial intelligence services, except for paid services they order separately, such as having a text written. The programme rules are set out in its rules document.

IP address — we record it at sign-in, when terms are accepted, and in the audit log of important operations. We use it to be able to prove who did what and when, and to discourage abuse. The address is turned into a country and city locally, on our own server, using the GeoLite2 databases; we send it to no external service for that. Basis: legitimate interest in the security of the platform and, for the acceptance of terms, legitimate interest in being able to prove that the contract was concluded (art. 6(1)(f) GDPR). When terms are accepted we also record the browser type.

Consent for news and offers — if you tick at registration that you want to receive them, we keep the tick and the moment of it. The box starts empty: a pre-ticked box is not valid consent. Basis: your consent, art. 6(1)(a) GDPR. You may withdraw it at any time from your account's notification settings, with no consequence for your account or your orders; withdrawal does not affect messages sent before it. Notifications about your own orders do not depend on this tick.

Audit log — what changed, by whom, when, and from what address. Necessary so that we can answer questions about money and about published content. Basis: legitimate interest and legal obligations.

Cookies and what we keep in your browser

We use no tracking cookies and have no behavioural analytics tools. We use two cookies:

- the session cookie, to keep you signed in; - the birou_ref cookie, only if you reached us through a referral link. It keeps the referral code for 60 days, so that we can fill it in on the registration form, and holds no other data about you.

A few preferences you choose also stay in your browser: the theme, the text size, the currency and how the catalogue and the menu look. They are not sent to us.

What we do NOT do

We do not sell data, do not carry out advertising profiling, and take no automated decisions with legal effects on you.

Who we pass data to

The publications you choose yourself — the article, images and SEO metadata reach them so that they can be published. Without that there is no publication.

The bank through which we collect payments — when you pay by bank transfer, we see the data in the payment order: the payer, the account and the amount. We do not receive or keep card data.

Public tax verification services — when you fill in the company's tax code, we check it with ANAF, the Romanian tax authority, or, for companies from other European Union states, in the European Commission's VIES system, so that we can pre-fill and check the billing details.

The hosting provider — the app and the database run on servers in a data centre in the European Union.

The page delivery and protection service — traffic to the platform passes through a proxy and cache service that sees the IP address and the requests in order to deliver them and stop attacks.

Artificial intelligence service providers — they receive only the texts described above, under "Texts processed by artificial intelligence services". Each provider keeps and uses the texts it receives under its own terms. That is why we send them only content meant for publication.

Authorities — only where the law obliges us, and only what is requested.

Data outside the European Economic Area

Some service providers process data outside the European Economic Area as well, for example in the United States. The transfer relies on an adequacy decision of the European Commission (art. 45 GDPR), such as the one for the EU–US Data Privacy Framework, or on the standard contractual clauses adopted by the Commission (art. 46 GDPR), as the case may be. For texts sent to artificial intelligence services, each provider's own terms apply as well.

You can ask us for details about these safeguards at contact@comunicate.eu.

How long we keep it

Account data for as long as the account exists, plus 30 days after deletion. Financial and audit records are kept for 10 years, as tax law requires. Acceptances of terms are kept for as long as they could matter in a dispute: a deleted acceptance would be destroyed evidence. Content already published on third-party sites is no longer under our control; deletion there has to be requested separately.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, under the GDPR. Write to contact@comunicate.eu and we answer within one month at the latest. If you are dissatisfied, you may address the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro).

Deleting your account has one limit that is fair to know in advance: we cannot delete the financial and audit records the law obliges us to keep, nor the acceptances of terms.

Security

Passwords are stored with attack-resistant derivation functions, not reversibly encrypted. Site credentials are encrypted with keys kept separately from the database. All traffic travels over HTTPS. Administrative access is restricted by role and leaves a trace in the audit log.

Changes

When we change the policy, we publish the new text on this page, with the date of the update at the top. For important changes, we show the new policy to account holders the next time they open the app. Earlier versions remain archived; your confirmation is tied to the exact text you read.