Planner privacy policy
Last updated: 11 October 2026
This policy applies to the Quadrart Development Planner application, at planner.quadrart.ro. The quadrart.ro website is covered by the website privacy policy.
The application belongs to Quadrart Wave S.R.L., registered office at 9 Prof. Ion Filibiliu St., building 2, room 1, apt. 28, District 3, Bucharest, registered with the Trade Register under no. J40/8008/29.04.2022, VAT ID RO46030913. You can write to us at office@quadrart.ro or call us on +40 740 057 440.
Who is responsible for the data
In the application we have two roles, depending on the kind of data.
Your account data and operational data: your name, e-mail address, password, sign-in sessions and acceptance of the terms. For these, Quadrart Wave S.R.L. is the controller.
What your company puts into the application: projects, documents, companies, contacts and their history. For this data, the company that bought access to the application (our client) is the controller, and Quadrart processes it on the client's behalf, as a processor, under the contract with the client. If you have a question or a request about this data, contact the company you use the application for first; we help them answer you.
What data we process
Your account. Your name, e-mail address and password; we keep the password only as a cryptographic hash, never in plain text. Your role and the company you work for, set by whoever creates your account. The date of your last sign-in, the date until which you have access (if there is one), whether the account is blocked, and your notification settings.
You cannot create an account yourself. An account is created by a Quadrart administrator or comes from an invitation. In the invitation, the person inviting you enters your e-mail address, the kind of access (user, beneficiary, designer, consultant, buyer), possibly the date until which you have access, the project or company, and a message; you enter your name and password yourself. The demonstration on the sign-in page asks for no data: the demonstration account lasts 15 minutes, and its project is deleted at the end.
What your company puts into the application.
- Projects: the name, the answers to the questions about the project, the recorded dates (for example, when an approval was obtained), durations, members and their roles.
- Uploaded documents of any kind. The application does not check what they contain, so a document may include personal data (for example, an identity document uploaded by the client).
- Companies: company data (VAT ID, registered office, shareholders and shares), registers (contracts, land plots with cadastral numbers, mandates and authorised persons, bank accounts, contacts with names and e-mail addresses) and documents. The “17 · Date personale” (personal data) folder is visible only to the company's managers and is never read automatically.
- Activity history: who changed something, what (the old and the new value) and when.
- What you opened in the data room: when you last opened the data room and which document versions you opened or downloaded. We use this to show you what is new.
Sign-in and security. At each sign-in we keep your IP address and browser type in your session. When you accept a confidentiality agreement for a project, a company or a transaction, we keep your name, e-mail address, on whose behalf you accept, your IP address, the text of the agreement and the time; the IP address also appears in that place's history, visible to those who have access to it. When you accept the terms and the policy on creating your account, we keep the date of acceptance and the page addresses at that time.
What we do not do. We do not measure how you use the application: we do not record pages opened, clicks or time spent, and we use no traffic analytics tools. The application's pages load nothing from third-party services. We do not sell or rent data.
Why we process the data and on what legal basis
For the data for which we are the controller:
| What | Why | Legal basis |
|---|---|---|
| Your account: name, e-mail, password, role | so you can use the application contracted by the company you work for | our legitimate interest and the client's in providing and using the contracted application |
| Sessions, with IP address and browser; security logs; limits on sign-in attempts | to keep the application secure and stop unauthorised access | our legitimate interest in protecting the application and the data in it |
| Acceptance of the terms and of confidentiality agreements, with the date and, for agreements, the IP address | so we can prove what was accepted, when and by whom | the legitimate interest in being able to prove acceptance |
| The application's e-mails: invitations, password links, notifications; daily digests only if you chose them | so invitations, password changes and notifications work | the legitimate interest in providing the application |
| Your name in the history, also after your account is deleted | so the project history stays complete and accurate | the client's legitimate interest in keeping a complete project history |
| Usage records: questions to the Assistant and automated readings, with the date, account and cost | to calculate the caps and the usage under the contract | performance of the contract with the client and the legitimate interest in keeping usage records |
These legal bases are those of Regulation (EU) 2016/679 (GDPR), Art. 6(1): point (f), legitimate interests, and point (b), performance of a contract. Because the application is sold to companies, in most cases it is not you who is party to the contract but the company you work for; that is why the main legal basis is legitimate interest. You may object to processing based on legitimate interest; see “Your rights”.
For the data your company puts into the application, the legal basis is determined by the company, as controller.
The Quadrart Assistant and automated document reading
These functions start only when you use them: automated reading when you press Citește (Read); the Quadrart Assistant when you ask a question. Only those whose plan includes them have them.
For automated reading we send: for a PDF with text, only the extracted text, page by page; for a scanned PDF, the file (possibly only the first pages); for an image, the image. Alongside it we send the list of fields to look for (for example the document number, the date, the issuer) and, for a project document, the project's questions. We do not send the name of the client or of the person.
For the Quadrart Assistant we send your question, the earlier questions and answers in the same conversation, a summary of the page you are on (read with your permissions), the relevant guide articles and the legal extracts from the Quadrart regulatory library. The Assistant can also read other data in the application, only what you can see yourself. We do not send the contents of files in the data room, Qstorage, the “Analize clienți” (client analyses) pages or the “17 · Date personale” folder.
For automated document reading and for the Quadrart Assistant we use the services of Anthropic, PBC (USA) as another processor. We send Anthropic only what a request requires: the document you submit for reading or your question, together with the project data needed to answer it. Anthropic processes this data solely to provide the service, in accordance with its data processing agreement, and does not use it to train its models. Transfers outside the European Economic Area rely on standard contractual clauses adopted by the European Commission. Anthropic's list of sub-processors is published at anthropic.com/subprocessors.
The Quadrart regulatory library is a service of ours, on the same server, connected to the application by an internal network that does not reach the internet. When the Assistant looks up the law, it sends the library the search it formulates: the search text, the act, the article, the date. For each search, the library keeps the time, a randomly generated session code that does not identify you, the search text, the act and article searched for and the references found. It does not keep your IP address, name, e-mail address, your question as such or the Assistant's answer. The log stays only on our server and is deleted after 12 months.
What we keep. For automated reading, the values found remain for as long as the document exists, and the quotation from the document and the page are deleted automatically after 12 months. For the Quadrart Assistant, questions and answers are kept for 12 months; after that their text is deleted, and only the date, account, company, project and cost remain, for usage records. A note you write when flagging an answer as wrong is not deleted. The ongoing conversation with the Assistant stays only in your browser, in the open tab, until you close it or start a new conversation.
The Assistant's answers and the data proposed by automated reading are generated automatically and may contain errors. See the terms of use.
Who we share data with
The application's data is processed on our behalf by the following providers:
| Provider | What it does | Where |
|---|---|---|
| netcup GmbH | hosts the application server: the database, the files and the local backups | data centre in Vienna, Austria |
| Hetzner Online GmbH | keeps the external backup, encrypted before it leaves our server; the provider cannot read its content | Falkenstein, Germany |
| Zoho Corporation, through the ZeptoMail service | sends the application's e-mails: invitations, password links, daily digests, notifications. It receives the recipient's address, the subject and the text. We do not track whether you open the e-mails or click the links in them. | European Union data centre |
| Anthropic, PBC | automated reading and the Quadrart Assistant, as described above | USA |
ANAF. We send the tax identification numbers (CUI) of the companies in the application to ANAF's public VAT payer service, on request and every night, to retrieve the company's public data: name, registered office, registration number, CAEN code and VAT payer status.
We may disclose data to public authorities where the law requires it.
Who at Quadrart has access
Quadrart administrators have access to all data in the application: projects, documents, companies, history, invitations and questions flagged as wrong. Their access does not require a particular reason or the client's consent. What an administrator changes appears in the history under their name, as for any user; opening a page leaves no trace, again as for any user.
Administrators use the data only for operating, maintaining and securing the application and for support.
Each administrator has undertaken in writing to keep the data confidential.
How long we keep the data
| What | How long |
|---|---|
| Your account | For as long as the account exists. On deletion, the account, the password and the sessions go. Your name remains in the history, in the entries you left, and an “account deleted” entry remains, with the name and e-mail address. |
| The IP address and browser of a sign-in | For the duration of the session (at most 7 days from last use and at most 30 days from sign-in) and at most 30 days after it expires; they are then deleted automatically. |
| What your company puts into the application | For the duration of the contract with the company. When the contract ends, the company may request an export of the data, and we delete it within 30 days. We carry out the export and the deletion manually. The export includes what the application can produce: the archives of the data rooms, companies and transactions, the Excel lists and the schedule as PDF; the history and the answers cannot be exported as data. |
| Activity history | Not deleted. When a project is deleted, its history remains, as text, in a folder of deleted projects, visible to those who could see the project. |
| Acceptance of a confidentiality agreement, with the IP address | Remains in that place's history. |
| Acceptance of the terms | For as long as the account exists. |
| The Quadrart Assistant and automated reading | See above. |
| Server logs with IP addresses (errors, blocked attempts) | 30 days. |
| The regulatory library log (the Assistant's searches, without IP or name) | 12 months. |
| Backups | At most 12 months. What is deleted from the application remains in the backups until they expire. |
Cookies and browser storage
The application uses a single cookie, __Secure-better-auth.session_token, which keeps you signed in. It lasts 7 days from last use and at most 30 days from sign-in. It belongs to the application, not to a third party, and cannot be read by the page's scripts. The application cannot work without it.
For convenience, the application also keeps a few display preferences in your browser: recently opened places and favourites, column and panel widths, which tabs and branches you left open, saved views. In the open tab it keeps the ongoing conversation with the Assistant. None of this leaves your browser for us or anyone else, and the application works without it.
Security
The application is used only over HTTPS. Passwords are kept only as cryptographic hashes. A new password has at least 8 characters, with a lower-case letter, an upper-case letter, a digit and a special character. A forgotten-password link is valid for one hour and can be used once. After 20 sign-in attempts per minute from the same address, attempts are refused. The database cannot be reached from the internet. The external backup is encrypted.
What we do not have, so you know exactly: the data is not encrypted on the server's disk, so anyone with access to the server, including the hosting provider, can read it; the external backup is encrypted. There is no two-factor authentication.
If a personal data breach occurs, we notify the client without undue delay, and in any case within 72 hours of becoming aware of it.
Your rights
You have the right of access to your data, and the rights to rectification, erasure, restriction of processing, objection to processing based on legitimate interest, and data portability. For your account data, write to us at office@quadrart.ro. For the data your company put into the application, contact the company; we help them answer you.
If the answer does not satisfy you, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Blvd, District 1, Bucharest, dataprotection.ro.
Changes
We may update this policy. The version in force is the one published here, with the date of last update shown at the top.
We notify clients in advance, by e-mail, of significant changes, and at your next sign-in the application asks you to accept the new version.