Privacy policy

OneSpec is a digital product of CORE829 SRL, which operates it from its registered office at Str. Mihai Eminescu, 10, Roman, România, CUI/CIF RO54616345 — Reg. com. J2026029428009, phone +40 766 668 482 (Romania) · +39 375 946 8881 (Italy), PEC (Italian certified email): not applicable — CORE829 SRL is a company under Romanian law, which has no PEC system.

For any request concerning personal data you can write to hello@onespec.eu. No Data Protection Officer (DPO) has been appointed; DPO contact details: not applicable — no DPO appointed at the date of review.

Account: name, email address, preferred language, country (derived at sign-up from the network or the browser language), date of birth (asked at sign-up only to check that you are of age), sign-up date, email verification status.

Two-step verification (optional): if you enable it we keep the authenticator app secret in encrypted form, the fingerprint (hash) of the recovery codes and the number of failed attempts; we do not keep the one-time codes generated by your app.

Organisation: company name, VAT number, address, phone and email entered by the user in the branding settings.

Quote requests generated by the widget: name, email, phone, company and message of the prospective customer, together with the chosen technical configuration and the calculated indicative price.

Widget technical data: hash of the IP address (the plain IP is not stored), user agent, outcome of the anti-bot check, anti-spam score.

Support: subject, text and attachments (images or PDF) of the tickets you open from the platform, category, status, any rating from 1 to 5, our team's replies and the internal processing notes (not visible to you).

«Contact us» page (for those who cannot sign in): name, email address and message you enter, chosen topic, language and hash of the IP address (the plain IP is not stored) used to limit abuse.

Activity log (audit log) of administrative actions and sensitive operations, including actions on tickets (identifiers and type of action, without the text of messages).

Invite programme: invite code, linked accounts, invite status and reward amount; for money rewards, the Stripe Connect account identifier and the tax documents sent (invoice and certificate of tax residence).

Providing the service and managing the account — performance of the contract (Art. 6(1)(b) GDPR).

Support through tickets — performance of the contract (Art. 6(1)(b)). Replying to messages sent from the «Contact us» page by people without an account — pre-contractual or contractual measures taken at the data subject's request (Art. 6(1)(b)) and, for non-contractual requests, legitimate interest in replying (Art. 6(1)(f)).

Security, abuse prevention, rate limiting and audit (including on the «Contact us» page and on tickets) — legitimate interest (Art. 6(1)(f)).

Emails about tickets (new reply, ticket resolved) are service messages linked to your request, not marketing messages; you can turn them off in the notification preferences.

Sending product and marketing communications — consent (Art. 6(1)(a)), which can be withdrawn from the Account page.

Tax and accounting obligations relating to paid subscriptions — legal obligation (Art. 6(1)(c)).

Invite programme — performance of the accepted rules (Art. 6(1)(b)); checking and keeping the tax documents of money rewards — legal obligation (Art. 6(1)(c)); anti-abuse checks — legitimate interest (Art. 6(1)(f)).

Account data: for the whole duration of the relationship, deleted within 30 days of the deletion request.

Quote requests, activity log and security logs: kept for as long as the organisation is active on the platform; there is currently no scheduled automatic deletion of these data, which are deleted on request following the procedure described in the «Data subject rights» section.

Support tickets: closed tickets are deleted automatically, with messages, internal notes and attachments, 730 days (24 months) after the last activity; resolved tickets with no further replies close by themselves after 7 days; files uploaded but never sent are deleted after 24 hours. This period serves to handle any disputes about the support provided and to defend a right in court.

Messages from the «Contact us» page: deleted 90 days after being handled and in any case within 365 days of receipt.

In-app notifications: 365 days. Log of service emails sent: 90 days.

When the account is deleted we also delete the tickets, messages, internal notes and attachments you opened and the «Contact us» messages sent with your email; only identifiers and type of action, without text, remain in the activity log.

Tax documents relating to paid subscriptions: for the period required by the tax and accounting rules applicable at the controller's registered office.

A ticket is visible to the person who opened it, to the owners and administrators of their organisation on the platform and to OneSpec support staff who are expressly authorised and bound to confidentiality. Every opening of an attachment by our staff is logged. Before being made available, attachments go through an automatic security check (detection of malicious content and integrity signature); rejected files are not kept. This is an internal check, not a third-party antivirus service. The team's internal notes are not visible to the customer.

For your contact details and for handling support, OneSpec acts as controller. If instead you enter personal data of third parties in the ticket (for example your organisation's customers), OneSpec processes them as processor, on behalf of your organisation, under the data processing agreement (DPA) and only to resolve the request. Enter only the data that is strictly necessary.

Never send passwords, verification codes, payment card data, special categories of personal data (Art. 9 GDPR, for example health data) or identity documents: they are not needed for support.

OneSpec relies on the following providers, which process data on behalf of the controller under agreements pursuant to Art. 28 GDPR:

• Convex (Convex, Inc.) — database, application backend and storage of files attached to support tickets. Data location: United States of America.

• Stripe (Stripe Payments Europe, Ltd.) — management of subscriptions and payments; card data are processed directly by Stripe and neither pass through nor are stored by OneSpec.

• Resend (Resend, Inc.) — sending of transactional emails (verification codes, quote notifications, support ticket alerts; the latter do not include the text of messages).

• Cloudflare Turnstile (Cloudflare, Inc.) — anti-bot check on quotes sent from the widget and on the sign-in, sign-up, password recovery and «Contact us» forms.

• Vercel (Vercel, Inc.) — hosting of the web application and the website, performance measurement (Speed Insights, no cookies) and aggregate visit statistics (Web Analytics, no cookies, only with prior consent).

• PostHog (PostHog Inc.) — product analytics and session recording (clicks, scrolling, navigation) to find and fix malfunctions; values typed into form fields remain masked. Active only after explicit consent through the cookie banner.

• Sentry (Functional Software, Inc.) — detection of technical errors; visual session recording (Session Replay) is active only after the same consent, while error reporting alone always stays on to ensure the security and stability of the service.

Any transfers to third countries take place on the basis of the European Commission's Standard Contractual Clauses. The up-to-date list of sub-processors with their details is available on request at hello@onespec.eu.

As a data subject you can exercise the rights under Articles 15–22 GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

Access and portability: from the Account page you can download a copy of your data in JSON format at any time; the export also includes the support tickets you opened (with our team's replies and the names of attached files) and the messages sent from the «Contact us» page with your email address. The export also includes the internal processing notes on your tickets, within the limits set by law (information concerning other people or that would infringe the rights of others is excluded). Technical security data (for example the IP address, kept only as a hash) are pseudonymised personal data and can be requested at hello@onespec.eu.

Erasure: from the Account page you can request deletion of the account; the request is carried out after a 30-day cooling-off period, unless retention obligations apply. Deleting the account also deletes the support tickets you opened, their messages, internal notes and attachments, and the messages sent from the «Contact us» page with your email.

Complaint: you can lodge a complaint with the supervisory authority if you believe the processing breaches the law. Since the controller is established in Romania, the lead authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, dataprotection.ro); you can in any case contact the authority of the country where you live or work (for Italy, the Garante per la protezione dei dati personali).

Any updates to this policy are published on this page with the new revision date. Substantial changes are also communicated by email to registered users.

For contractual matters, disputes or legal notices concerning this document: office@core829.net.

For sales enquiries: sales@core829.net. For support on the service and requests for custom Enterprise plans: hello@onespec.eu.