SAGEPrivacy Policy
Last updated: 6 November 2026 · draft pending legal review
This explains what personal data [name] ("we") collects through sage-edge.com, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Controller
[name], CUI [cui], [address]. Privacy contact: [dpo_email].
2. Data, purpose and legal basis
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address, password (stored only as a one-way hash) | Create and run your account, log you in | Contract (art. 6(1)(b)) | While the account exists |
| Confirmation that you are 18+ and accepted the Terms, with date | Prove eligibility and consent | Legal obligation / legitimate interest | While the account exists + 3 years |
| Purchases (item, week, amount, currency, Stripe references), subscription status, withdrawal-waiver confirmation | Deliver what you bought, accounting, refunds, disputes | Contract; legal obligation (accounting law) | As accounting law requires (up to 10 years) |
| IP address and timestamps of login/sign-up attempts | Block abuse and brute-force attacks | Legitimate interest (security) | 24 hours |
| Session cookie | Keep you logged in | Strictly necessary | Until you close the browser |
| Language choice and watchlist (stored in your browser only) | Your convenience; never sent to us | Strictly necessary / your request | On your device until you clear it |
We do not run advertising or analytics trackers, we do not sell your data, and we make no decisions about you by automated means with legal effects.
3. Who receives data
Stripe (payment processing; an independent controller for payment data that may transfer data outside the EU under standard contractual clauses). Our hosting provider (stores the Site and its database). Authorities where the law requires. Nobody else.
4. Your rights
You can ask for access, correction, deletion, restriction, portability, object to processing based on legitimate interest, and withdraw any consent. Write to [dpo_email]; we reply within one month. Some records (invoices, accounting) must be kept by law even after your account is deleted. You can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority of your own country.
5. Security
The Site uses HTTPS; passwords are hashed; payment details never reach our servers; the database is outside the public web folder. No system is perfectly secure; if a breach affects you we will notify you and the authority as the law requires.
6. Children
The Site is for adults only. We do not knowingly process data of anyone under 18; if we learn we have, we delete it.
7. Changes
If this policy changes materially we will tell you on the Site or by email.