Privacy Policy

All in One Software S.R.L., a limited liability company (S.R.L.) registered in Romania, tax identification code (CUI) 55693621, trade registry number J2026057554000, share capital 500 RON, registered office Bd. Dinicu Golescu, nr. 7, et. Parter, ap. SP. COM. 3, Sector 1, București, România, represented by Cristian Vieru. Contact: cristianvieru3@gmail.com.

We have not appointed a data protection officer, as the law does not require one for our activity. Privacy questions and requests go to cristianvieru3@gmail.com.

• Controller for the data about you as a Frusma user and customer: your account, billing and security data, support messages, and visits to our website. This policy covers that data.
• Processor for the data your workspace holds about its own clients, contacts, team members and other people (invoices, deals, projects, documents and so on). You, the workspace owner, decide why and how that data is used and are the controller; we only process it on your instructions under the Data Processing Agreement. If you are a client or contact of a Frusma customer and want to exercise your rights, please contact that business first; we will help them respond.

• Account data: name, e-mail address, password (stored only as a salted hash), role, workspace, language and display preferences, and the sign-in provider if you use Google, Microsoft, GitHub or Facebook to sign in.
• Workspace and business data you enter (as processor): clients and contacts, deals, proposals and contracts, projects, tasks, time entries, invoices, expenses and receipts, documents, lead-form submissions, and your company details and logo.
• Billing data: billing contact and address, VAT number and subscription history. Card details are collected and held by our payment provider, not by Frusma.
• E-mail records: recipient, subject, time and delivery status of e-mails sent from Frusma.
• Technical and security data: sign-in sessions, IP address and device information in server logs, and the audit log of personal-data exports and erasures.
• Free tools: the calculators and generators on our website run in your browser and do not send what you type to us. To see the results or download a document you enter your e-mail address and agree to receive a short series of e-mails from us (four e-mails over about ten days, then occasional tips and news). We then store your address, the tool you used, what you entered or chose in it, the time of your consent and, if present, the campaign tag of the link you came from, and we add your address to our e-mail provider (Resend) so we can send and manage these e-mails. Every e-mail has a one-click unsubscribe link; when you unsubscribe we stop all e-mails to that address and keep only the address and the fact that you unsubscribed, so we do not write to you again. You can also ask us to delete your data. Contract template PDFs are created on our server from the details you submit and are not stored.
• Contact form: if you write to us through the contact form we store your name, e-mail address, company (if you give it), the topic, your message, the page you wrote from and, if present, the campaign tag of the link you came from, so we can answer you and keep a record of the conversation. We use it on our legitimate interest in answering enquiries (Art. 6(1)(f)) or, if you are asking about a contract, to take steps before one is made (Art. 6(1)(b)). We keep it for as long as the conversation lasts and then up to 24 months, unless you become a customer. You can ask us to delete it at any time. Your message is not used for marketing e-mails unless you separately agree to receive them.
• Security checks on forms: our sign-in, sign-up, contact and lead forms use Cloudflare Turnstile to tell people from bots. Cloudflare receives your IP address and technical signals from your browser while you use the form (not what you type) and returns a pass or fail. We use it on our legitimate interest in keeping our service secure and free of abuse (Art. 6(1)(f) GDPR). It is not used for advertising.
• Website visitors and advertising: on our public website (not in the app), if you accept optional cookies in the cookie banner, tools such as the Meta Pixel and Google Analytics receive information about your visit (the page, your browser, an identifier in a cookie, and a “lead” event when you send a message or unlock a free tool) so that we can count visits and measure and improve our advertising. The legal basis is your consent (Art. 6(1)(a) GDPR and the ePrivacy rules). Meta and Google process this data under their own privacy policies. You can withdraw consent at any time with “Cookie settings” in the footer, and nothing optional runs if you decline. See the Cookie Policy.
• Website: our public pages do not use analytics or advertising trackers, so we do not profile visitors.

• Providing the service, your account and support: performance of a contract (Art. 6(1)(b) GDPR).
• Billing, tax and accounting records, and responding to authorities: legal obligation (Art. 6(1)(c)).
• Security, preventing abuse and fraud, and improving reliability: our legitimate interest (Art. 6(1)(f)).
• Service e-mails about your account, trial, billing and important changes: contract and legitimate interest. We send marketing e-mails, including to people who signed up through our free tools, only if you opt in, and you can withdraw consent at any time (Art. 6(1)(a)).

We do not sell personal data, and we do not use your workspace data for advertising or to train advertising or profiling models.

We share data only with service providers that help us run Frusma, under written agreements, and with authorities where the law requires it:

• Supabase: Database, authentication and file storage.
• Vercel Inc.: Application hosting and serverless functions.
• Resend, Inc.: Delivery of e-mails you send from Frusma (invoices, proposals, contracts, reminders) and of our own e-mails to people who sign up through our free tools.
• Stripe Payments Europe, Ltd.: Payment of Frusma subscriptions (when you subscribe to a paid plan).
• Cloudflare, Inc.: Bot protection (Turnstile) on our sign-in, sign-up and public forms.

The full list with locations is on the GDPR and data protection page. If you sign in with a social account, that provider processes your sign-in as an independent controller under its own policy. We will update the list before adding a provider that processes customer data.

Our database, authentication and file storage are hosted in the European Union. Some providers, such as our application host and e-mail delivery provider, are based in the United States. Where personal data is transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (and on the EU–US Data Privacy Framework where the provider is certified) together with additional safeguards where needed. You can ask us for a copy of the safeguards at cristianvieru3@gmail.com.

• Account and workspace data: while your account is active. After you close a workspace we delete it within 30 days; remaining copies in backups are overwritten on the normal backup cycle.
• Invoices and accounting records: kept as long as accounting and tax law requires them to be kept (often several years, in Romania generally up to 10 years, depending on the document), even after an erasure request. Customers can have personal contact data inside such records erased while the legally required fields are kept.
• Our billing records about you: as long as tax law requires.
• Free-tool sign-ups: until you unsubscribe or ask us to delete them, and in any case reviewed at least every two years.
• Server and security logs: a limited period, normally up to 90 days; the audit log of exports and erasures is kept for accountability and holds identifiers rather than names.

Under the GDPR you have the right to access your data, have it corrected or erased, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You also have the right to complain to a supervisory authority; in Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro, or the authority in the country where you live or work.

For your own account, write to cristianvieru3@gmail.com; we reply within one month. Workspace admins can export or erase a client’s or contact’s data directly in the app. How this works is explained on the GDPR and data protection page.

Each workspace is separated from all others at database level, access depends on role (admin, employee, freelancer, client), files are stored privately and opened through short-lived links, connections are encrypted, and passwords are stored hashed. No system is perfectly secure; if a personal data breach affecting you occurs we will notify you and the authority as the law requires. More detail is on the GDPR and data protection page.

Frusma uses only strictly necessary cookies and browser storage (to keep you signed in and remember your theme) and no tracking or advertising cookies. See the Cookie Policy.

Frusma is a business tool and is not intended for people under 18. We do not knowingly collect data from children.

We will update this policy when our processing changes. The date at the top shows the latest version; for material changes we will notify you by e-mail or in the app.