Politica de confidențialitate

Această notă descrie cum Decret prelucrează date cu caracter personal, în calitate de operator și, unde e cazul, de persoană împuternicită.

Data de aplicare: 2 noiembrie 2026. Decret publică orice revizuire pe această pagină, cu o nouă dată de aplicare.

Textul juridic operativ este cel în limba engleză; acolo unde o parte este redată și în limba română, prevalează textul în limba engleză.

Cuprins

1. Controller

Decret (the Service) is operated by Sorenor, LLC, a Delaware limited liability company (Delaware file number 10762175), which is the controller of the personal data described in this notice, except where it acts as a processor for a business customer (clause 2). In this notice, Decret and we mean Sorenor, LLC. Mailing address: 2810 N Church St STE 90277, Wilmington, DE 19802, United States. Website: https://decret.ai. Privacy correspondence: hello@decret.ai.

This notice is issued under the EU GDPR, which applies where Decret offers the Service to persons in the EEA, including Romania, and under the UK GDPR and the Data Protection Act 2018 where it offers the Service to persons in the United Kingdom. Cookies are addressed under the ePrivacy rules of the visitor’s country (PECR in the United Kingdom). Decret has not appointed a Data Protection Officer. Requests shall be sent to the address above.

2. Roles

Decret processes personal data in the following capacities:

As controller: accounts; the website; demonstration and access-request forms; support correspondence; security logs retained for Decret’s own operations; and any marketing undertaken on a lawful basis.
As processor: Customer Data in the workspace, including uploaded drawings and files, extracted text, project metadata entered by the Customer, generated drafts and exports, workspace activity records, and any personal data those files contain (including names on a drawing title block or a labour return). The business customer is the controller, or an independent controller, of that data. The Data Processing Agreement applies.

A data subject whose personal data appears only in a customer’s project files should address the relevant customer in the first instance. Decret shall assist that customer under the Data Processing Agreement and does not, as processor, determine erasure of the customer’s files of its own motion.

3. Scope

This notice applies to decret.ai, the workspace, related application programming interfaces, and emails sent from our domains (including noreply@decret.ai for verification and password reset). It does not apply to third-party websites linked from the Service.

The processing described in this notice is carried out now, with two conditions: push notifications are sent only where they are enabled on the Service and you turn them on for a device, and analytics runs only while Decret has it switched on and you accept it (clause 6).

4. Categories of personal data

4.1 Account and identity

Email address; display name; password (stored as an Argon2id hash); optional company name and logo; plan and role; email-verification status; and timestamps. Decret does not store payment card numbers. Card payments are taken through Stripe: card numbers are entered on Stripe-hosted pages and are handled by Stripe, not by Decret. For each order Decret keeps what was bought, the amount and currency, and the exchange rate and its date where lei were charged. For an invoice under the reverse-charge mechanism it keeps the company’s VAT identification number, the name and address VIES returns for it, and when VIES confirmed it.

4.2 Session and security

HttpOnly session cookie; hashed session identifiers; last-active time; idle and absolute expiry. Authentication events (including login, register, reset, verify, password change, logout, and idle expiry) with Internet Protocol address and user identifier. Those logs do not contain passwords, tokens, or email addresses. Rate-limiting uses Internet Protocol addresses (including the Cloudflare connecting address where present). Verification and reset tokens are stored as hashes.

4.3 Website and access

The public site is open. A first-party cookie records whether you accept or refuse analytics (decret_consent), and another records the language you read the site in (decret_locale). Demonstration and access-request forms store name, email, organisation, role, optional note, and related fields submitted by the requester. Inbound mail to addresses such as hello@decret.ai is routed to Decret for handling.

4.4 Workspace (processor)

Project name, location, work types, employer and contractor names, jurisdiction, language, and other metadata entered by the Customer; uploaded files (including PDF, office documents, and images, subject to type and size limits); a cryptographic hash of uploads used for duplicate detection; extracted text where extraction succeeds; generated documents and exports; workspace activity messages; template download records; a demonstration credit ledger (not a live payment); logos uploaded for document covers; and the names, email addresses and roles of the people a Customer invites to a project. Questions put to the project assistant and its answers are kept with the project.

A project created on the free 14-day test is deleted, with its files, when the test period ends, unless the account has moved to a paid plan by then.

4.5 Site diary

Dictation in the site diary uses your browser's own speech recognition (for example Google's in Chrome or Apple's in Safari, which may process the audio on their own servers under their terms); Decret receives only the resulting text, never the audio. Diary photos keep the time and position the camera recorded, when the file carries them. When a project chooses automatic weather, the site's coordinates are sent to the Norwegian Meteorological Institute (MET Norway, api.met.no) to add a forecast to a diary page. Manual weather sends nothing to a weather provider. To find those coordinates once, OpenStreetMap Nominatim receives only a locality with its county or country: one a person enters or confirms in the site's location settings, or, for a site in Romania, a locality named in the project's location that Romania's official register of localities lists, with its county. It never receives the project's location text, a street or a house number, and Decret refuses a locality that is the name of the project's client, contractor or contacts. Coordinates a person types are not looked up.

4.6 Project email address (processor)

A project may receive email at its own address. For each message Decret stores the sender’s address and name, the recipient address, the subject, the body, the attachments, and the time of receipt. Messages from the project’s members and from senders the Customer has approved are added to the project. Messages from any other sender wait for a decision by the project owner and are deleted, with their attachments, thirty (30) days after receipt if they have not been accepted. Mail to these addresses reaches Decret through Cloudflare Email Routing.

4.7 Notifications

Notifications are shown in the workspace and, according to each person’s choices, sent by email. Where push notifications are enabled and you turn them on for a device, Decret stores, for that device, the push address and keys your browser provides, a short device label (for example “Chrome, Android”, never the full browser identification string), and delivery times and failures. Push messages are delivered through the push service operated by your browser’s vendor (for example Google, Mozilla, or Apple). The record is removed when you turn push off, sign out on that device, or the browser withdraws the subscription, and after repeated failed deliveries. Your notification choices are stored with your account.

4.8 Outside parties invited by link (processor)

A Customer may ask a person outside its account (for example a designer, supplier, beneficiary, or site supervisor) to answer requests for information or to review a draft through a link, without an account. Decret stores that person’s name, role, and email address as entered by the Customer, the message sent with the link, when the link was viewed, and the answers, review decisions, and downloads made through it. The link expires after the period the Customer chose (thirty (30) days unless changed, ninety (90) at most) or when it is revoked; the record of what was done through it stays with the project. Decret emails that person the link and reminders on the Customer’s behalf.

A Customer may also share approved documents with such a person through a personal link to the project’s shared folder, where that person can read and download them without an account. Decret stores that person’s name and email address as entered by the Customer, when the link was opened, and which documents were downloaded and when; the Customer’s project team sees that record. The link works for ninety (90) days from when it is sent or last extended by the Customer, or until it is revoked; the record stays with the project. Decret emails that person the link on the Customer’s behalf.

4.9 Data not collected as a purpose of the Service

Advertising cookies, cross-site trackers, and social-media pixels are not used. Analytics (Google Analytics 4) runs on the public pages only while Decret has it switched on and the visitor has accepted it; it is not used in the signed-in workspace. Government identity documents are not required at registration. Special-category data is not a purpose of the Service.

5. Purposes and legal bases

Purpose	Examples	Legal basis
Provision of the account and the Service	Registration, authentication, workspace, exports, password reset	Contract (UK/EU GDPR Article 6(1)(b))
Customer Data in a project	Storage of drawings, generation of drafts, listing of projects	Processor instructions (Article 28); the customer’s bases as controller
Security of the Service	Rate limits, authentication logs, session idle timeout, abuse prevention	Legitimate interests (Article 6(1)(f))
Transactional email	Address verification, password reset	Contract; legitimate interests in account integrity
Demonstration and sales enquiries	Request-a-demo form	Legitimate interests in responding to business enquiries; or steps prior to entering a contract
Legal obligations	Tax records if invoices are issued; responses to lawful requests	Legal obligation (Article 6(1)(c))
Strictly necessary cookies	Session cookie; analytics consent cookie; language cookie	ePrivacy rules (necessary cookies); GDPR contract and/or legitimate interests
Analytics (optional)	Google Analytics 4 on the public pages, after the visitor accepts	Consent (ePrivacy rules; EU/UK GDPR Article 6(1)(a)), withdrawable at any time
Optional marketing	Not presently undertaken	Would require consent or another valid ePrivacy or GDPR basis
Payments	Card checkout through Stripe; the VAT identification number and its VIES check for invoices under the reverse-charge mechanism	Contract (Article 6(1)(b)); legal obligation for invoices (Article 6(1)(c)); card data is handled by Stripe

Where processing is based on legitimate interests, the data subject may object (clause 11). Decret shall not continue such processing where the law requires it to stop.

6. Cookies

Cookies are described in the Cookie Policy. Decret uses a session cookie for authentication, a cookie recording your analytics choice, and a cookie recording the language you read the site in. Google Analytics 4 runs on the public pages only while Decret has it switched on, and then only after you accept it in the banner, which is shown only while it is on; Google acts as Decret’s processor for it. Withdrawing consent stops further analytics and removes its cookies on a best-effort basis. Advertising and cross-site tracking cookies are not set.

Decret does not sell personal data. Personal data is disclosed only as required to operate the Service, to the recipients below. Those that process Customer Data as Decret’s subprocessors come first, as Annex C of the Data Processing Agreement lists them.

Recipient	Purpose and data received	Location, role and safeguard
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg	Hosting of the Service: the application servers (Amazon EC2), the database (Amazon RDS for PostgreSQL), project files, generated documents, site diary photos and logos (Amazon S3), and the Service’s configuration and secrets (AWS Systems Manager). It holds all account and project data.	Europe (Frankfurt), eu-central-1. Processor under the AWS Data Processing Addendum, part of the AWS Service Terms, which includes the Standard Contractual Clauses for any transfer outside the EEA.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States	DNS, the edge network, TLS and security filtering for decret.ai: every request to the Service passes through it, with the visitor’s IP address and what the request carries, uploaded files included. Email Routing: it receives mail sent to project email addresses, which it passes to the Service.	A global network, operated from the United States. Processor under the Cloudflare Data Processing Addendum. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Cloudflare is certified, and on the Standard Contractual Clauses with the UK Addendum in that addendum.
Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States	Outbound email from noreply@decret.ai: address verification and password reset, notifications, and links and reminders sent to outside parties on the Customer’s behalf. It receives each recipient’s address and the message, and keeps the messages it sends and their delivery records.	United States. Processor under Resend’s Data Processing Addendum, which includes the Standard Contractual Clauses with the UK Addendum; Resend also participates in the EU-U.S. Data Privacy Framework and its UK Extension.
Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, for an API customer in the EEA, Switzerland or the United Kingdom; Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, United States, otherwise	Model inference (Claude API) when an AI feature runs on a project: transcribing drawings, classifying files, extracting facts, filling templates, answering questions in chat and the project assistant, drafting site diary reports, describing site photos and proposing measurements. It receives the relevant project documents or extracts of them, does not train models on them, and deletes them within thirty (30) days unless it must keep them longer to enforce its usage policy or to comply with law.	United States. Processor under Anthropic’s Data Processing Addendum, part of its Commercial Terms, which includes the Standard Contractual Clauses with the UK and Swiss addenda.
Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, CA 94080, United States	Card payments, invoices and the customer portal. It receives the account’s email address, the name, billing address and VAT identification number given for an order, the name VIES returns for that number, and what was ordered. Card details are entered on Stripe-hosted pages and never reach Decret.	United States. Processor for the payments it handles for Decret, and an independent controller for its own purposes, such as fraud prevention and its duties as a payment provider. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Stripe, LLC is certified, and on the Standard Contractual Clauses in Stripe’s data processing terms.
European Commission (VIES, the VAT Information Exchange System)	Checking a company’s VAT identification number before a sale under the reverse-charge mechanism. It receives only that number.	European Union. The Commission runs VIES as processor for the Member States’ tax authorities, which are its controllers. Nothing leaves the EEA.
Norwegian Meteorological Institute (MET Norway), Oslo, Norway	Automatic weather on a site diary page, for a project that chooses it. It receives the site’s coordinates, rounded to about one kilometre, from Decret’s server.	Norway, in the EEA. Independent controller of its access logs, which it keeps in Oslo.
OpenStreetMap Foundation (Nominatim), Cambridge, United Kingdom	Finding a site’s coordinates for automatic weather. It receives only a locality with its county or country, from Decret’s server: one a person enters or confirms, or, in Romania, one the official register of localities lists. Never the project’s location text, a street or a house number.	United Kingdom, which has an adequacy decision of the European Commission. Independent controller of its request logs.
Google (Google Workspace)	Decret’s mailboxes: mail sent to Decret’s addresses at decret.ai.	Google’s global infrastructure, operated from the United States. Processor under Google’s Cloud Data Processing Addendum. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Google LLC is certified, and on the Standard Contractual Clauses in that addendum.
Google (Google Analytics 4)	Audience measurement on the public pages, only while Decret has it switched on and only after the visitor accepts it. It receives the pages visited and the identifiers in the analytics cookies; Google Analytics 4 does not log or store IP addresses. Not used in the workspace.	United States. Processor under Google’s data processing terms for its measurement products. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Google LLC is certified, and on the Standard Contractual Clauses.
The push service of the device’s browser (for example Google, Mozilla or Apple)	Delivery of push notifications to a device that turned them on. It receives each notification encrypted, so it cannot read it, with the device’s push address.	Chosen by the browser, not by Decret; the browser vendor’s own terms apply.
Professional advisers and public authorities	Legal, accounting, or lawful requests	As required

The table names every recipient the Service uses at the date of this notice. Decret keeps it current and gives notice of a new subprocessor of Customer Data as clause 7 of the Data Processing Agreement provides. Operator access is limited as described in the Security Measures document.

Correspondence sent to Decret by email is visible to persons who operate the Service.

8. International transfers

Account and project data are stored in the EEA: Decret’s database, project files and application servers run in AWS Europe (Frankfurt), eu-central-1. Decret itself is a United States company (clause 1). For the data it controls (accounts, billing, the website and support) it is subject to the EU GDPR and the UK GDPR directly, because it offers the Service to persons in the EEA and the United Kingdom, and the persons who operate the Service may reach that data from the United States.

Decret passes personal data to recipients outside the EEA only as clause 7 sets out, each under one of these safeguards:

the EU-U.S. Data Privacy Framework and its UK Extension, for a recipient certified under it: Cloudflare, Resend, Stripe and Google;
the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), with the UK Addendum for data from the United Kingdom, which are part of the data processing terms of Anthropic, Cloudflare, Resend, Stripe and Google, and of the AWS terms for any transfer AWS makes outside the EEA;
an adequacy decision, for the OpenStreetMap Foundation in the United Kingdom.

For Customer Data, which Decret processes for a business customer, the Data Processing Agreement (clause 8) sets out the safeguards, including the Standard Contractual Clauses between the customer and Decret. Cloudflare’s network may handle a request in the location nearest the visitor, inside or outside the EEA. A copy of the safeguard for a recipient is available on request at hello@decret.ai.

9. Păstrarea datelor

Se aplică următorul calendar de păstrare.

Conturi: pe durata existenței contului, apoi ștergere sau anonimizare într-o perioadă rezonabilă după închidere (țintă: treizeci (30) de zile pentru datele active, mai mult pentru copiile de siguranță și obligațiile legale de păstrare).
Sesiuni: până la expirarea pentru inactivitate (implicit paisprezece (14) zile) sau la expirarea absolută (treizeci (30) de zile), apoi ștergere.
Tokenuri de autentificare: douăzeci și patru (24) de ore (confirmarea e-mailului) sau o (1) oră (resetarea parolei), cu o singură utilizare, apoi consumate sau expirate.
Jurnalele evenimentelor de autentificare: un jurnal operațional limitat, nu o arhivă a conținutului e-mailurilor.
Cereri de acces și demonstrații: până la soluționarea cererii, apoi ca evidență a contactului comercial, cel mult douăzeci și patru (24) de luni. Solicitantul poate cere ștergerea lor mai devreme, iar Decret o face acolo unde legea permite.
Datele clientului (persoană imputernicită): până când clientul șterge proiectul sau contul, instruiește Decret conform Acordului de prelucrare a datelor sau expiră perioada aplicabilă de retenție de după abonament ori de după comanda punctuală de mai jos. Ștergerea din datele active este supusă ciclului copiilor de siguranță descris mai jos.
După încheierea abonamentului plătit: cât abonamentul este activ, acest calendar nu șterge Datele clientului. După anularea la sfârșitul perioadei de facturare sau după ce abonamentul rămâne neplătit peste perioada de grație de șapte (7) zile, fișierele proiectului, documentele generate și livrabilele se păstrează șaizeci (60) de zile și apoi se șterg din datele active ale Serviciului. Proprietarul contului primește un e-mail cu 45 de zile, 30 de zile, 15 zile și o zi înainte de ștergere, cu data ștergerii după ora României și linkuri către exportul datelor contului și către ZIP-ul dosarului aplicabil. Ștergerea are loc doar după aceste avertismente: dacă un avertisment nu a putut fi trimis la timp, ștergerea se mută la cincisprezece (15) zile după avertismentul trimis atunci, care menționează noua dată, iar avertismentul cu o zi înainte o precedă în continuare. Un abonament nou început înainte de data ștergerii anulează ștergerea și toate avertismentele următoare.
Comenzi punctuale fără abonament: documentele livrate, inclusiv documentele editate de Decret pentru Client, se șterg din datele active ale Serviciului la douăzeci și patru (24) de ore după livrare. Ecranul livrării și e-mailul de livrare menționează această perioadă și ora ștergerii, după ora României. O livrare al cărei ecran și e-mail nu au menționat o oră de ștergere, cum este una făcută înainte de aplicarea acestui calendar, nu se șterge după acest calendar; Clientul este anunțat înainte de ștergerea ei. Copiile descărcate în sistemele proprii ale Clientului nu sunt afectate.
Înregistrările de audit ale ștergerilor din retenție: ce s-a șters, când și de ce, fără conținutul fișierelor, se păstrează împreună cu contul propriu-zis și istoricul său de facturare. Proiectul sau documentul livrat propriu-zis nu se păstrează în aceste înregistrări.
Copii de siguranță: Copiile de siguranță automate ale bazei de date, cu recuperare la un moment dat, expiră după șapte (7) zile. Pentru versiunile anterioare ale fișierelor de proiect păstrate prin versionarea stocării, inclusiv pentru versiunile unor fișiere șterse între timp, nu este configurată încă o expirare: ele se păstrează până la configurarea ei. Expirarea prevăzută este de nouăzeci (90) de zile, cu excepția cazului în care se aplică o obligație legală de păstrare. O copie a datelor serviciului din 22 octombrie 2026, păstrată la mutarea serviciului în baza de date administrată, este reținută în contul AWS al serviciului (pe gazda aplicației și în copiile sale de siguranță zilnice) până când mutarea este declarată încheiată. Datele cu caracter personal care existau în serviciu la acea dată și au fost șterse ulterior rămân în această copie până la ștergerea ei; pentru această ștergere nu a fost stabilită încă o dată.
Proiecte în testul gratuit de 14 zile: se șterg împreună cu fișierele lor la sfârșitul perioadei de test, cu excepția cazului în care contul a trecut între timp la un plan plătit.
E-mail către adresa unui proiect de la un expeditor neaprobat:se șterge împreună cu atașamentele la treizeci (30) de zile după primire, dacă proprietarul proiectului nu îl acceptă.
Abonările la notificări push: până la dezactivarea notificărilor, la deconectarea persoanei de pe dispozitiv, la retragerea abonamentului de către browser sau la eșuarea repetată a livrărilor.
Linkuri pentru părți externe: utilizabile până la expirare (treizeci (30) de zile dacă Clientul nu a ales altfel, cel mult nouăzeci (90) de zile) sau la revocare; înregistrarea lor rămâne în proiect ca Date ale clientului.
Linkuri către dosarul partajat: utilizabile nouăzeci (90) de zile de la trimitere sau de la ultima prelungire ori până la revocare; înregistrarea deschiderilor și a descărcărilor rămâne în proiect ca Date ale clientului.
E-mail tranzacțional: conținutul mesajelor nu este păstrat pe gazda aplicației. Resend, care le trimite, păstrează mesajele trimise și evidența livrării lor în Statele Unite (clauza 7).

10. Security

Measures are described in the Security Measures document, including TLS in transit, Argon2id password hashing, HttpOnly session cookies, project access controls, origin checks on authentication requests, and security response headers. Decret is not presently certified under SOC 2, ISO/IEC 27001, or equivalent schemes. Security controls are designed with reference to widely recognised frameworks, including the control themes commonly associated with ISO/IEC 27001 and SOC 2. The database and project files are encrypted at rest by the storage provider (Amazon RDS and Amazon S3); application-level encryption of project files is not implemented.

11. Data subject rights

Subject to the EU GDPR or the UK GDPR, as applicable, a data subject may have the right of access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), and data portability, and the right not to be subject to a solely automated decision producing legal or similarly significant effects. Outputs of the Service are tools for a human reviewer. Decret does not take solely automated decisions granting construction permits or employment.

A signed-in user may exercise access, portability and erasure directly under Settings, Your data. The export is a ZIP archive containing the account record (without the password hash), the projects the user owns with their stored files, the user’s notifications, sign-in events and billing ledger entries. Account deletion requires the account email and current password; it removes the account, its sessions and the projects the user owns, removes the user from projects owned by others and replaces the user’s name and email in their activity records with “Deleted user”, except in the site diary, and cancels an active subscription. The site diary keeps the user’s name on pages and addenda they wrote and photos they added; its append-only change history keeps the name and email recorded with each change, because the diary is the register of the works. Credit ledger entries, which carry no name or email, are kept for accounting retention. Backup copies are kept as set out under Retention (clause 9).

Requests shall be sent to hello@decret.ai from the address held on file, or with other evidence of identity. Manifestly unfounded or excessive requests may be refused or charged as permitted by law. In respect of Customer Data processed as processor, Decret shall refer the requester to the customer or act on the customer’s instructions.

Complaints concerning Decret’s processing of personal data may be sent to the same address. Decret shall acknowledge and respond without undue delay.

12. Children

The Service is intended for businesses and professionals and is not directed at children. Decret does not knowingly collect personal data from persons under 18. If such data has been collected, Decret shall delete it upon notice.

13. Complaints

Data subjects may contact Decret in the first instance. They also have the right to lodge a complaint with a supervisory authority.

United Kingdom: Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/.
European Economic Area, including Romania: the supervisory authority of the data subject’s habitual residence, place of work, or place of the alleged infringement. In Romania, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP): https://www.dataprotection.ro/. Reference to ANSPDCP does not constitute an establishment in Romania or a designation of ANSPDCP as lead supervisory authority.

14. EU and UK representatives

Decret is established in the United States, outside the EEA and the United Kingdom. A controller or processor not established in the EEA that offers goods or services to, or monitors the behaviour of, persons in the EEA may be required to appoint a representative under Article 27 of the EU GDPR; Article 27 of the UK GDPR makes the same provision for persons in the United Kingdom. No EU representative has been appointed as at the date of this notice. No United Kingdom representative has been appointed as at the date of this notice. Persons in the EEA and the United Kingdom may write to Decret directly at the addresses in clause 16 and complain to their supervisory authority (clause 13).

15. Changes

Decret shall publish revisions of this notice on this page with an updated effective date. Material changes may also be notified to account holders by email.

16. Contact

Sorenor, LLC, operator of Decret
2810 N Church St STE 90277, Wilmington, DE 19802, United States
hello@decret.ai
General correspondence: hello@decret.ai.