Privacy policy

Last updated: 5 August 2026 · Operator: Softescu SRL · office@softescu.com
See also the Terms and conditions.

This is an English translation provided for convenience. If it differs from the Romanian version, the Romanian version prevails.

1. Personal Data Collected

1.1 Browsing and Session Data

To operate and improve our service, we collect the following data:

1.2 Newsletter (Optional)

If you subscribe to our newsletter, we collect:

• Email address - to send news and updates
• Subscription date - to manage the subscriber list

Legal basis: Explicit consent given by subscribing.

1.3 AI Assistant Conversations

Conversations with the AI assistant are stored for the following purposes:

• Processing and answering - to generate relevant answers to your questions
• Improved context - to give more accurate answers based on the conversation history
• Improving the service - to improve the quality of the AI answers

Conversations are associated with your anonymous session and you can delete all conversations at any time with the delete button in the page footer.

Legal basis: Implied consent by using the AI Assistant feature.

1.4 User Account (Optional)

Search can be used without an account. If you choose to create an account, we collect:

• Email address - for signing in, verifying the account and account-related communications
• Password - stored only in encrypted (hashed) form, never in clear text
• Account creation and activity dates - for account management and security

Legal basis: Performance of the contract (providing the account features) and the consent given at sign-up.

1.5 Profile Photo and Virtual Try-on ("Try on")

The virtual try-on is an optional feature, available only to signed-in users who upload a photo. If you use it, we process:

• The photo you upload (usually a photo of yourself) - used only to generate the virtual try-on of products
• The generated images (the virtual try-on of the worn product), saved in the "Wardrobe" section of your account

To prepare the photo and generate the try-on, the image is processed with the Google Gemini artificial intelligence service (see section 4 - Data Sharing). On upload, the photo's background is automatically replaced with a neutral studio background.

Your photo is private: it is stored in a restricted-access space and can only be accessed by you, through your signed-in account. It is not shown publicly and is not used for any other purpose.

You can delete your profile photo and the try-ons in your "Wardrobe" from your account at any time. In addition, generated images are deleted automatically after a limited period (see section 3).

Legal basis: Explicit consent, given by uploading the photo and using the virtual try-on feature.

2. Purpose of Processing

We process your data for the following purposes:

1. Providing the search service - processing requests, showing results
2. Personalization - recommendations based on preferences and behaviour
3. Improving the service - analytics, usage statistics
4. Security - preventing abuse and attacks
5. Newsletter - sending news (subscribers only)
6. Legal compliance - meeting legal obligations

3. Data Retention Period

4. Data Sharing

We do not sell or rent your personal data.

Data may only be shared in the following situations:

• Necessary third-party services:
  • Hosting (to store the data)
  • DuckDuckGo Icons API (to display favicons - no personal data is sent)
  • OpenAI - for the AI Assistant feature (conversations are sent for processing)
  • Anthropic (Claude AI) - for the AI Assistant feature (conversations are sent for processing)
  • Google (Gemini) - for the virtual try-on feature ("Try on"); the photo you upload and the product image are sent to generate the virtual try-on
• Legal obligations: In case of legitimate requests from the authorities

5. Data Security

We apply technical and organizational measures to protect the data:

• HTTPS encryption for all communications
• Pseudonymization through session tokens
• IP anonymization for analytics
• Restricted access to personal data
• Security monitoring and regular backups
• Input validation and sanitization (XSS, SQL injection protection)
• Content Security Policy (CSP)

6. Your Rights (GDPR)

Under the GDPR, you have the following rights:

6.1 Right of Access

You can request a copy of the personal data we hold about you.

6.2 Right to Rectification

You can ask for inaccurate or incomplete data to be corrected.

6.3 Right to Erasure ("Right to be forgotten")

You can request the deletion of your personal data in the following ways:

• User account: You can delete the account completely from "My profile" → "Delete account"; deleting the account also removes the related data (profile photo, virtual try-ons)
• Profile photo and virtual try-ons: You can delete them at any time from "My profile" (the photo) and from the "Wardrobe" (the try-ons); try-ons are also deleted automatically after a limited period
• AI conversations: Use the delete button in the page footer to delete all conversations immediately
• Sessions and preferences: You can manually delete the session token from your browser's localStorage
• Newsletter: Unsubscribe through the link in the email or contact us
• Other data: Contact us at contact@softescu.com to have the data deleted completely

6.4 Right to Restriction of Processing

You can request that the processing of your data be restricted under certain conditions.

6.5 Right to Data Portability

You can receive your data in a structured, commonly used and machine-readable format.

6.6 Right to Object

You can object to the processing of your data for certain purposes.

6.7 Right to Lodge a Complaint

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

7. Cookies and Tracking Technologies

HeiLocal.ro does not use traditional cookies.

We use localStorage (local storage in the browser) for:

• The session token (to identify the session)
• Authentication tokens (only if you create an account and sign in)
• Search preferences
• AI Assistant conversations

This data is stored only on our server and is not accessible to other websites.

8. Newsletter - Unsubscribing

If you subscribed to the newsletter, you can unsubscribe at any time by:

• Clicking the unsubscribe link in any email you receive
• Sending an email to office@softescu.com with the subject "Unsubscribe heilocal.ro"

9. International Data Transfers

Your data is stored on servers located in the European Union.

When you use features that rely on third-party artificial intelligence services, certain data is sent to providers located outside the EU (United States), only for the requested processing:

• OpenAI and Anthropic - the content of conversations with the AI Assistant
• Google (Gemini) - the uploaded photo and the product image, for the virtual try-on

These transfers only happen when you use the respective features. The providers apply recognized safeguards for international transfers (such as the EU Standard Contractual Clauses). We make sure that adequate safeguards under the GDPR are respected.

10. Data Accessed Through Google Services (YouTube)

The HeiLocal.ro application uses the YouTube Data API solely to publish video content to our own brand YouTube channel (Hei!Local) and to read that channel's statistics.

• What data we access: the metadata and video files we ourselves upload to our channel, and our own channel's statistics (views, likes). We do not access any other Google user's data.
• How we use it: solely to publish our own marketing content and analyze its performance. The data is not used for targeted advertising or any other purpose.
• What we share: we do not sell or transfer Google user data to third parties, data brokers or advertisers.
• How we protect it: OAuth access tokens are stored on our servers with access restricted to authorized personnel and are never exposed publicly.
• Retention and deletion: we retain only the authentication tokens and technical publishing logs, and delete them when the integration is no longer used. Access can be revoked at any time at myaccount.google.com/permissions.

HeiLocal.ro's use of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

11. Minors

Our service is not intended for people under 16. We do not knowingly collect data from minors without the consent of their parents or legal guardians.

12. Changes to the Privacy Policy

We reserve the right to change this privacy policy. Any change will be communicated through:

• Updating the "Last updated" date at the top of this document
• A notice on the site for important changes
• An email to newsletter subscribers (for significant changes)

13. Contact

For any questions about data protection or to exercise your rights, you can contact us:

14. Consent

By using the HeiLocal.ro service, you confirm that you have read and understood this Privacy Policy and agree to the processing of your data under the terms described above.