Privacy Policy

1. Controller

The data controller for the Neytom panel and marketing site is Neytom Services SRL (Romania / EU). Contact: [email protected].

Registered office, CUI and trade-register number will appear on invoices and on the Legal/Imprint page once published. We do not invent registry identifiers in this policy.

2. What we process

• Account: email, username, display name, password hash (or Google account ID if you use Google Sign-In), country/geo hints from auth, support tickets.
• Billing: plan, invoices, payment status. Card numbers are handled by Stripe / PayPal — we do not store full PAN.
• Hosting ops: domains, instance metadata, deploy logs, IP addresses used to access the panel, abuse/security signals.
• Analytics (optional): Google Analytics 4, only after you click “Accept analytics”. No advertising, remarketing or conversion tags.

3. Purposes and legal bases (GDPR Art. 6)

• Contract — create and operate your hosting/VPS account, billing, support.
• Legitimate interests — security, fraud prevention, service improvement, abuse response.
• Consent — non-essential cookies / marketing tags; Google Sign-In where you choose it.
• Legal obligation — tax/accounting retention where required.

4. Google Sign-In

If you use “Continue with Google”, we receive your Google account ID, email, and display name solely to authenticate you. We do not access Gmail or Drive.

5. Cookies

Essential cookies keep you signed in (host-only session) and secure forms (CSRF). Google Analytics loads only after Accept analytics. Choice is remembered 30 days. Change anytime via Cookie settings.

Cookie	Purpose	Duration	When
neytom_cookie_consent, neytom_cookie_consent_at	Your choice	30 days	Always, essential
_ga	Google Analytics: distinguish visitors	2 years	Only after Accept analytics
_ga_<ID>	Google Analytics: session state	2 years	Only after Accept analytics

GA4 settings: Google Signals off, ad personalization off, data retention 2 months.

Optional connection summary (approximate region, masked IP, latency) is consent-gated and not used for ads. See system status.

6. Processors / subprocessors

We use service providers as processors or independent controllers as applicable:

• Cloudflare — CDN, DNS, WAF, TLS edge
• Stripe, PayPal — payments
• Google (Sign-In; Analytics only after consent)
• Forward Email — transactional/inbound mail routing
• Infrastructure vendors in the EU for compute/storage (Proxmox cluster)

Business customers needing a signed DPA: email [email protected] with subject “DPA request”.

7. Retention

• Account data — while the account is active, then deleted or anonymized within a reasonable period after closure (unless legal holds).
• Billing records — as required by accounting law.
• Security/auth logs — typically weeks to months, longer if investigating abuse.
• Backups/snapshots — per plan limits (default 1 backup + 1 snapshot).

8. International transfers

Primary processing is in the EU. Some processors (e.g. Google, Stripe, Cloudflare) may process data in other regions under SCCs or equivalent safeguards.

9. Your rights

You may request access, rectification, erasure, restriction, portability, and objection where applicable, and withdraw consent for optional cookies. Contact [email protected]. You may lodge a complaint with your local supervisory authority (in Romania: ANSPDCP).

10. Children

Services are intended for adults / business users. We do not knowingly collect data from children under 16.

See also Payment & Service Terms and Acceptable Use Policy.