Legal
Privacy policy
Last updated: 24 September 2026
Who processes your data
The controller of your personal data is Flawless Beauty S.R.L., the company that runs the Podo Step By Step clinic, with its registered office at Str. Intrarea Epistolei nr. 2, ground floor, Sector 1, Bucharest, fiscal code RO40317963, Trade Register no. J40/4972/2024. For any question about your data: office@podostepbystep.ro or +40 729 437 374. This policy covers the data collected through this website and through the contact channels shown on it.
What data we collect
Booking form: your name and, optionally, your phone number, the service you want, your preferred day and time window and your message. When you submit the form, your name, phone number, service, day, time window, the page language and the fact that you ticked the consent box are stored by the hosting provider and emailed to the clinic, so that your request reaches us even if you do not send the WhatsApp message. The text in the “Message” field is not stored by the website and is not emailed: it reaches us only if you send the WhatsApp message. Digital assistant: the messages you write. Phone, WhatsApp and email: the details you choose to share with us. Technical data: on every visit, the hosting provider automatically records the IP address, date and time and the page requested, in logs used to run and secure the website. The website uses no cookies and builds no profiles.
Health data
A description of the problem you would like treated (for example a nail or sole condition) is health information, a special category of data (Art. 9 of Regulation (EU) 2016/679, GDPR). We process it only if you choose to share it and only with your explicit consent (Art. 9(2)(a) GDPR), which you give by ticking the box in the form or in the digital assistant. The box is never pre-ticked, and the message cannot be sent without it. The description in the “Message” field is not stored by the website and is not emailed; it reaches us only through WhatsApp, if you send the message. Please write only what is needed to arrange the appointment.
Purposes and legal bases
Answering your request and arranging the appointment: steps taken at your request before the service is provided (Art. 6(1)(b) GDPR) and, for health information, your explicit consent (Art. 9(2)(a) GDPR). The digital assistant: your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Running and securing the website: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR). Legal obligations, such as tax rules, once a service has been provided (Art. 6(1)(c) GDPR). We do not use data collected on this website for marketing, and we never sell or rent it.
The digital assistant (chat)
The answers to the frequently asked questions in the assistant are prepared in advance and send no data. Messages you type freely are sent, only after you tick the consent box, to an artificial-intelligence service provider (Claude models, developed by Anthropic, accessed directly or through OpenRouter), which generates the reply as a processor under contractual safeguards. Under these providers' terms, messages sent through their API are not used to train models. We do not store conversations on a server of our own; the provider may keep them for a limited period for security purposes. The conversation history and your consent are kept only in your browser, for the current tab, and are deleted when you close it. The assistant is an automated program, can make mistakes and takes no decision about you.
Who receives your data
WhatsApp (Meta): the form message opens in the WhatsApp app on your device and reaches us only if you send it; WhatsApp processes data under its own policy. Netlify, Inc.: hosting of the website and the digital assistant, and receiving the form requests (without the text in the “Message” field), which it stores and emails to the clinic, as a processor. Netlify filters requests for spam using the Akismet service of Automattic Inc. The artificial-intelligence provider described above. Google: only if you choose to load the map on the contact page. Public authorities, only where the law requires it. The links to Instagram, TikTok and Facebook are plain links and transmit no data until you click them.
Transfers outside the European Economic Area
Some of these providers are based in the United States. Transfers rely on the mechanisms of Chapter V GDPR: the adequacy decision on the EU-US Data Privacy Framework, for certified providers, or the standard contractual clauses approved by the European Commission. Netlify, Inc. is certified under the EU-US Data Privacy Framework and additionally uses the standard contractual clauses (Commission Implementing Decision (EU) 2021/914), included in its data processing agreement.
How long we keep your data
Form requests stored by Netlify: deleted automatically after 90 days. Booking requests received by the clinic (email, WhatsApp, phone): as long as needed to reply and arrange the appointment; if a request does not lead to a visit, we delete it once it is no longer needed, or sooner at your request. Conversations with the assistant: we do not keep them; in your browser, until you close the tab. Hosting technical logs: for the short period set by the provider. Accounting documents: for the periods required by law.
Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection, and the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise your rights, write to us at office@podostepbystep.ro; we reply within one month at the latest. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro.
Cookies and local storage
This website sets no cookies and uses no analytics, advertising or tracking scripts; the fonts and all other files are hosted with the website, not by third parties. That is why there is no cookie banner: the law requires consent only for storage that is not strictly necessary. The digital assistant uses only the browser's temporary storage (sessionStorage), for the conversation history and to remember your consent, strictly necessary for it to work and deleted automatically when you close the tab. The Google map on the contact page loads only after you press the button; only from that moment may Google receive your IP address and set its own cookies, under its policy.
Minors
Requests for a child under 16 are made by a parent or legal guardian.
Changes
We may update this policy when the way the website works changes. The date of the last update is shown at the top of this page.