Privacy Policy
Last updated: 29 October 2026
1. Who is the data controller
The controller of the personal data processed for your account and for operating the OptiPit Platform is COURTFIELD CONSTRUCT SRL, tax ID (CUI) 36107980, registered office at str. Gării nr. 66, Videle, Teleorman County, Romania. For any question or request about personal data: contact@optiflow.ro.
This policy explains what data we process, why and on what basis, who we share it with, how long we keep it and what rights you have, under Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian law.
Role of repair shops. An auto repair shop (Garage) using OptiPit enters and manages its own customers’ and jobs’ data in the Platform (customer records, vehicles, appointments, estimates, jobs). For that data the shop is an independent controller and is responsible for informing its customers and having a legal basis; we act as the platform provider. For your user account data and for the operation, security and audit of the Platform, we are the controller.
2. What data we process
Account and identity data
e-mail address, password (stored only as a cryptographic hash, never in clear), e-mail confirmation date, password set date;
first and last name, phone (optional), owner profile or shop team member profile, roles and organisation membership;
for shops and company owners: organisation identification data (name, contact, registration details you provide).
Vehicle and activity data
VIN, registration number, make, model, year, specifications, mileage, expiry dates (inspection, insurance, etc.), maintenance, technical history and interventions;
appointments, visits, estimates, estimate approvals, jobs, parts, generated documents (for example estimate or report PDFs);
documents and photos you upload (for example a vehicle photo, inspection/insurance documents, proofs). If a photo shows licence plates, people or other personal data, these become part of what you entrust to us; please avoid unnecessary information.
Access, consent and security data
authentication sessions, verification and reset tokens (kept only as hashes, for a limited time);
records of legal document acceptance (version accepted, time, language, a truncated cryptographic digest of the IP address – the plain IP address is not stored in this record);
consents and access grants from the Owner to shops;
audit log of sensitive actions (who, what, when – without the content of personal data);
IP address and technical identifiers used to limit abuse (rate limiting) and in server logs;
device token for push notifications, if you enable them in the mobile app.
We do not collect: device location, contacts, SMS or call logs, health data, payment data (the Platform does not process payments as of this policy). We do not use third-party advertising or behavioural analytics modules.
3. Why we process data and legal basis
| Purpose | Legal basis (GDPR) | |---|---| | Creating and managing the account, authentication, operating the Platform (vehicles, history, appointments, estimates, transactional notifications) | performance of a contract – Art. 6(1)(b) | | Platform security, fraud and abuse prevention, audit log, limiting repeated attempts | Operator’s legitimate interest – Art. 6(1)(f) | | Record of acceptance of terms and consents, and applicable legal obligations (including replies to authorities) | legal obligation – Art. 6(1)(c) and legitimate interest | | Push notifications, using the camera to photograph a vehicle or documents, Owner access grants to a shop | consent – Art. 6(1)(a), which you can withdraw at any time (device permissions are managed on your device; a shop’s access is withdrawn in the app) | | Obtaining vehicle specifications from the VIN and reading the VIN from an image, at your request | performance of a contract and legitimate interest in providing the feature you requested |
We do not take decisions based solely on automated processing that produce legal effects on you.
4. Who receives the data
Repair shops with which you have a valid relationship (for example a confirmed appointment or access you granted) see the relevant vehicle and relationship data, under the Platform’s access rules. A shop cannot access other customers’ or other shops’ data. Access granted through an appointment stays active until you withdraw it.
Providers that help us operate the Platform (processors): infrastructure hosting and the e-mail provider through which we send transactional e-mails.
Vehicle data provider (Auto.dev) – receives only the VIN to return the vehicle’s specifications; we do not send owner data.
Image text recognition provider (Google Cloud Vision) – if you use the VIN-from-photo scan, the image sent for recognition reaches this provider only to extract the text.
Firebase Cloud Messaging (Google) – only if you enable push notifications: receives the device token and notification content.
Public authorities, when required by law.
We do not sell your data and do not use it for advertising.
5. Transfers outside the European Economic Area
Some of the providers above (for example the vehicle data provider or Google services) may process data outside the EEA. In that case the transfer relies on the mechanisms provided by GDPR (for example adequacy decisions or standard contractual clauses). You can request more information at contact@optiflow.ro.
6. How long we keep data
We do not keep personal data longer than necessary for the purpose it was collected:
account data – while the account is active; when the account is deleted it is anonymised (see below);
tokens, sessions and temporary operational data – while needed for operation, then revoked or deleted;
vehicle technical history, estimates, approvals and generated documents – as long as needed for the vehicle’s history and the shop’s technical and commercial records, including periods required by law;
audit log and acceptance records – as long as needed for security, proof of compliance and defence of legal claims.
Details on what is anonymised and what is kept on account deletion: Account deletion and Data retention.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting earlier processing.
Access and portability: you can download an export of your personal data (JSON file) from the “My data” section of the app (Settings).
Erasure: you can delete your account in the app or through the public account deletion page. The account is anonymised; some data is kept as described in the documents above.
Rectification: you can correct profile data in the app or write to us.
For any other request, write to contact@optiflow.ro. We reply within one month at most, which may be extended under GDPR for complex requests. To protect you, we may ask you to confirm your identity.
If a repair shop holds your customer record, requests about that record can also be addressed to that shop, as controller.
Complaints. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – dataprotection.ro – without prejudice to other remedies.
8. Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS/TLS), passwords stored with dedicated hash functions, tokens stored only as hashes, access control by role and by relationship to each resource, limits on repeated attempts, an immutable audit log for sensitive actions. No method is perfect; in the event of a personal data breach we will act as GDPR requires, including mandatory notifications.
9. Children
The Platform is not intended for persons under 18 and we do not knowingly collect data from minors. If you learn that a minor created an account, write to us so we can delete it.
10. Cookies and similar technologies
We use only strictly necessary cookies. Details: Cookie Policy.
11. Changes to this policy
We may update this policy. Every version is kept with its effective date. For significant changes we will inform you and, where needed, ask you to acknowledge or accept the new version.
12. Contact
COURTFIELD CONSTRUCT SRL · CUI 36107980 · str. Gării nr. 66, Videle, Teleorman · contact@optiflow.ro