Privacy Policy

1. Data controller

The controller of personal data collected through wstr.ro is:

2. What data we process

• Account data · first and last name, email address, password (stored only as a strong bcrypt hash – we can never see it)
• Order data · products purchased, amounts, currency, order number, date
• Payment data · processed entirely by Stripe; we pass Stripe your email address and the order reference, and receive back a transaction reference and status. Card numbers never reach our servers.
• Library & access data · which digital products your account holds, download timestamps, gift-code redemptions
• Technical data · IP address, browser type, pages visited (server logs, security). All typefaces, images and scripts of the site are served from wstr.ro itself, so loading a page sends no data to font or tracking services. Only the payment page is provided by Stripe.
• Correspondence · messages sent through the contact form or by email
• Withdrawal statements · name, email, order number, the items, your note, IP address and the date and time received

We do not collect special categories of data (health, beliefs, biometrics) and do not perform automated decision-making or profiling.

3. Purposes of processing

• Creating and operating your account and personal story library
• Processing orders, payments and delivering digital products instantly
• Issuing invoices and meeting accounting obligations
• Answering messages and support requests
• Securing the website, accounts and payment flow (fraud prevention)
• We currently run no analytics; any future statistics tool would be used only with your consent

4. Legal bases

• Performance of a contract (art. 6(1)(b) GDPR) · account, orders, delivery of digital products, support
• Legal obligation (art. 6(1)(c) GDPR) · invoicing and accounting records (Romanian Accounting Law no. 82/1991), consumer-protection obligations
• Consent (art. 6(1)(a) GDPR) · optional cookies, any future newsletter
• Legitimate interest (art. 6(1)(f) GDPR) · security of IT systems, fraud prevention, defence of legal claims

5. Retention periods

6. Recipients of data

• Stripe · payment processing (data processor / independent controller for fraud prevention)
• Hosting provider · Spatiul.ro · Romanian web-hosting company (cPanel) whose servers host wstr.ro, its database and our mailboxes, acting as our processor under a GDPR art. 28 agreement
• Email delivery · transactional emails (verification, order confirmations) are sent from our own domain through that same hosting provider
• Public authorities · only where the law requires (e.g. fiscal authorities, courts)

We never sell, rent or trade your personal data.

7. International transfers

Our servers are located in the European Union. Stripe may transfer payment-security data to the United States; such transfers rely on the EU–US Data Privacy Framework and Standard Contractual Clauses under art. 46 GDPR.

8. Your rights

• Access (art. 15) · confirmation and a copy of your data
• Rectification (art. 16) · correcting inaccurate data – write to us and we update it
• Erasure (art. 17) · we delete your account data; accounting documents are kept for the 5-year legal period and the limited evidence listed in section 5 only as long as stated there
• Restriction (art. 18) · temporary suspension of processing
• Portability (art. 20) · your data in a structured, machine-readable format
• Objection (art. 21) · against processing based on legitimate interest
• No automated decisions (art. 22) · we make none
• Withdraw consent (art. 7) · anytime, without affecting prior processing

9. How to exercise your rights

Write to contact@wstr.ro from the email address linked to your account (or include identification details), describing the right you wish to exercise. We respond without undue delay and in any event within one month of receiving your request. Where requests are complex or numerous, this may be extended by two further months; if so, we will tell you within the first month, together with the reasons for the delay (GDPR art. 12(3)).

10. Complaints · ANSPDCP

If you believe your data-protection rights were infringed, you may lodge a complaint with the National Supervisory Authority for Personal Data Processing:

11. Data security

• Encrypted HTTPS/TLS connections for all traffic
• Passwords stored exclusively as bcrypt hashes (cost 12)
• Payment card data handled solely by Stripe (PCI-DSS Level 1)
• Access to purchased content restricted to verified, entitled accounts
• Server access on a need-to-know basis; periodic reviews

In the event of a breach posing a risk to your rights, we will notify ANSPDCP within 72 hours and, where applicable, the affected persons.

12. Cookies

Cookies and similar technologies are covered in detail in the Cookie Policy. You can change your choices anytime via the round button at the bottom-left of every page.

13. Children’s data

Where Stories Take Root is a book for children, but wstr.ro is a shop for parents and adults. Accounts and purchases may only be made by persons aged 18 or over. We do not knowingly collect personal data from children under 16; if a parent or guardian discovers that a minor has provided data, contact contact@wstr.ro and we will delete it.

14. Changes to this policy

This notice may be updated to reflect legislative or service changes. The current version and date appear at the top. Significant changes will be announced on the website and, where appropriate, by email to account holders.