Privacy Policy

1. Data controller

The controller of personal data collected through wstr.ro is:

2. What data we process

• Account data · first and last name, email address, password (stored only as a strong bcrypt hash — we can never see it)
• Order data · products purchased, amounts, currency, order number, date
• Payment data · processed entirely by Stripe; we receive only a transaction reference and status. Card numbers never reach our servers.
• Library & access data · which digital products your account holds, download timestamps, gift-code redemptions
• Technical data · IP address, browser type, pages visited (server logs, security)
• Correspondence · messages sent through the contact form or by email

We do not collect special categories of data (health, beliefs, biometrics) and do not perform automated decision-making or profiling.

3. Purposes of processing

• Creating and operating your account and personal story library
• Processing orders, payments and delivering digital products instantly
• Issuing invoices and meeting accounting obligations
• Answering messages and support requests
• Securing the website, accounts and payment flow (fraud prevention)
• Anonymous statistics for improving the site — only with consent

4. Legal bases

• Performance of a contract (art. 6(1)(b) GDPR) · account, orders, delivery of digital products, support
• Legal obligation (art. 6(1)(c) GDPR) · invoicing and accounting records (Romanian Accounting Law no. 82/1991), consumer-protection obligations
• Consent (art. 6(1)(a) GDPR) · optional cookies, any future newsletter
• Legitimate interest (art. 6(1)(f) GDPR) · security of IT systems, fraud prevention, defence of legal claims

5. Retention periods

6. Recipients of data

• Stripe · payment processing (data processor / independent controller for fraud prevention)
• Hosting provider · servers hosting wstr.ro and its database, under a GDPR art. 28 agreement
• Email delivery · transactional emails (verification, order confirmations) sent through our mail infrastructure
• Public authorities · only where the law requires (e.g. fiscal authorities, courts)

We never sell, rent or trade your personal data.

7. International transfers

Our servers are located in the European Union. Stripe may transfer payment-security data to the United States; such transfers rely on the EU–US Data Privacy Framework and Standard Contractual Clauses under art. 46 GDPR.

8. Your rights

• Access (art. 15) · confirmation and a copy of your data
• Rectification (art. 16) · correcting inaccurate data (also possible directly in account settings)
• Erasure (art. 17) · deletion where legally possible (invoicing data must be kept 10 years)
• Restriction (art. 18) · temporary suspension of processing
• Portability (art. 20) · your data in a structured, machine-readable format
• Objection (art. 21) · against processing based on legitimate interest
• No automated decisions (art. 22) · we make none
• Withdraw consent (art. 7) · anytime, without affecting prior processing

9. How to exercise your rights

Write to contact@wstr.ro from the email address linked to your account (or include identification details), describing the right you wish to exercise. We respond within 30 calendar days; for complex requests this may be extended by up to two months, with prior notice.

10. Complaints · ANSPDCP

If you believe your data-protection rights were infringed, you may lodge a complaint with the National Supervisory Authority for Personal Data Processing:

11. Data security

• Encrypted HTTPS/TLS connections for all traffic
• Passwords stored exclusively as bcrypt hashes (cost 12)
• Payment card data handled solely by Stripe (PCI-DSS Level 1)
• Access to purchased content restricted to verified, entitled accounts
• Server access on a need-to-know basis; periodic reviews

In the event of a breach posing a risk to your rights, we will notify ANSPDCP within 72 hours and, where applicable, the affected persons.

12. Cookies

Cookies and similar technologies are covered in detail in the Cookie Policy. You can change your choices anytime via the round button at the bottom-left of every page.

13. Children’s data

Where Stories Take Root is a book for children, but wstr.ro is a shop for parents and adults. Accounts and purchases may only be made by persons aged 18 or over. We do not knowingly collect personal data from children under 16; if a parent or guardian discovers that a minor has provided data, contact contact@wstr.ro and we will delete it.

14. Changes to this policy

This notice may be updated to reflect legislative or service changes. The current version and date appear at the top. Significant changes will be announced on the website and, where appropriate, by email to account holders.