Privacy Policy

1. Who we are

The data controller is Metropolitan Research & Technology SRL, a company registered in Romania (CUI 51196409, Nr. Reg. Com. J2025005608002), with its registered office at [Registered office address], Romania (“we”, “us”).

For any privacy question or to exercise your rights, contact us at contact@researchlab.ro.

2. What this policy covers

This policy applies to:

• this website;
• the consumer mobile applications we publish on the Apple App Store and Google Play (the “Apps”);
• communication with us by email or through our support page.

When we build software for clients under contract, the client is usually the controller of their users’ data and their own privacy policy applies.

3. Data we collect

Information you give us

• Account data (if an App offers accounts): email address, display name and sign-in identifiers, including those provided by Sign in with Apple or Google.
• Content you create in an App, stored so the App can work and sync across your devices.
• Support requests: your name, email address and the contents of your message.

Information collected automatically by the Apps

• Device and app information: device model, operating system version, app version, language and region.
• Usage data: which features you use, screens viewed and session timing, in pseudonymous form.
• Diagnostics: crash reports and performance logs.
• Identifiers: an app-specific install identifier and, for notifications, a push token. We only access your device advertising identifier (IDFA) if you allow tracking when iOS asks you.
• Purchase information: product, subscription status and transaction identifiers. Payments are processed by Apple or Google; we never receive your card details.

Information collected by this website

Our hosting provider records standard server logs (IP address, browser type, pages requested and time) for security and reliability. This website does not use advertising cookies.

We do not knowingly collect special categories of data (such as health, religious or biometric data). We do not sell personal data.

4. Why we use it and our legal basis

5. Who we share data with

We share personal data only with service providers that process it on our behalf under data processing agreements, for example:

• cloud hosting and database providers;
• crash reporting and analytics providers;
• email and customer support tools;
• Apple and Google, as app distributors and payment processors (under their own privacy policies);
• advertising and attribution partners, only where you have given consent.

We may also disclose data where required by law or to protect our rights. A current list of our processors is available on request.

6. International transfers

Some providers may process data outside the European Economic Area. When they do, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

7. How long we keep data

• Account data and content: for as long as your account exists, then deleted within 30 days of a deletion request, except where we must keep it longer by law.
• Support correspondence: up to 3 years after the last contact.
• Analytics and diagnostics: up to 26 months.
• Accounting records: as long as required by Romanian law (generally up to 10 years).

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting past processing.

To exercise any of these rights, email contact@researchlab.ro. We reply within one month. You can also delete your account from inside an App where that option is offered, or ask us through the support page.

You have the right to complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at dataprotection.ro, or to the authority in the EU country where you live.

9. Tracking choices

• iOS: Settings → Privacy & Security → Tracking.
• Android: Settings → Google → Ads → Delete advertising ID.
• Notifications: turn them off at any time in your device settings.

10. Children

Our Apps are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

We protect data with encryption in transit, access controls and regular security reviews. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

12. Changes to this policy

We may update this policy. We will change the “last updated” date above and, for significant changes, notify you in the App or by email.