Privacy Policy
Last updated: October 30, 2026 (v2026-10)
Data controller
The controller that decides the purposes and means of processing your personal data is:
Cadru · email: contact@r1984.md
For any question about your data, contact us at contact@r1984.md.
What data we process
Depending on how you use the service, we may process the following categories of data:
- Account data: name, email address, one-time access code (OTP), avatar
- Photographs that may show identifiable people
- Order data: shipping and billing address (collected by the payment processor)
- Carousels: the project (text, layout, settings) and the photos, clips and graphics added in the editor. Without an account they stay in your browser only; signed in, they are saved to your Cadru account
- A connected AI assistant (e.g. Claude): the connected app, access tokens (kept only as a hash), the carousel open in the editor, the slide in view and the selected element (so the assistant works on what is in front of you), and the links to photos the assistant passes to us. What you write or show the assistant is processed by its provider, under its own policy
- Push notification subscriptions (device identifier)
- Technical data: IP address, device type, access logs
Legal bases and purposes
- performance of a contract or pre-contractual steps (account creation, delivering services and photos)
- your consent (audience statistics, some notifications, people tagging)
- legitimate interest (service security, abuse prevention, product improvement, aggregated anonymous audience statistics - cookieless, via the Umami tool hosted on our own servers)
- legal obligations (accounting, responding to authority requests)
Processors and transfers
We use service providers (processors) that process data on our behalf and only on our instructions:
| Provider | Purpose | Location | Transfer |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting and storage | EU (Germany) | No |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (access codes, notifications) | USA | Yes |
| Cloudflare, Inc. | Anti-bot protection (Turnstile) on forms | USA / EU | Yes |
| Peecho B.V. | Print and delivery of photo products, payment and VAT collection | EU (Netherlands) | No |
Some of these are located outside the Republic of Moldova. In those cases we ensure appropriate safeguards (standard contractual clauses or an equivalent mechanism).
How long we keep data
| Data category | Period |
|---|---|
| Account data | For the lifetime of the account; deleted 30 days after account closure |
| Gallery photographs | For the duration of the contract and delivery, then per the agreement with the client |
| Unfinished drafts (anonymous) | Deleted automatically after an inactivity period |
| Albums and zines in an account (photos, pages, PDFs) | Album never exported: 30 days without activity; exported album: the photos 180 days without activity (ordered in print: 365), the PDF 15 more days; unpublished zine: 30 days; published zine: while the account exists. Always with a warning email and 14 days to react. Details in the Terms, the section on limits. |
| Carousels (project, photos, clips, graphics and the email address) | Without an account: in your browser only, until you delete them; in an account: until you delete them or after 180 days without activity, with a warning email first (the files go with the carousel); when the account is deleted they are deleted automatically, files included, within 15 minutes; links sent by email without an account: 30 days, then deleted automatically |
| Carousels published to the Cadru Feed (the public gallery of carousels) (the exported slides, title, name shown, Instagram link, likes) | While they are published; you can take them out any time in the editor; deleted with the carousel or the account (the files at the next clean-up, within a day); likes are deleted with the account of whoever gave them |
| AI assistant connection | Connected apps and access keys: until you revoke them in the account (AI assistant) or close the account; access tokens expire in an hour, refresh tokens in 60 days; the position in the editor: only the latest, replaced on every change; the assistant's working copies on the server: deleted after 6 hours |
| Contact-form messages | Up to 24 months from the last interaction |
| Order and invoicing data | As required by applicable accounting law |
| Technical logs | Up to 12 months |
Your rights
Under personal data protection law, you have:
- the right to access your data
- the right to rectify inaccurate data
- the right to erasure (the right to be forgotten)
- the right to restrict processing
- the right to data portability
- the right to object to processing
- the right to lodge a complaint with the supervisory authority
You can exercise your rights by writing to contact@r1984.md or via the "Personal data" page. We respond within 30 days.
Security
We apply technical and organizational measures to protect data against unauthorized access, loss or disclosure. In the event of a security incident that risks your rights, we notify the authority and, where relevant, the affected individuals.
Supervisory authority
You have the right to lodge a complaint with the National Center for Personal Data Protection of Moldova (CNPDCP) (https://datepersonale.md).