Privacy Policy

The controller of your personal data is NEUROBYTE ENTERPRISE S.R.L., headquarters in Bucharest, Sector 2, Str. Recreerii nr 2D. The OnlyDeal app is owned by NEUROBYTE ENTERPRISE S.R.L. and operated and published by ALLPHONE APPS SRL under authorization from NEUROBYTE ENTERPRISE S.R.L.

For data protection questions, you can contact us at privacy@onlydeal.ro. If we formally appoint a Data Protection Officer where legally required, we will publish the relevant contact details separately.

This Privacy Policy also applies when you use the OnlyDeal mobile application, including the OnlyDeal iOS/mobile marketplace application.

When you use app features, we may process the account, profile, contact, and business identifiers you provide; listings and other user-generated content, including listing photos, videos, audio, messages, and moderation-related reports or records; and payment, payout, order, and transaction data.

Where you use location-enabled features and grant permission, the app may process precise or coarse location information to support listing and pickup-related features.

Where you use search or product-discovery features, we may process search queries, filters, viewed or otherwise interacted-with products or listings, and related interaction history.

Depending on the features you use, we may process push-notification tokens, device hashes, login history, and technical, security, or diagnostic information.

Analytics in the app is optional and consent-gated. Where you grant analytics consent and enable the relevant in-app setting, we may process app-use analytics and related telemetry; you can manage this setting in the app's privacy and security controls.

App data may be handled by processors and service providers needed for payments and payouts, storage and media, communications and notifications, moderation, security, diagnostics, and consent-based analytics.

You can request account deletion from the app's privacy and security settings or at https://onlydeal.ro/account-deletion. A 30-day cancellation period applies before deletion and anonymization are completed. Some transaction, accounting, tax, fraud-prevention, dispute, or legal-claims records may be retained or isolated where required by law or necessary to establish, exercise, or defend legal claims.

**Identity/Profile:** username, display name, profile content, account type.

**Contact:** email, phone, address book and shipping details.

**Trader/Business Verification Data:** company name, VAT/tax identifiers, registration documents, representative identity, bank details, and other information necessary to verify trader status or trader traceability.

**Transaction Data:** listings, orders, delivery events, payouts, support/dispute records.

**Security/Technical:** device and session metadata, IP logs, fraud and abuse signals.

**Consent-Based Analytics/Replays:** page path, device/browser metadata, click/scroll/navigation events, and privacy-mode replay data where analytics consent is granted; visible text, form input values, network payloads, and console logs are not intentionally recorded by our replay configuration.

**Operational Request Metadata:** endpoint/path, query key names, request/response size and timing, protocol/host, selected HTTP headers (e.g., user-agent, accept-language, referer/origin), and infrastructure request identifiers.

**Data from Other Sources:** information from payment processors, logistics partners, verification/anti-fraud providers, other users involved in a transaction, public sources, or authorities, to the extent permitted by law.

We process personal data for account creation and administration, listing publication and moderation, processing orders, payments, payouts, deliveries, returns, and disputes, service communications, support, fraud prevention, and compliance with legal obligations.

For trader/business accounts and certain transactions, we may process additional data for identity and trader-status verification, tax compliance, trader traceability obligations, and cooperation with authorities or relevant processors.

Where you grant analytics consent, we may use privacy-mode session replay and analytics to understand navigation patterns, detect UX friction, improve product quality, and diagnose frontend issues without intentionally recording form contents, private messages, payment details, or account-management flows.

We also process strictly necessary server-side telemetry for service security, abuse detection, incident investigation, audit, platform integrity, operational continuity, and technical performance improvement.

Legal bases include contract performance or pre-contractual steps (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), and consent where required (Art. 6(1)(a)). Our legitimate interests may include platform security, fraud prevention, defense of rights, and safe administration of the service.

Recipients may include payment processors, logistics partners, cloud/storage vendors, communication providers, analytics and session replay processors, authentication, verification and anti-fraud services, consultants, auditors, and authorities where required or necessary.

Where providers act as processors, we use GDPR-compliant contracts and security controls. We may also disclose data where necessary to establish, exercise, or defend legal claims.

Data is retained only as long as necessary for service delivery, legal compliance, fraud prevention, and dispute handling.

Operational/security telemetry is retained for limited periods with rotation and access controls, unless longer retention is required for investigations or legal obligations.

Certain records (including accounting, tax, transaction, anti-fraud, or legal-claims records) may be retained for mandatory statutory periods or until applicable limitation periods expire.

When data is no longer needed, we delete, anonymize, or isolate it in accordance with our internal policies and legal obligations.

If data is transferred outside the EEA, we apply appropriate safeguards (such as Standard Contractual Clauses) and supplementary protections where required.

You may request access, rectification, erasure, restriction, objection, and portability, subject to legal limitations.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You may also lodge a complaint with your competent supervisory authority.

You can request account deletion directly at https://onlydeal.ro/account-deletion or from account security settings. A 30-day cancellation period applies before deletion and anonymization are completed, subject to the limited legal retention described above.

Some data is contractually or legally required for account creation, order processing, delivery, payments, fraud prevention, and compliance. If you do not provide it, we may be unable to create the account, execute the transaction, or provide certain services.

You are not required to provide data for processing based solely on consent, but the absence of such data may make certain optional features unavailable.

We may use automated rules for fraud detection, security, risk scoring, or operational checks. Based on the information published here, we do not take solely automated decisions producing legal effects or similarly significant effects on individuals unless this is permitted by law and separately disclosed where required.

For privacy requests, contact privacy@onlydeal.ro. We may request identity verification for account safety and to prevent unauthorized disclosure.