Privacy Policy

1. The data controller

The controller of personal data for Grupul Antreprenorilor is ExeqT Ltd, with its registered office at Vyzakias 9, 13, Castle Complex, Paralimni, 5297, Famagusta, Cyprus. For any request concerning your data, you can write to us at privacy@grupulantreprenorilordinromania.ro.

2. The data we collect

• Account data: email address and name. Sign-in is passwordless (magic link) — we do not collect or store passwords. When a group plan is purchased, the public checkout (email only) automatically creates or links an account based on that address.
• Public profile data: company, industry, city, description and the contact details you choose to make public.
• Facebook links: the link to your personal Facebook profile (for the VIP and Founders plans) and/or the link to your business's Facebook page (for the Business Page and Founders plans), used to identify you and approve/unblock you in the group.
• Billing data: when a plan is purchased, the company name, address and VAT number, processed through Stripe.
• Generated content: reviews, messages, announcements, requests.
• Technical data: IP address, browser type and logs, used for security and to prevent abuse.
• Marketing data: when Facebook marketing is active, identifiers from the Meta Pixel cookies (_fbp, _fbc) and conversion events sent to Meta (Pixel + Conversions API) to measure the effectiveness of campaigns.
• Networking Profile data (private, optional): if you activate the Networking Agent, we collect the information you enter in the private profile, grouped into four sections:
  • About you: business context (free text), industry, city or country, languages spoken and an optional professional link.
  • What you are looking for: the desired commercial result, the type of partner, the industries or categories targeted, the geographical scope (local, national, remote or international), the time horizon, mandatory criteria and exclusions.
  • What you can offer: expertise, products or services, distribution, the access you can open up, recommendations, the collaboration format and availability.
  • Limits: the maximum number of proposals per month, excluded industries, excluded organisations or competitors, the contact fields you accept for disclosure (by default: the email address only), your preference for receiving proposals by email and — separately — your marketing preference.
  From these texts we generate derived numerical representations (vectors), used exclusively to calculate the similarity between what one person is looking for and what another offers. The representations are not shown to anyone and cannot be read as text.
• Records of the agent's operation: the proposals generated (internal score, reason for the match, limited summaries, the rule version and the model used), your decisions to accept or decline together with the version of the wording displayed at that moment, the fields actually passed on in a bilaterally approved introduction, the log of introduction emails sent and the feedback you give after an introduction.

Where the Networking Profile data comes from. It comes entirely from you: you enter it directly in the configuration form or dictate it to the platform's AI assistant, which can save only a draft, subsequently confirmed by you. So that you do not have to rewrite what you have already filled in, the form can pre-fill fields from your existing public profile (company, industry, city, description); you can change any pre-filled value before saving. The name and email address used in an introduction come from your account data.

We do not build the Networking Profile from external sources and we do not complete it through automated collection from the internet. The automatic completion service from public sources mentioned in the table in section 4 concerns exclusively the public profile in the directory, not the private networking profile.

3. Legal bases and purposes

We set the legal basis separately for each processing purpose. The presence of a tick box in the interface does not automatically turn the processing into consent-based processing:

The Meta Pixel marketing cookies, used for advertising campaigns, are also based on consent — details in the Cookie Policy.

Deterministic processing vs AI-assisted processing. Matches are selected in two stages. The first stage is entirely deterministic: strict filters (the industries and organisations you have excluded, the geographical scope, your monthly proposal cap, the waiting period for the same pair) and a numerical similarity score calculated on the derived representations, with a fixed minimum threshold. The second stage is AI-assisted: a language model receives the redacted texts of the two profiles and produces the explanation of the match and the limited summaries.

There is no automated decision that produces legal effects concerning you or similarly significantly affects you: the agent only proposes, each introduction depends on two separate human decisions, and during the pilot period there is also an intermediate human review before the proposal is presented to you.

4. Providers and sub-processors

We share data only with the providers strictly necessary for operation, under a data processing agreement (DPA):

What we send to the AI model provider. To generate the Networking Agent's explanations and limited summaries, we send redacted text from the two profiles: we do not send the parties' names, company names, email addresses, telephone numbers or links. The output received from the model is in turn filtered on our server to remove any email addresses, telephone numbers or web addresses that appear by accident. The derived numerical representations are generated from text that contains no contact details.

5. International transfers

Some of the providers above process data outside the European Economic Area (for example in the United States). These transfers take place on the basis of appropriate safeguards — mainly the European Commission's standard contractual clauses — and the principle of data minimisation.

Processing related to the Networking Agent involves transfers outside the European Economic Area: the AI model provider processes in the United States, and the transactional email provider may process in both the European Union and the United States. These transfers rely on the same appropriate safeguards mentioned above. In the case of the AI model, minimisation is additionally applied through the redaction described in section 4: members' identifying and contact data do not leave our infrastructure as part of this processing. The name and the approved contact fields are passed on only through the introduction email, via the transactional email provider.

6. Visibility between members — "Who viewed your profile"

The Platform includes the "Who viewed your profile" feature, which involves a form of data exposure between members:

• What is disclosed, and to whom: when a signed-in member visits another member's profile, the owner of the visited profile can see that they received a visit — including the visitor's name, company and profile link, and the time of the visit. This exposure occurs by default, because transparency between professionals is an intended component of the B2B network.
• Opt-out — incognito mode: if you do not want your visits to be recorded and shown to profile owners, you can enable incognito mode in your account settings. While incognito mode is active, your visits are not recorded and do not appear in the visitor list of any profile.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR) — mutual transparency within a B2B business network, with an opt-out guaranteed through incognito mode.
• Retention period: view records are kept for 30 days, after which they are deleted automatically.

6A. The Networking Agent — private profile, proposals and bilateral disclosure

• The Networking Profile is private. It does not appear in the public directory, is not indexed by search engines or AI crawlers and is not made available to other members in full. It is separate from your public profile: changing one does not change the other.
• What the other party sees before acceptance. Only a limited summary, generated specifically for them: the need, the offer, the field and the reason for the match. The summary does not contain your name, company name, email address, telephone number or links. Each party receives its own summary of the other; the two summaries are different and neither party sees the other's summary.
• Who else sees these summaries. During the pilot period, a platform administrator reviews the proposal before it is presented to you and, for that purpose, sees both summaries, the internal score and the reason for the match. The review aims to ensure the quality of matches and to prevent unsuitable proposals. When the pilot period ends, this review may be removed, and the policy will be updated accordingly.
• Disclosure happens only bilaterally. Contact details are passed on only after both parties have separately accepted the same proposal. The name is passed on, together with only the contact fields each party selected in advance in the "Limits" section (by default: the email address only). A single acceptance discloses nothing, and the party who did not accept does not learn who accepted.
• Withdrawal and irreversibility. You may withdraw your acceptance as long as the other party has not decided and the introduction has not been sent. Once sent, the data is in the other party's possession and can no longer be recalled by us.
• Acceptance is not permission for marketing. Approving an introduction authorises contact for the proposed business discussion. It does not constitute consent to direct marketing, to being added to commercial communication lists or to unsolicited prospecting. The acceptable use rules in the Terms and Conditions expressly prohibit these practices.
• What the agent does not do. It does not contact anyone on your behalf, does not send messages, does not publish anything from your private profile and does not add anyone to any communication list.
• Proof of consent and audit records. For each acceptance or decline we record the version of the wording displayed at that moment; for each proposal we record the version of the matching rules and the model used; for each introduction we record the fields actually passed on and the time it was sent. These records exist so that we can demonstrate that a disclosure took place only on the basis of two approvals, to resolve complaints and to investigate any incidents.
• Email notifications. As part of the service, we send you emails about: the activation of the agent, the appearance of a possible opportunity, confirmation that your acceptance has been saved, the bilateral introduction and the request for feedback after an introduction. You can opt out of proposal emails in the "Limits" section (you remain notified in the interface) or pause the agent. Emails confirming an action you took — in particular the bilateral introduction — are sent in any case, because they are part of the service requested.
• Pause and withdrawal. You can pause the agent at any time: the profile remains saved but no longer generates or receives proposals. You can delete the Networking Profile without closing your account.

6B. The app in ChatGPT and Claude

• What it does. With the Grupul Antreprenorilor app in ChatGPT (or the connector in Claude), the assistant can search the public business directory, show businesses' pages and, when you ask for it, send a quote request to a business.
• What the assistant sees. Only public directory data, exactly as on this website, with only the contact details each business chose to make public.
• What we receive with a search. The search text and, from ChatGPT, your language, an approximate location (city and country) and an anonymised identifier generated by ChatGPT. We use the language and the city only to answer in your language and to list nearby businesses first, and the identifier only to limit abuse. We do not keep them, we do not create an account and we do not link them to a member profile; the IP address of the request is handled like the other technical data (section 2).
• Quote requests. When you ask the assistant to contact a business and confirm the request, we receive your name, email address, telephone number, your message and, optionally, a budget. We save them as a request in that business's inbox and email them to the business, so it can reply to you directly — exactly as with the request form on the business's page. Nothing is sent without your confirmation, and the same request is not sent twice.
• What stays with OpenAI or Anthropic. Your conversations with ChatGPT or Claude are governed by their terms and privacy policies; we receive only what the assistant sends to our app for the actions above.

6C. Requests sent to businesses — follow-up and answers

When you send a request to a business through Grupul Antreprenorilor — from the form on the business's page, as a quote request, through Conector (on the website or through the Conector in ChatGPT), through the website's AI assistant or through the app in ChatGPT or Claude — the business receives the request by email. So that the request does not go unanswered, we follow up on it:

• Reminder to the business. If after 48 hours the business has not answered through the answer link, has not sent an offer from its account and has not marked the request as handled, we send it one reminder by email, with a link through which it can answer you without signing in. The link is valid for 14 days.
• The question after Conector. For requests sent through Conector (on the website or through the Conector in ChatGPT), about 2 days after sending we ask you by email whether you have received an answer and give you a link through which you can look for another supplier. The email is sent once for each business that received the request, whether or not that business has answered.
• Email to you after 5 days. If after 5 days the business has not answered through the answer link, has not sent an offer from its account and has not marked the request as handled, we write to tell you that you have no answer yet, show you up to 3 other businesses in the same field, with links to their public pages, and send you the link to a status page, for which you do not need an account. The other businesses are chosen only from businesses listed in the directory and are not among those that already received the request. When the same request went to several businesses (for example through Conector), you receive a single email for the whole request, only if none of them has answered, and the status page covers all of them. On the status page you can see who received the request and what each one answered, and you can say how it ended: you chose one of the businesses, you chose someone else, you chose nobody, or you are still looking. Requests sent from ChatGPT or Claude — through the Grupul Antreprenorilor app (from ChatGPT, Claude or another AI assistant connected to it) or through the Conector in ChatGPT — do not receive this email for now.
• The business's answer. When the business answers through the answer link, we email you its answer. The answer is for information only and is not a firm offer. The email shows the business's public contact email address, if the business has set one, and otherwise the email address of the business's account, so that you can continue directly. If you have a Grupul Antreprenorilor account with the same email, you also see the answer in your account's notifications.
• Closing the request. If after 21 days the business has not answered through the answer link, has not sent an offer from its account and has not marked the request as handled, the request is closed as expired.
• Requests through the business's widget and requests the business brings in itself. Requests sent through the widget on a business's own website (the Grupul Antreprenorilorassistant the business installed on its website) and requests that a business brings in itself are handled by that business and receive none of the emails above.

7. How long we keep data

We keep data while the account is active and thereafter only for the period required by legal obligations (e.g. billing records) or by legitimate security interests. When the account is deleted, profile data is removed and conversations are deleted in accordance with the retention policy. Profile view records (the "Who viewed your profile" feature) are deleted automatically after 30 days.

The Networking Agent:

• The Networking Profile — while it is active or paused and while the account exists. It is deleted at your request, independently of the account.
• The derived numerical representations — deleted together with the profile they come from.
• Closed proposals (declined, expired or withdrawn) — 12 months, in reduced form, to avoid proposing the same pair again, for audit and for handling complaints.
• Decision and introduction records (who accepted, which fields were passed on, when and in which version of the wording) — for the duration of the contract and thereafter for the applicable general limitation period, as proof of the consent specific to each introduction.
• Feedback after an introduction — 24 months, used to improve the service.
• Data already passed on through an introduction — is in the other party's possession; we cannot delete it from their systems.

Requests sent to businesses (section 6C):

• What we keep — the request, the contact details you gave in it, the attached files, the business's answers and the outcome you recorded on the status page.
• For how long — as long as needed for both sides to see the request's status and history (you on the status page, the business in its account) and while the business's account exists. For now there is no period after which requests are deleted automatically.
• Deletion — the request is deleted when the business deletes it from its account or when you ask us to, at the address in section 1. The business's answers and the attached files are deleted together with the request. When a business's account is deleted, the requests it received are deleted too, with their answers and attached files.

8. Your rights (GDPR)

• The right of access, rectification and erasure.
• The right to data portability (export from your account).
• The right to restriction and objection.
• The right to lodge a complaint with the competent supervisory authority (in Cyprus, the Commissioner for Personal Data Protection).

How to exercise your rights in relation to the Networking Agent:

• Access and portability: you can export at any time, from your account, a structured file with everything the agent holds about you — the private profile, proposals, decisions, introductions and feedback.
• Rectification: you can edit the private profile at any time; a change triggers a re-evaluation of matches.
• Erasure: you can delete the Networking Profile without closing your account. Open proposals are closed and the derived representations are removed. Only the minimum records proving consent are kept, in accordance with section 7.
• Restriction and objection: pausing the agent stops matching processing while keeping the data.
• Withdrawing consent: where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it and cannot cancel an introduction already sent.
• Marketing: marketing consent is separate from the use of the agent. Withdrawing it does not affect the operation of the service, and switching off proposal emails does not amount to withdrawing marketing consent.

9. Cookies

We use essential cookies for authentication and security, plus aggregate traffic analytics without tracking cookies (Plausible). When Facebook marketing is configured, the Meta Pixel may set tracking cookies (_fbp, _fbc) to measure the effectiveness of advertising campaigns. Details in the Cookie Policy.

With your consent, we also measure arrivals through campaign links and views of the dashboard and proposal cards. Our first-party gar_product_visit cookie is optional, HttpOnly and expires after 30 days; it contains a random identifier, without your name or email. After sign-in, the visit can be associated on our server with your account identifier for aggregate reports about activity and verified payments. Withdrawing consent in cookie settings stops this measurement and removes the cookie and the visit record associated with the browser. Operational records of decisions, permissions and payments remain separate.

10. Changes and contact

Each version of this policy carries a version identifier and an effective date, shown at the top of the page. The current version is 2026.10, in force from 9 October 2026. For substantial changes concerning the Networking Agent — in particular the rules on disclosing contact details, the providers involved or the retention periods — we inform you by email, at the account's address, before they take effect. For each account we record the version accepted and the moment of acceptance.

We may update this policy from time to time; the "Last updated" date reflects the current version. For any privacy question: privacy@grupulantreprenorilordinromania.ro. See also the Data Processing Agreement (DPA).