Privacy Policy

Version 2026-10-21. Repair Command Center ("RepairCmd") is provided by EVOCELL S.R.L., Str. Valea Miroslavei nr. 1B, Camera 1, Miroslava village, Miroslava commune, Iași County, Romania, company ID 38764900 ("we"). For any data question: [email protected]. The Romanian version prevails if versions differ.

1. Two different roles

  • Controller: for shop-account data (owners and staff), security, support, subscription billing and our own legal obligations, we decide how and why data is processed.
  • Processor: for the data a shop enters about its customers (repair tickets and so on), the shop is the controller and we process that data only on its behalf, under the Data Processing Agreement. If you are a repair shop's customer, please contact the shop first (see Data requests).

2. Shop-account data (we are the controller)

  • Name, e-mail, phone, business name and address, role in the shop — to create and run the account and send service messages. Basis: performance of the contract (Art. 6(1)(b) GDPR).
  • Password (stored only as a hash), two-step verification factors, sessions — sign-in and security. Basis: contract (b) and our legitimate interest in protecting accounts (f).
  • Access and error logs (IP address, browser, actions, time) — security, troubleshooting and abuse prevention. Basis: legitimate interest (f).
  • Support messages — to answer requests. Basis: contract (b) and legitimate interest (f).
  • Requests from a repair shop's customers that reach us (name, contact, the shop's name — only what the person sends) — to forward the request to the shop and keep proof that it was forwarded. Basis: legitimate interest in helping people exercise their rights and our duty to assist shops (f, c).
  • Acceptance of the terms (version, text hash, time) — proof of acceptance. Basis: legal obligation and legitimate interest (c, f).

3. A shop's customer data (we are a processor)

A shop may record: the customer's name and contact details; the device brand, model, IMEI or serial number; fault description, repair ticket, quotes, approvals and warranties; photos and attachments; payments and financial-document references; messages between the shop and the customer; and an action history (who did what, when). We process it only to provide RepairCmd to the shop, on its instructions.

4. Service providers (sub-processors)

  • Supabase, Inc. (on AWS infrastructure) — database and authentication; data stored in the EU region (Ireland, eu-west-1).
  • Acvile Tech / Cloudify.ro — application server, in Romania.
  • Cloudflare, Inc. — network and protection for repaircmd.com (DNS, CDN, firewall, which see traffic and IP addresses); storage of photos and attachments (R2); encrypted backups (R2, EU jurisdiction); forwarding of e-mails sent to contact@ and privacy@.
  • Brevo (Sendinblue SAS) — sending account e-mails (confirmation, password reset, invitations); EU.
  • Google (Gmail) — the mailbox that receives e-mails sent to contact@ and privacy@ (forwarded by Cloudflare Email Routing), including anything written or attached in them; Google LLC, USA, certified under the EU-US Data Privacy Framework. Please do not send your customers' personal data by e-mail: refer to a repair by its ticket number.
  • jsDelivr (CDN) — downloading the digit-recognition engine when an IMEI is scanned with the camera; it receives the technical data of that download request (IP address, browser, requested file); the image never leaves the device.
  • Healthchecks.io — monitoring of the backups; our server sends it only a timing signal, with no shop or customer data.

Where a provider or part of its infrastructure is outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework (for certified providers) or on the European Commission's standard contractual clauses in that provider's data processing terms (Cloudflare, Google and Supabase are US companies). External integrations (for example paid checks) are not active today, and SmartBill is used only by shops that connect their own SmartBill account; providers are added to this list before activation.

5. How long we keep data

  • The shop's data and its customers' data: for as long as the account is active. Once a customer has no open repair, the shop can use "Remove contact details" on the customer's page: it removes the customer's name and contact details, device passcodes and message texts, while repair tickets, payments and warranties remain for the shop's legal obligations. It does not change free text typed elsewhere (fault descriptions, quotes, notes) or photos; if those contain personal data, the shop can correct them or ask us.
  • When the account is closed: after the confirmed request we delete the data from the database without undue delay and confirm it in writing, except what the law requires us to keep.
  • Backups: encrypted daily copies of the database kept for 31 days and a monthly copy kept for 400 days, protected against early deletion. Data deleted in the app disappears from these backups only when they expire; until then they are used only to restore after an incident and for regular restore tests on an isolated test system. Older database copies made before this backup system are being inventoried and will be deleted or brought under the same periods.
  • Technical logs: server logs are kept for security and troubleshooting. Automatic deletion after at most 90 days is being set up; until it is active, logs may be kept longer, and we delete them on request where they are not needed for security.
  • Photos and attachments: stored separately from the database; they are deleted when the account's data is deleted on request (not automatically), and they are not part of the daily database backups.
  • Our invoices to shops: the period required by Romanian accounting law (Law 82/1991, Article 25: generally 5 years, counted from 1 July of the year after the financial year), or longer where a specific rule requires it.

6. Security

Encrypted connections (HTTPS), per-shop data isolation enforced in the database, passwords stored only as hashes, mandatory two-step verification for platform administrators, encrypted backups with separately held keys, tested by restoring them. No measure removes all risk; we will notify you as the law requires if an incident affects your data.

7. Cookies

We use only strictly necessary cookies and browser storage: the sign-in session; your language and currency preferences; and small working data that lets the app remember your choices or finish an interrupted action (for example print settings, the last payment method chosen, an import's column mapping, a pending administrative action). We use no advertising or analytics cookies or scripts.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw consent where processing is based on it. Write to [email protected]; we answer within one month. You may complain to the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro) or the authority where you live or work.

9. Changes

Each new version is published with its date; earlier versions are available on request. Important changes are announced in the app.

10. Contact

EVOCELL S.R.L. · [email protected] · [email protected] · +40 747 457 488

Version 2026-10-21