01About this Privacy Policy

1.1. This Privacy Policy (the “Policy”) describes how BOSTAN ENTERPRISE S.R.L., with its registered office at București, Sector 1, Intrarea Navigatorilor nr. 2A, Romania, registered with the Trade Register under no. J2026046044002, having CUI 55281310 (“Libertos”, the “Controller” or “we”), collects and processes personal data in connection with the access to and use of the Libertos platform, available at libertos.org, the creation and administration of the Account, the provision of the Briefings and the use of the other Libertos services and functionalities (the “Service”).

1.2. Personal data are processed in accordance with Regulation (EU) 2016/679 (the “GDPR”), as well as with the other legal provisions applicable in the field of personal data protection.

1.3. We recommend that you read this Policy together with the Libertos Terms and Conditions and, where applicable, with the Cookie Policy, in order to understand how your data are used in the context of the Service.

1.4. Definitions. For the purposes of this document:

• “Platform” means the website www.libertos.org and the digital services associated with it;
• “User” means any person who accesses or uses the Platform, whether or not they hold an Account;
• “Account” means the individual account created by the User for accessing the personalised services;
• “Subscriber” means the User who purchases a paid subscription plan;
• “Service” means the functionalities made available through Libertos, including the personalised briefings and information feeds, access to content, the selection of interests and of the frequency of communications, and other functionalities available at any given time;
• “Briefing” means the personalised selection and synthesis of information created by Libertos according to the interests, fields and parameters selected by the User;
• “Sources” means the publications, news agencies, websites, databases and other third-party sources on the basis of which information is identified and synthesised;
• “Subscription” means paid access, for a fixed period or with automatic renewal, to the functionalities included in the plan chosen by the User;
• “Order” means the electronic expression of the User’s intention to purchase a Subscription or another Service against payment through the Platform.

02Who is the data controller

2.1. The Controller of the personal data processed in connection with the Service is: BOSTAN ENTERPRISE S.R.L., a Romanian legal entity, with its registered office at București, str. Navigatorilor 2 A, sector 1, Romania, registered with the Trade Register Office under no. J2026046044002, CUI 55281310, contact e-mail [email protected].

Libertos may be contacted for questions or requests concerning the processing of personal data and the exercise of the rights provided for by the GDPR at the e-mail address: [email protected].

2.2. Libertos offers natural persons and professionals a digital information service through which Users may receive Briefings and selections of information tailored to their interests and preferences.

For this purpose, Libertos uses automated technologies and artificial intelligence systems for identifying, selecting, aggregating, analysing, synthesising and personalising information originating from external sources.

The objective of Libertos is to facilitate Users’ access to information relevant to the fields and topics of interest they have selected, by providing a personalised, structured information feed that is referenced to the sources used.

03Where do we collect your data from?

3.1. We collect personal data mainly directly from you, and also as a result of your use of and interaction with the Libertos Platform.

3.2. Depending on how you use the Platform and the Services, we may obtain personal data from the following sources:

• directly from you, including when you create or manage your Account, select or change the topics and fields of interest, the markets or countries of interest, the language, frequency and time of the Briefings, provide information in free-text fields, rate or save content, send feedback or contact us;
• With your permission, we record stories you view or open, active reading time and source-link clicks. Records are linked to your account and used to understand use of the reader. They do not change your interests or briefing depth. Raw events expire after 30 days through scheduled cleanup. Withdrawal stops new collection and schedules deletion of reading events linked to that consent. Cleanup runs hourly, so expiry can take up to one additional hour. It also allows website statistics to record product actions you take, such as signing in, generating a briefing or starting checkout, and their outcome together with your internal account identifier, signed-in state and plan tier; never your email address, name or reading content.
• Personalization uses only preferences you state and explicit feedback. Passive reading activity and questions do not infer interests or briefing depth.
• from public sources and external information sources, including press publications, publicly accessible websites and web pages, press releases, official sources, publicly accessible databases, as well as public content available through third-party platforms and services. In the course of providing the Service, such materials may contain personal data relating, among others, to persons who are not Libertos Users.

04What personal data do we collect?

Depending on how you use the Service, we may process the following categories of data:

4.1. Account and authentication data, such as the e-mail address, the password stored in secure (hashed) form, session data, the IP address, browser information and the data needed to recover access to the Account.

4.2. Preferences and information provided by the User, such as the language, the fields and topics of interest, the interests described in free-text fields, the countries or markets of interest, the frequency and time of the Briefings, the time zone and, where applicable, information on the professional field or professional activity.

4.3. With your permission, we record stories you view or open, active reading time and source-link clicks. Records are linked to your account and used to understand use of the reader. They do not change your interests or briefing depth. Raw events expire after 30 days through scheduled cleanup. Withdrawal stops new collection and schedules deletion of reading events linked to that consent. Cleanup runs hourly, so expiry can take up to one additional hour. It also allows website statistics to record product actions you take, such as signing in, generating a briefing or starting checkout, and their outcome together with your internal account identifier, signed-in state and plan tier; never your email address, name or reading content.

4.4. Personalization uses only preferences you state and explicit feedback. Passive reading activity and questions do not infer interests or briefing depth.

4.5. Data on the Briefings and communications, such as the content of the Briefings provided, the date and status of their generation or transmission, the recipient’s address, the technical identifier of the message and the information needed for managing communications.

4.6. Technical and security data, such as the IP address, user agent, session information, technical logs, requests made to the server and other information necessary for the operation, securing and protection of the Platform against unauthorised access, fraud or abuse.

4.7. Data originating from public or external sources. In the course of identifying, analysing, aggregating and synthesising information, Libertos may process personal data appearing in press articles, press releases, official pages, public posts, online sources and other materials used for providing the Service. Such data may also relate to persons who are not Users.

Libertos does not seek to collect, through the Account, data on the telephone number, postal address, date of birth, precise location or special categories of personal data, except where such processing becomes necessary and is carried out in accordance with the applicable legislation.

4.8. Subscription and payment data

Where a Subscription or another paid Service is contracted, Libertos may process the information needed for managing the Subscription and the payments, such as:

• the type of Subscription or Service contracted;
• the amount, currency and date of the payment;
• the payment status;
• the transaction identifier;
• the expiry date of the debit/credit card used for the payment;
• the history of Subscriptions and payments;
• billing information, where necessary;
• limited information on the payment method, as provided to Libertos by the payment processor.

Electronic payments will be processed through a specialised payment service provider. Full card details or other payment credentials entered directly into the payment processor’s infrastructure will not be stored by Libertos, to the extent that they are not transmitted to the Controller by the payment service provider.

05For what purposes and on what legal bases we process the data

Libertos processes personal data only where there is a specified purpose and an applicable legal basis. Depending on the processing operation, these may include:

• Purpose of processingCreation and administration of the Account
  Data usedThe e-mail address, the password stored in secure (hashed) form, the data and settings associated with the Account
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR, since the processing is necessary for the creation, administration and use of the Account and the provision of the Service
• Purpose of processingConfiguration and provision of the Briefings
  Data usedThe language, the topics and fields of interest, the information provided in free-text fields, the markets or countries of interest, the frequency and time of delivery, the time zone and the other preferences selected
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR, to the extent that the processing is necessary for the provision of the Service requested
• Purpose of processingPersonalisation of the Service and of the Briefings
  Data usedPersonalization uses only preferences you state and explicit feedback. Passive reading activity and questions do not infer interests or briefing depth.
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR, to the extent that personalisation is necessary for the provision of the Service requested;
  and/or
  Legitimate interest – Art. 6(1)(f) GDPR, for certain additional processing operations, where applicable
• Purpose of processingContracting and administration of a Subscription or of another paid Service
  Data usedThe type of Subscription/Service, the validity period, the status of the Subscription, the date of activation, renewal or termination and the information needed for its administration
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR
• Purpose of processingProcessing and administration of payments
  Data usedFirst name and surname or company name, as applicable; e-mail address; type of Subscription/Service; amount, currency and date of the payment; payment status; transaction identifier; payment method and the limited information on the payment instrument communicated by the payment processor
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR, for processing the payment and providing the Service contracted;
  Compliance with legal obligations – Art. 6(1)(c) GDPR, where the processing is necessary for compliance with tax, accounting or other applicable legal obligations
• Purpose of processingInvoicing and compliance with tax and accounting obligations
  Data usedIdentification and billing data, information on the Subscription/Service purchased, the amount and date of the payment, information on the transaction and the invoice
  Legal basisCompliance with a legal obligation – Art. 6(1)(c) GDPR, in order to comply with the applicable tax, accounting and archiving obligations
• Purpose of processingCancellation of the Subscription and handling of refunds
  Data usedThe e-mail address, information on the Account and the Subscription, the history and status of payments, information on the transaction and the refund and, if optionally requested, the reason for cancellation
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR, for managing the termination of the Subscription and any refund;
  Legal obligation – Art. 6(1)(c) GDPR, for compliance with tax, accounting and consumer-rights obligations;
  Legitimate interest – Art. 6(1)(f) GDPR, where applicable, for preventing fraud, handling disputes and analysing the optionally provided reasons for cancellation
• Purpose of processingPrevention of fraud and ensuring the security of the Account, the Platform and transactions
  Data usedThe IP address, session and device data, user agent, technical “logs” and, where applicable, information on transactions and payment attempts
  Legal basisLegitimate interest – Art. 6(1)(f) GDPR, consisting in protecting the Platform, the Users and transactions against fraud, unauthorised access and security incidents; and, where applicable, Compliance with legal obligations – Art. 6(1)(c) GDPR
• Purpose of processingHandling requests and complaints and defending legitimate rights and interests
  Data usedIdentification and contact data, information on the Account, the Subscription, payments, communications and any other information relevant to the request or dispute
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR; Compliance with legal obligations – Art. 6(1)(c) GDPR;
  and/or
  Legitimate interest – Art. 6(1)(f) GDPR, consisting in handling complaints and the establishment, exercise or defence of the Controller’s rights
• Purpose of processingUse of external AI Systems for providing and personalising the Service
  Data usedDeclared interests and preferences, information provided in free-text fields, subjects of interest, feedback and ratings, relevant information on the interaction with the content and information generated or inferred for the purpose of personalisation
  Legal basisPerformance of the contract – Art. 6(1)(b) GDPR, to the extent that the use of AI Systems and the transmission of information to their providers are necessary for providing the functionalities requested;
  and/or
  Legitimate interest – Art. 6(1)(f) GDPR, for certain additional operations of analysis, personalisation and improvement of the Service, where applicable. To the extent that an external provider uses the data received for its own purposes, including for developing, training or improving its models or services, such use is subject to the conditions and legal basis applicable to the processing carried out by the provider concerned. Further information is set out in Art. 6.5.;
  and/or
  Consent – Art. 6(1)(a) GDPR, in the case of operations for which Libertos specifically requests the User's agreement, including, where applicable, for the transmission or use of data through certain external AI Systems for purposes which are not necessary for providing the Service.
• Purpose of processingWebsite statistics
  Data usedOur self-hosted Plausible measures public page visits, unique visitors, sessions, downloads and outbound links without analytics cookies. It uses your IP address and browser information to derive a visitor identifier with a daily rotating salt. We exclude private routes, URL queries and fragments, and send no account ID or reading history without your reading-activity permission. It also counts product actions such as sign-in attempts, briefing requests and checkout starts, with their outcome. Rejecting or withdrawing permission for reading activity does not stop these statistics. BOSTAN ENTERPRISE S.R.L. operates this service on its servers in Romania. Automatic deletion of website statistics is not configured.
  Legal basisCookieless website statistics run independently of the optional reading-activity permission, which is separate and covers only the account-linked records described in the next row.
• Purpose of processingReading activity
  Data usedWith your permission, we record stories you view or open, active reading time and source-link clicks. Records are linked to your account and used to understand use of the reader. They do not change your interests or briefing depth. Raw events expire after 30 days through scheduled cleanup. Withdrawal stops new collection and schedules deletion of reading events linked to that consent. Cleanup runs hourly, so expiry can take up to one additional hour. It also allows website statistics to record product actions you take, such as signing in, generating a briefing or starting checkout, and their outcome together with your internal account identifier, signed-in state and plan tier; never your email address, name or reading content.
  Legal basisConsent, Article 6(1)(a) GDPR.
• Purpose of processingYour privacy choices
  Data usedWe remember acceptance and rejection for 180 days using first-party cookies. We keep a record of the choices, notice version, language and time in our database for one year. You can withdraw permission for reading activity here at any time.
  Legal basisCompliance with the obligation to demonstrate consent, Articles 6(1)(c) and 7(1) GDPR.

06Personalisation, profiling and the use of artificial intelligence

6.1. Personalisation of the Service

Libertos uses information on your interests and preferences to tailor the content and the Briefings provided through the Service.

For this purpose, account may be taken of the information you provide directly, such as the topics and fields of interest, the markets or countries selected and the information entered in free-text fields, as well as, where applicable, your feedback and the way in which you interact with the content available through the Platform.

6.2. Reading behaviour and feedback

When the relevant functionalities are active, Libertos may use information on your interaction with content, including the materials displayed or accessed, reading time, accessing sources, skipping certain materials, saving them, the ratings given and the feedback provided.

This information may be used to determine, for example, which topics are of greater or lesser interest to you and to adapt the selection of content provided subsequently.

6.3. Use of AI Systems

Libertos uses AI Systems for certain functionalities of the Service, including for analysing and synthesising information, generating the content of the Briefings and personalising them according to the User’s interests.

AI Systems may also be used for analysing relevant information on your interests and preferences and for generating or updating the interest profile.

6.4. What information may be processed through AI Systems

Depending on the functionality used, the information processed through AI Systems may include, as applicable:

• the declared interests and preferences;
• the information you have entered in free-text fields;
• information on the topics of interest and the preferred level of detail;
• the feedback and ratings given to certain materials;
• relevant information on the materials you have interacted with; and
• information previously generated or inferred for the purpose of personalising the Service.

Libertos limits the information transmitted to external providers of AI Systems to that considered necessary for providing the functionality concerned. Data such as the e-mail address, the password, the Account identifier, the IP address, session data and the Briefing delivery schedule are not transmitted to external providers of AI Systems as part of the personalisation process described above.

Further information on the providers to whom data may be disclosed is available in Article 7 below.

6.5. Use of data for developing or improving AI Systems

• a. Libertos does not use Users’ personal data for training its own artificial intelligence models, unless such processing is introduced in the future in accordance with the applicable legislation and after the necessary information has been provided to the data subjects.

b. Where external providers of AI Systems are used, Libertos establishes, depending on the legal relationship and the service used, the conditions applicable to the processing of the data transmitted to them and seeks to limit the data transmitted to those necessary for providing the functionalities concerned, as well as, where possible, to limit their retention and subsequent use, including for training, developing or improving the provider's models or services.

The relevant information on the conditions applicable to the retention and use of the data by external providers of AI Systems is set out in this Policy, including in this Article.

To the extent that an external provider uses the data received for its own purposes, including for developing, training or improving its models or services, such use is subject to the conditions and legal basis applicable to the processing concerned.

b.1. At present, for providing certain functionalities of the Service, Libertos uses external providers of AI Systems such as: Anthropic (Claude), OpenAI (GPT), Google (Gemini) and Meta (Muse).

Depending on the functionality used, the information transmitted to these providers may include the interests and preferences declared by the User, the information entered in free-text fields, the subjects of interest, feedback and ratings, relevant information on the interaction with the content, as well as information generated or inferred for the purpose of personalising the Service. The conditions regarding the retention and use of the information transmitted may differ depending on the provider and the service used.

As regards Anthropic (Claude), OpenAI (GPT) and Google (Gemini), in the case of the commercial/API services used by Libertos, the data transmitted are used primarily for providing the services requested and, in the applicable configurations, are not used by default for the training or general improvement of the providers' models, but may nevertheless be retained and processed under the conditions and for the periods provided for by the service used, including, where applicable, for security, abuse-prevention and legal-compliance purposes.

In particular, as regards the provider Meta (Muse), certain information transmitted to Meta or generated in the course of using the system may be retained and, under the conditions applicable to the service used, may be used for developing, training or improving Meta's artificial intelligence models or services. Libertos applies, where available and appropriate, the configurations or options offered by Meta for limiting the retention or use of data for such purposes.

The specific retention periods, as well as the possibility of the data being used for developing, training or improving models, may vary as a result of changes to the providers' services, configurations or terms. Libertos monitors these terms and updates this Policy where the changes are relevant to the processing of Users' data.

c. Should Libertos in the future use personal data for the purpose of training, developing or improving AI Systems in a manner different from that described in this Policy, such processing will be carried out only if there is an applicable legal basis and in compliance with the requirements on transparency, purpose limitation and the other safeguards provided for by data protection legislation.

d. The evolving nature of AI Systems. The AI Systems used by Libertos are technologies under continuous development, testing and updating. The functionalities and practices of external providers may evolve independently of Libertos, which is why Libertos cannot guarantee that they will remain unchanged, but it monitors relevant changes and adopts the measures necessary to protect Users and comply with the applicable legislation.

In particular, Meta (Muse) is a recently launched technology still under development, and certain information transmitted or generated through its use may be used by Meta for developing, training or improving its models and services.

Libertos monitors relevant changes regarding the AI Systems used and adopts reasonable measures to limit the risks associated with them, and may modify, limit, suspend or replace a particular provider or AI System where it considers this necessary.

The User understands and accepts that certain AI Systems, including Meta (Muse), are at a stage of continuous testing and development and that, despite Libertos's measures and diligence, unforeseen results, behaviours or processing operations, or deviations from the purpose for which they are used within the Service, may occur.

By continuing to use the Service, the User confirms that they have taken note of and assume the risks inherent in the experimental and evolving nature of these technologies, within the limits permitted by law. This provision does not limit the User's rights or Libertos's obligations which cannot be excluded or limited under the applicable legislation.

6.6. Limits of personalisation and profiling

The interest profile is used to adapt and personalise the content and the Briefings provided through Libertos, according to the User’s declared or inferred (on the basis of likes and dislikes) interests and preferences. The information inferred in this process represents estimates made on the basis of the available data (previous likes and dislikes) and may not fully or accurately reflect the User’s interests or preferences.

The interest profile is one of the elements used for selecting content and does not exclusively determine the information provided to the User. Libertos may also include in the Briefings information selected on the basis of relevance or editorial importance, as well as materials on topics outside the fields of interest identified for the User.

6.7. Automated decision-making

The personalisation and profiling described in this Policy influence the selection and presentation of the content provided through Libertos. At present, Libertos does not use Users’ profiles to take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you, within the meaning of Art. 22 GDPR.

Should Libertos introduce such automated decision-making processes in the future, we will provide you with the information and safeguards provided for by the applicable legislation.

07To whom we disclose the data and where they are processed. International transfers.

7.1. Own infrastructure and external providers

Libertos mainly uses its own infrastructure located in Romania, where the User database, the authentication systems, the web application and the main infrastructure of the Service are hosted.

For the provision of certain components and functionalities of the Service, Libertos uses or may use external service providers, including:

• Anthropic (Ireland) – Claude and Google (USA) – Gemini, for providing certain artificial-intelligence-based functionalities, including content analysis, generation and personalisation;
• OpenAi (USA) – ChatGPT – for providing certain artificial-intelligence-based functionalities, including content generation and personalisation;
• Meta (USA) – Muse Spark, for providing certain artificial-intelligence-based functionalities, including content analysis, generation and personalisation;
• Resend (USA), for sending the Briefings and other communications by e-mail;
• Browserbase (USA), for certain operations of searching for and identifying relevant sources;
• AI Gateway (USA) – when used for routing certain operations to providers of AI Systems;
• Libertos also uses press publications and other external sources, including, where applicable, X API and Reddit API, for identifying information relevant to the Service. Within these flows, Users’ data are not transmitted to these sources.
• Stripe – payment service provider in the case of Subscriptions or other paid Services.

7.2. The information on the relevant providers and the mechanisms applicable to international transfers will be updated in this Policy according to the services actually used by Libertos.

7.3. Only the data necessary for providing the respective services are transmitted to providers, depending on the purpose and nature of the operation.

7.4. Where personal data are transferred outside the European Economic Area (“EEA”), Libertos will ensure compliance with Chapter V of the GDPR and the use of a legal mechanism applicable to the transfer, including, as applicable, an adequacy decision within the meaning of Art. 45 GDPR or appropriate safeguards within the meaning of Art. 46 GDPR.

7.5. In the case of providers who process personal data on behalf of Libertos, the relationship with them will be subject, where applicable, to the requirements of Art. 28 GDPR and to the corresponding contractual safeguards.

7.6. As regards providers of AI Systems, Libertos will establish the conditions applicable to the retention and use of the information transmitted to them, including the conditions concerning any use of such information for training, developing or improving the provider’s models or services, as also described in Article 6 of this Policy.

7.7. You may request further information on the mechanisms applicable to international data transfers and, under the conditions provided for by the GDPR, a copy of the relevant safeguards, using the contact details set out in this Policy.

7.8. Access by advisers and corporate transactions

Libertos may disclose personal data to auditors, lawyers, consultants or other professional advisers, to the extent necessary for the provision of their services and subject to the applicable confidentiality obligations.

Likewise, in the event of a reorganisation, merger, acquisition, sale or other transaction concerning Libertos or its business, certain data may be disclosed to potential buyers, investors or their advisers, to the extent necessary for evaluating and completing the transaction and with the application of appropriate data protection measures.

08Data retention period

8.1. Libertos retains personal data only for as long as is necessary for fulfilling the purposes for which they are processed, in compliance with the applicable legal obligations.

8.2. The retention period differs according to the nature of the data and the purpose of the processing. In determining it, Libertos mainly takes into account the duration of the relationship with the User, the need for the data for providing and personalising the Service, the applicable legal obligations, as well as the need to protect the legitimate rights and interests of Libertos.

8.3. Depending on the category of data, we apply the following retention periods after the end of the contractual relationship (termination of a subscription):

• Account data and the User’s preferences are retained for as long as the Account exists and for a period of 1 year after its closure;
• Authentication and security data, including the IP address and the device or browser information associated with sessions, are retained for a period of 180 days;
• With your permission, we record stories you view or open, active reading time and source-link clicks. Records are linked to your account and used to understand use of the reader. They do not change your interests or briefing depth. Raw events expire after 30 days through scheduled cleanup. Withdrawal stops new collection and schedules deletion of reading events linked to that consent. Cleanup runs hourly, so expiry can take up to one additional hour. It also allows website statistics to record product actions you take, such as signing in, generating a briefing or starting checkout, and their outcome together with your internal account identifier, signed-in state and plan tier; never your email address, name or reading content.
• Interests, feedback, ratings and the interest profiles generated or inferred are retained, as a rule, for as long as the Account exists, to the extent that they are necessary for personalising the Service;
• Data on the sending of the Briefings and other communications by e-mail are retained for a period of 3 years;
• Operational logs of the systems used for generating the Briefings are retained for a period of 90 days;
• Data on Subscriptions, payments, invoices and other financial and accounting documents, where applicable, are retained for the period provided for by the applicable tax and accounting legislation, but for no less than 4 years.

8.4. Data processed on the basis of consent are processed until the withdrawal of consent or until the purpose for which it was given ceases to exist, without the withdrawal affecting the lawfulness of the processing carried out beforehand.

8.5. Without prejudice to the periods above, certain data may be retained for a longer period where:

• retention is required by law;
• the data are necessary in connection with a complaint, investigation or judicial or administrative proceedings; or
• retention is necessary for the establishment, exercise or defence of a right of Libertos.

Upon expiry of the applicable retention period, the data will be deleted or anonymised, except where their continued retention is required or permitted by law.

09Cookies and similar technologies

Libertos, operated by BOSTAN ENTERPRISE S.R.L., uses cookies and browser storage for sign-in and site functions. With your permission, we record reading activity linked to your account. Rejecting optional tracking will not affect your access.

Supports sign-in, security, loading recovery and remembering your choices. These items are used for the functions you request.

Sign-in cookies last for the browser session, or up to 90 days when you choose to stay signed in. Convex access tokens last 15 minutes. Google sign-in state and passkey challenges last 5 minutes. The language cookie lasts one year. Theme and cross-tab sign-in preferences use local storage without automatic expiry. Loading recovery uses tab-session storage.

Our self-hosted Plausible measures public page visits, unique visitors, sessions, downloads and outbound links without analytics cookies. It uses your IP address and browser information to derive a visitor identifier with a daily rotating salt. We exclude private routes, URL queries and fragments, and send no account ID or reading history without your reading-activity permission. It also counts product actions such as sign-in attempts, briefing requests and checkout starts, with their outcome. Rejecting or withdrawing permission for reading activity does not stop these statistics.

BOSTAN ENTERPRISE S.R.L. operates this service on its servers in Romania. Automatic deletion of website statistics is not configured.

With your permission, we record stories you view or open, active reading time and source-link clicks. Records are linked to your account and used to understand use of the reader. They do not change your interests or briefing depth. Raw events expire after 30 days through scheduled cleanup. Withdrawal stops new collection and schedules deletion of reading events linked to that consent. Cleanup runs hourly, so expiry can take up to one additional hour. It also allows website statistics to record product actions you take, such as signing in, generating a briefing or starting checkout, and their outcome together with your internal account identifier, signed-in state and plan tier; never your email address, name or reading content.

We do not use marketing tracking.

We remember acceptance and rejection for 180 days using first-party cookies. We keep a record of the choices, notice version, language and time in our database for one year. You can withdraw permission for reading activity here at any time.

10Security of personal data

10.1. Libertos applies appropriate technical and organisational measures to protect personal data throughout their collection, use and storage.

10.2. The measures adopted are aimed at reducing the risk of unauthorised access to or use of the data, as well as the risk of their loss, destruction, alteration or unauthorised disclosure.

10.3. For this purpose, Libertos implements security procedures and mechanisms adapted to the nature of the data processed and the associated risks, including measures concerning control of access to data, the security of systems and the management of security incidents.

10.4. Likewise, where personal data are transmitted to external providers who process them on behalf of Libertos, we seek to ensure that they provide sufficient guarantees regarding the security and protection of the data. Where the applicable legislation so requires, the relationship with these providers is governed by agreements which set out their obligations and responsibilities regarding the processing and protection of personal data.

10.5. Libertos adopts reasonable measures to protect the Platform, the infrastructure and systems used for providing the Service, as well as electronic communications, against cyber threats, including unauthorised access, malware and other security incidents.

However, given the continuous evolution of technology and the increasingly complex nature of cyber threats, including in the context of the development and use of artificial intelligence technologies, the complete elimination of all risks associated with the use of the Platform or of AI Systems, or with the transmission of information by electronic means, cannot be guaranteed.

11Data concerning other persons and content originating from external sources

11.1. For the provision of the Service, Libertos may identify, analyse, select, aggregate and synthesise information from publicly accessible external sources, including press publications, official sources and third-party platforms. This information may include personal data concerning persons who are not Libertos Users.

11.2. Libertos may use AI Systems and other automated means for analysing and synthesising this information and for generating the content provided through the Platform and the Briefings.

11.3. The processing is carried out for the purpose of providing the Service and, where applicable, for journalistic purposes, in compliance with the applicable legislation on data protection and on freedom of expression and information.

11.4. Persons wishing to make a request concerning data relating to them may contact us at [email protected].

12Personal data of minors

12.1. The Libertos Services are not specifically intended for minors, and Libertos does not seek to knowingly collect their personal data.

In accordance with the provisions of Article 8 GDPR, consent to the processing of personal data for the purpose of accessing the services offered by Libertos on the basis of Article 6(1)(a) GDPR may be given only by persons who are at least 16 years of age.

We do not intentionally collect or use the personal data of children below the applicable age limit.

12.2. If we find that we have collected or processed the personal data of a minor in breach of the applicable legal requirements, we will take the necessary measures to delete such data or, as applicable, to cease processing them.

12.3. If you have reason to believe that a minor has provided us with personal data in such circumstances, you may contact us at [email protected].

13Your rights

Under the conditions provided for by the GDPR and the applicable legislation, you have a number of rights in connection with the processing of your personal data.

Depending on the specific circumstances of the processing, you may exercise the following rights:

• a) The right of access – you may request confirmation as to whether Libertos is processing personal data concerning you and, where that is the case, obtain access to those data, as well as the information provided for by the GDPR;
• b) The right to rectification – you may request the correction of inaccurate data or the completion of incomplete data concerning you;
• c) The right to erasure (the “right to be forgotten”) – you may request the erasure of your personal data in the cases provided for by the GDPR, including where the data are no longer necessary for the purposes for which they were collected;
• d) The right to restriction of processing – you may request a temporary limitation of the way in which Libertos processes your data, in the situations provided for by the GDPR;
• e) The right to data portability – where the conditions provided for by the GDPR are met, you may request to receive the personal data you have provided to Libertos in a structured, commonly used and machine-readable format and, where possible, to have them transmitted to another controller;
• f) The right to object – you may object, on grounds relating to your particular situation, to processing based on the legitimate interest of Libertos, under the conditions provided for by the GDPR. Where data are processed for direct marketing purposes, you may object at any time to such processing;
• g) The right to withdraw your consent – where the processing is based on consent, you may withdraw it at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal;
• h) The rights relating to automated individual decision-making – in the situations where the provisions of Art. 22 GDPR apply, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

13.1. How you can exercise your rights

To exercise any of the rights above, you may send us a request at [email protected].

In order to protect the data and prevent their disclosure to unauthorised persons, Libertos may request additional information where this is necessary to verify the identity of the person making the request.

Libertos will respond to requests within the time limits and under the conditions provided for by the GDPR. The exercise of rights is, in principle, free of charge, subject to the situations in which the GDPR allows a reasonable fee to be charged or a manifestly unfounded or excessive request to be refused.

13.2. The right to lodge a complaint

If you consider that the processing of your personal data infringes the applicable legislation, we encourage you to contact us and to discuss with us first any issue related to the processing of your data. At the same time, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

You also have the right to bring proceedings before the competent courts, under the conditions provided for by law.

14Amendments to the Privacy Policy

14.1. Libertos may periodically update this Privacy Policy, including to reflect changes to the Service, to the way in which we process personal data or to the applicable legal requirements.

14.2. The updated version will be published on the Platform, indicating the date of the last update. In the event of significant changes, we will inform Users by appropriate means, where this is required under the applicable legislation.

15Contact

For any questions regarding this Privacy Policy or the way in which Libertos processes your personal data, as well as for exercising the rights provided for by the GDPR, you may contact us at:

BOSTAN ENTERPRISE S.R.L.

Correspondence address: București, str. Navigatorilor 2 A, sector 1, Romania

E-mail: [email protected]