Privacy Policy

This policy explains what personal data Edeso processes, why, how long we keep it, who we share it with and what rights you have. It applies to the websites edeso.app, ro.edeso.app and de.edeso.app, to the emails we send you and to the Edeso platform used by churches.

In short: when you contact us through the website, we decide what happens to your data, as the controller. When a church uses the Edeso platform for its members, the church decides, and we process the data on its behalf, as a processor.

1. Who we are and how to contact us

The data controller is Outcreate Media Group SRL (tax ID RO41089715, trade register number J2019001008331, registered office: Calea Fălticeni 97, Cumpărătura village, Bosanci commune, Suceava County, Romania), which operates the Edeso brand (“Edeso”, “we”).

If you have any question about your data or want to exercise your rights, email us at contact@edeso.app. We reply within one month at the latest.

2. When we are a controller and when a processor

Website, requests, emails and the business relationship: Edeso is the controller. Sections 3 to 11 describe this processing.
The Edeso platform used by churches: each church is the controller of its members’ data, and Edeso is the processor. Section 12 describes this situation.

3. What data we collect on the website

When you submit a form (demo request or contact message)

The data you enter: first name, last name, email, phone, church name, approximate number of members and your message.
Your choice about product emails (the checkbox in the form), together with the text shown, the date and the page, as proof of consent.
Technical data: the language and the page from which you sent the form, the browser type, and the approximate country, region and city derived from your IP address. We use the IP address to protect against abuse and store it only in an irreversible cryptographic form (hash).
How you arrived at the website: the landing page, the referring site and the campaign parameters in the link (for example utm_source, gclid, fbclid, ttclid). These are stored in your browser and sent to us only together with the form.

When you use the AI assistant on the website

Your question and the generated answer. Please do not include personal data in your questions.

When you receive emails from us

Whether you opened the email and which links you clicked, recorded through links and a tracking pixel. We use this to understand which information is useful to you and to avoid sending emails that are not read.

When you browse the website

Data about your visit, collected through cookies and similar technologies. Analytics and marketing cookies are used only with your consent (see section 9).

4. Why we use your data and on what legal basis

To respond to your request (demo, quote, questions), to contact you and to keep a record of our conversation in our CRM (status, notes, next step): to take steps at your request before a possible contract (Art. 6(1)(b) GDPR) and in our legitimate interest in managing our relationship with prospective customers (Art. 6(1)(f)).
The confirmation email after you submit the form, and the notification to our team: the same legal bases.
The introduction emails after your request (a few emails about how Edeso works, announced under the form): our legitimate interest in presenting the platform you asked about (Art. 6(1)(f)). You can object at any time through the unsubscribe link in every email or by writing to us, and you will receive no further introduction emails.
News and offers by email: only if you leave the news and offers box ticked when you send a demo request (Art. 6(1)(a)). You can unsubscribe at any time through the link in every email.
Preparing our conversation with you: an AI tool reads your message and number of members to suggest the right features, which we show you on the thank-⁠you page and which our team uses. We also use AI to check whether your first and last name were entered the wrong way round, so that we address you correctly; our team can undo the correction at any time. Legal basis: our legitimate interest in giving you a relevant response. We do not make automated decisions that have legal or similarly significant effects on you.
Website usage statistics (Google Analytics 4): only with your consent to analytics cookies.
Measuring and improving our ads on Google, Facebook, Instagram and TikTok: only with your consent to marketing cookies (details in section 5).
Protecting the website and forms against spam and abuse (a hidden anti-⁠bot field, a submission limit and a log of rejected submissions, which keeps what you typed so we can still answer you): our legitimate interest in keeping the service secure.
Legal obligations, for example invoicing and bookkeeping, if you become a customer (Art. 6(1)(c)).

5. Ad measurement (Meta, TikTok, Google)

Only if you have accepted marketing cookies:

the Meta (Facebook and Instagram) and TikTok pixels and the Google Ads tag load in your browser;
when you submit a form, we report the conversion to these platforms, directly from your browser and from our server (Meta Conversions API, TikTok Events API), so that we know which ads work;
to match the conversion, we send your email, phone, name, city, region and country only in irreversibly hashed form (SHA-256), together with your IP address, browser, click identifiers and the platform’s cookies;
later, if your request moves forward (for example we schedule a demo or you become a customer), we may send the same platforms an event about this step, also hashed, but only if the original request was submitted with marketing consent.

Without marketing consent, we send nothing to these platforms. The platforms also process the data under their own policies; in certain situations Meta and Google may act as joint controllers.

We do not sell personal data. We share it only with providers that help us operate, under a contract and subject to confidentiality and security obligations:

Supabase: our CRM database, hosted in the European Union (Frankfurt, Germany).
Cloudflare: website hosting, content delivery network and protection against attacks.
ToSend: sending our emails.
OpenRouter and the AI model providers it uses (for example Google): the website assistant, the suggestions on the thank-⁠you page and the name check. We send them only the data each task requires.
Google (Analytics, Ads), Meta Platforms Ireland and TikTok Technology Limited: only with your consent, as described in sections 5 and 9.
Providers that develop and maintain our website and systems, who may have access to data strictly for these services.
Public authorities, only when the law requires us to.

7. Transfers outside the European Economic Area

Some providers (for example OpenRouter, Cloudflare, Google, Meta, TikTok) may process data outside the EEA, including in the United States. In these cases we rely on the European Commission’s adequacy decision (EU-⁠U.S. Data Privacy Framework) for certified providers, or on the standard contractual clauses approved by the Commission, together with supplementary measures where needed.

8. How long we keep data

Requests and contact data in our CRM: for as long as we are in conversation with you and up to 3 years after the last interaction; after that we delete or anonymize them. If you become a customer, we keep the data for the duration of the contract.
Product emails: until you withdraw your consent. After you unsubscribe, we keep your address on a suppression list so that we do not write to you again, and we keep the proof of consent for as long as we may need to show it.
The log of submissions rejected as spam and the questions asked to the AI assistant: up to 12 months.
Accounting records: for as long as the law requires (in Romania, usually 10 years).
Cookies: the duration of each cookie is listed in section 9.

9. Cookies and similar technologies

On your first visit we ask for your consent. Analytics and marketing cookies are not loaded until you accept them, and you can change your choice at any time under “Cookie settings” in the footer of every page. We use Google Consent Mode so that Google services respect your choice.

Necessary (always active): edeso_consent stores your cookie choice (6 months); edeso_lang stores your chosen language (12 months); Cloudflare may set technical security cookies (for example __cf_bm, 30 minutes).
Analytics (only with consent): Google Analytics 4, _ga and _ga_* (up to 2 years).
Marketing (only with consent): Meta Pixel, _fbp and _fbc (up to 90 days); TikTok Pixel, _ttp (up to 13 months); Google Ads, _gcl_au (up to 90 days).
Browser storage: edeso_ft and edeso_lt (localStorage) store the landing page and campaign parameters, which are sent only together with a form; edeso_thanks (sessionStorage) holds the data shown on the thank-⁠you page and is cleared when you close the tab; edeso_cfg (sessionStorage) keeps the website’s measurement settings for a few minutes.

10. Your rights

You have the right:

to find out what data we hold about you and to receive a copy (access);
to have it corrected (rectification) or to request its erasure;
to request restriction of processing;
to receive your data in a structured format and to transmit it to another controller (portability);
to object to processing based on legitimate interest and, at any time, to direct marketing;
to withdraw your consent at any time, without affecting processing carried out before the withdrawal;
to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro) or with the data protection authority of the country where you live.

To exercise your rights, email us at contact@edeso.app. We may ask for additional information to confirm that the request comes from you.

11. Security and minors

We protect data through encryption in transit, role-⁠based access and authentication, activity logs and providers with recognized security standards. No system is completely secure; if a personal data breach affecting you occurs, we will notify you as required by law.

The website is not intended for children under 16, and we do not knowingly collect data about them.

12. The Edeso platform used by churches

When a church uses Edeso (the admin panel and the church app), the church is the controller of its members’ data and decides what data it collects, for what purpose and on what legal basis, and Edeso is the processor and processes the data only on the church’s documented instructions, under a data processing agreement (Art. 28 GDPR).

Data processed, depending on how the church sets up Edeso: contact details (name, email, phone, address), account activity (logins, attendance, session logs), membership (status, roles, groups, family relationships), donations and event-⁠related data, as well as religious and community data, such as the date of baptism or other fields defined by the church.
Sensitive data: some data may reveal religious beliefs (special categories of data, Art. 9 GDPR). The church must have a valid legal basis for this data, for example explicit consent; Edeso processes it only on the church’s instructions and with appropriate safeguards.
Purpose: providing the service to the church (accounts and access, member records, attendance, events, groups, donations, reports). We do not use this data for advertising, for our own profiling or for resale.
Retention: for as long as the church has an active subscription; after the contract ends, the data is deleted or anonymized within 3 months at the latest, unless the law requires it to be kept. Backups are deleted according to their retention cycle.
Sub-processors: hosting and database (Google Firebase, in data centres in the European Union), email and IT support providers, bound by equivalent contractual obligations; the current list is available on request.
Children: the church obtains consent from parents or guardians where required; Edeso does not allow children to create accounts without their parents’ or guardians’ involvement.
Members’ rights: members exercise them primarily with the church; Edeso helps the church respond to requests.

13. Changes to this policy

We may update this policy when we change how we process data. The current version is always available on this page, with the date of the last update. If the changes are significant, we will also let you know by email, if we have your address.