Privacy Policy

1. General

This Privacy Policy explains how the Karmn brand ("we", "us"), operated by AX Creativ S.R.L., processes personal data when you use karmn.services (landing), demo.karmn.services (demo), and app.karmn.services (application), as well as related communications.

This Policy is prepared in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law. Infrastructure is hosted primarily in the EU; where certain providers are used, transfers outside the EEA may occur under the conditions below.

2. Controller and processing roles

The data controller is:

• Legal entity: AX Creativ S.R.L.
• CUI: 49475584
• VAT: RO49554432
• Registered office: Jud. Iași, Mun. Iași, Șos. Nicolina, nr. 189, bir. 2, Et. 2, Romania
• Administrator: Begu Alexei
• Email for personal data matters: support@karmn.services

We act as controller for landing visitors, leads, demo/app user accounts (e.g. name, email, phone, billing data), and technical service data.

When a customer (auto shop or other organisation) uploads personal data of its end customers, staff, or others into Karmn to receive the service, that customer is the controller of such data and AX Creativ S.R.L. is the processor (persoană împuternicită), processing only on the customer's instructions under the Terms of Use and any applicable DPA.

No separate Data Protection Officer (DPO) has been appointed. Contact support@karmn.services for all requests.

3. Data we collect

Depending on the service, we may process:

• Landing (karmn.services): name and phone or email from request forms; technical visit data (IP, browser, language, time, pages); cookies — see the Cookies section.
• Demo (demo.karmn.services): data needed to access the demo environment (including session identifiers); in-product actions as needed for demo operation.
• App (app.karmn.services): registration and profile data (name, email, phone, organisation); subscription and payment data (as needed for billing via payment providers when connected); data you or your organisation enter into the CRM (orders, shop customers, inventory, etc.) — as processor where this is third-party personal data; access and security logs.

4. Purposes and legal basis

We process personal data for the following purposes (Article 6 GDPR):

• Processing landing requests and contacting you — consent and/or steps prior to a contract (Art. 6(1)(a) and (b) GDPR).
• Registration, providing the demo and app, performing the contract — Art. 6(1)(b) GDPR.
• Service operation and security — legitimate interest (Art. 6(1)(f) GDPR): abuse prevention, stability and security.
• Saving language and currency on the landing — consent ("locale" / "currency" cookies, Art. 6(1)(a) GDPR).
• Analytics and advertising on the landing — consent (Google Analytics and Meta Pixel only after cookie acceptance; Art. 6(1)(a) GDPR).
• Processing end-customer data in the app — on the customer-controller's instructions (Art. 28 GDPR) under the customer contract.
• Legal obligations — Art. 6(1)(c) GDPR.

5. Cookies

On karmn.services we use essential and functional cookies. Google Analytics and Meta Pixel load only after you choose "Accept". "Essential only" does not load these services.

Landing cookies:

• locale — site language (RU / EN / RO); up to 1 year; functional.
• currency — pricing currency (EUR / MDL / RON); up to 1 year; functional.
• cookie_consent — cookie choice; up to 1 year; essential.
• laravel_session — session and form security; until browser close / session expiry; essential.
• XSRF-TOKEN — CSRF protection; until browser close; essential.
• _ga, _ga_* — Google Analytics; up to 2 years; analytics (after consent).
• _fbp, _fbc — Meta Pixel; up to 3 months / up to 90 days; marketing/analytics (after consent).

On demo.karmn.services and app.karmn.services, essential cookies/session storage may be used for login and security. Product cookie details may be refined in the service UI. Disabling essential cookies may limit forms and services. To opt out of GA/Meta on the landing: decline cookies in the banner or https://tools.google.com/dlpage/gaoptout

6. Retention

Landing form data — up to 24 months from last contact or until consent is withdrawn, whichever is earlier, unless law requires longer.

App account data — while the account is active and for as long as needed after closure for contract performance, billing, and legal obligations (typically limitation / tax periods).

Data processed as processor on the customer's behalf — for the period set by the customer or contract, then deleted or returned when processing ends, unless law requires otherwise.

Server technical logs — usually up to 90 days, unless needed longer for security or incident investigation.

Cookies — as in Section 5.

7. Third parties

We do not sell personal data. Access may be granted to:

• Hostinger International Ltd. and other hosting/infrastructure providers (EU).
• Google LLC (Google Analytics on the landing) — after cookie consent.
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (Meta Pixel) — after cookie consent.
• Payment and communication providers (email, WhatsApp / Viber and similar) — for billing and contact.
• Sub-processors engaged for product support and development — under Art. 28 GDPR agreements only.
• Public authorities — only where legally required.

We enter into DPAs with processors under Article 28 GDPR.

8. Cross-border transfers

Core service data is processed in the EU. Where Google Analytics, Meta Pixel, or other providers outside the EEA are used, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework, where applicable) and/or the European Commission's Standard Contractual Clauses (SCCs) plus providers' additional safeguards.

9. Your rights

Under the GDPR (Articles 12–22) you have rights to information, access, rectification, erasure, restriction, objection, portability (where applicable), withdrawal of consent, and to lodge a complaint with ANSPDCP (www.dataprotection.ro) or your EU supervisory authority.

For data we control as controller: support@karmn.services. We generally respond within 30 days.

If you are an end customer of an auto shop whose data was entered into Karmn by that shop as controller, contact that shop first; we will assist the customer as processor within the contract.

10. Security

We apply organisational and technical measures: HTTPS, access controls, backups, and monitoring. No internet transmission is fully secure; we aim for industry standards proportionate to the risks.

11. Children

Karmn services are intended for business users. We do not knowingly collect data from persons under 16. If a child has provided data, contact us to delete it.

12. Policy changes

We may update this Policy. The current version is available on the site with the update date. Material changes will be communicated prominently (site and/or in-product notice).

13. Contact

Controller: AX Creativ S.R.L., Jud. Iași, Mun. Iași, Șos. Nicolina, nr. 189, bir. 2, Et. 2, Romania.

Personal data: support@karmn.services.

Supervisory authority (Romania, ANSPDCP): www.dataprotection.ro.