Privacy policy — Bogdan Andronic

1 · Who is responsible

ANDRONIC ANDREI-BOGDAN PERSOANA FIZICA AUTORIZATA — an authorised natural person (Persoană Fizică Autorizată) registered in Romania — is the data controller for personal data processed through this website.

CUI: 39021084 · Reg. Com.: F22/370/2018 · EU VAT: RO39124586
Str. Vânătorilor 16, Vorovești, Comuna Miroslava, jud. Iași, 707319, România
privacy@iambogdan.com

That address is the one to use for anything in section 9 — access, correction, deletion, objection. You can also use the contact form, which reaches the same person.

2 · What this site collects

There is no tracking on the pages themselves beyond what section 8 describes. Everything else here is data you deliberately typed in.

If you use the AI agent

The agent asks for a name and an email address before it will talk to you, and it will not start a conversation without them. After that, it stores:

Every message you send, word for word. The full transcript is kept, including anything you paste into it. Nothing strips personal details out of what you type — if you put a phone number or a client's name in the chat, that is what gets stored.
A summary of your project — the type of work, technologies, timeline, budget band and urgency — built from what you tell it. You can see and edit this in the panel beside the conversation.
The agent's own notes about the conversation, including a short written reason when it hands you over to Bogdan or closes the conversation, and a rough assessment of whether the work looks like a fit. These are written by the model, kept as written, and never revised. You are entitled to see them; section 9 says how.
A satisfaction rating, if you give one.

If you use the contact form

Your name, email address, the shape of enquiry you picked, and your message. All four are saved to the database before the notification email is sent, deliberately — it is what allows the site to tell you honestly when a message was recorded but the alert failed, rather than claiming success either way.

If you agree to session recording

A replay of your visit is recorded — where you moved, scrolled and clicked — so I can see where a page fails people. It is off unless you switch it on, and three things are true about it:

Everything you type is masked. Form fields are replaced with blocks at the moment of capture, in your browser, so the characters never leave your machine.
The AI conversation is never recorded at all. The whole agent — wherever it opens, on any page — is excluded from recording, and opening it stops any recording already in progress. The contact page is excluded outright.
Nothing from your browser's console is captured, and neither are the contents of network requests.

Technical data

Your IP address is stored when you use the agent or the contact form. It is how the rate limiter tells one visitor from another and stops the same address flooding the form. IPv6 addresses are shortened to a network prefix; IPv4 addresses are kept in full. The hosting provider also records IP addresses in its own server logs, under its own retention, which this site does not control.

No analytics ran on this site at all before 7 September 2026. There is still no tag manager, no advertising pixel, no fingerprinting, and no third-party fonts or CDN — every asset is served from this domain.

3 · Why, and on what legal basis

Answering you and doing business. Everything you send through the agent or the form is processed to respond to your enquiry and, if it goes anywhere, to carry out work. Legal basis: steps taken at your request prior to a contract, and legitimate interest in running a consulting practice.
Keeping the site up and unabused. IP-based rate limiting. Legal basis: legitimate interest in not having the form and the agent used as a spam relay or a way to burn Bogdan's model budget.
Improving the agent. Conversations are reviewed, and may be scored by a second model, to find where the agent answered badly. Legal basis: legitimate interest. If you would rather your conversation were not used this way, say so and it will be excluded.
Analytics. Consent, and only consent — see section 8. Nothing analytics-related happens until you say yes, and you can change your mind at any time.

4 · How long it is kept

Personal data is kept for as long as it serves the purpose it was collected for, and the criteria are these:

Enquiries and conversations — while a working relationship is possible or ongoing, and afterwards for as long as Romanian accounting and limitation law requires records relating to work performed to be kept.
Technical data — IP addresses recorded for rate limiting are kept as part of the abuse-prevention record for the site.
Analytics — 12 months, and only for visitors who switched it on.
Session recordings — 30 days, and only for visitors who switched them on. This one really does expire on its own: PostHog deletes recordings at the end of that window.

Deletion is currently carried out on request rather than on an automatic schedule. If you ask for your data to be removed, it is removed — but nothing expires by itself today, so data you sent stays until you ask or until it is cleared by hand. Scheduled deletion is something I intend to add; this section will say so plainly when it exists, and the date at the top will move.

5 · Cookies and similar storage

Two things may be stored in your browser, and they are not the same kind of thing.

A session cookie for the agent — set only after you deliberately submit the agent's form, so the conversation survives a page reload. It contains two random identifiers and nothing about you, cannot be read by JavaScript, and expires after seven days. This is strictly necessary for a feature you asked for, so it does not require consent and there is no way to refuse it other than not using the agent.
Analytics and session-recording storage — set only for the categories you switch on, and they are two separate choices. Section 8 covers both, including how to change your mind.

Nothing else is stored on your device. There are no advertising cookies, because there is no advertising.

6 · Who else sees your data

These are the services involved in running the site. None of them is sold your data, because none of it is sold to anyone, ever.

Service	What it does	What reaches it
Neon	The database	Everything in section 2 that is stored
Railway	Hosting	All traffic; IP addresses in server logs
OpenAI	The model behind the agent	Your messages, word for word, and the project summary — sent on every turn so the agent can reply
MailerSend	Notification email	Your name, email address and message, so Bogdan is told you wrote
PostHog	Analytics and session recording, EU region	Only what you switched on — see section 8. Never the AI conversation, and never what you type.

What you type reaches OpenAI. That is unavoidable in an AI agent and it is stated rather than buried: if you would not paste something into a third-party model, do not paste it into the chat. The agent never needs client names, credentials or anything confidential to be useful, and it is instructed not to ask for them.

7 · Where your data goes

The database is hosted in the United States. Storing your data therefore involves a transfer outside the European Economic Area, made on the basis of the provider's standard contractual clauses. Analytics, if you consent to it, is hosted in the European Union instead.

8 · Analytics and session recording, and the consent you gave

This site uses PostHog, hosted in the European Union. There are two separate choices, and neither is on unless you switch it on:

Analytics — page views and a couple of named actions, to find out which pages are worth keeping. Kept for 12 months.
Session recording — a replay of how you moved through a page. Kept for 30 days. Section 2 lists what it never captures.

They are asked separately on purpose. Counting page views and recording somebody using the site are different intrusions, and one button covering both would not be a real choice.

Nothing is stored and nothing is sent before you answer. Until you choose, the analytics library writes no cookies, no local storage, sends no events, and does not even download the recorder. If you decline, every event is discarded before it is sent — not anonymised, discarded. Automatic click tracking, heatmaps and error capture are all off as well, and there is no pre-ticked box anywhere.

Declining analytics also ends any recording, because a recording with nothing to send it to is not a thing you agreed to.

To change your mind, use the button below. It reopens the panel with your current choices shown, works in both directions, and takes effect immediately.

If that button does nothing, JavaScript is disabled — in which case no analytics ran in the first place, and there is nothing to change.

9 · Your rights

Under the GDPR you can ask for a copy of everything held about you, ask for it to be corrected, ask for it to be deleted, object to processing based on legitimate interest, or ask for it in a portable format. You can also complain to a supervisory authority — in Romania that is the ANSPDCP, and you may instead complain in the EU country where you live.

Write to privacy@iambogdan.com or use the contact form. There is no charge and no form to fill in; describe what you want and it gets done.

One practical note, because it is fair to say it. Deleting a person from this system is currently a manual job across several stores. That does not change your right or the answer — it means a request may take a few days rather than being instant, and you will be told when it is done.

10 · Children

This is a business-to-business consulting site and is not directed at children. No data is knowingly collected from anyone under 16.

11 · Changes

When what happens to your data changes, this page changes and the date at the top moves with it. The date tracks meaning, not typos.