Inimo Privacy Policy

Version 1.0. Last updated: 19.10.2026

Who we are. The controller of your data is AET JEWELRY VENTURES S.R.L., registered office Șos. Alexandriei nr. 98-100A, parter, bl. 1, sc. 1, ap. 2, Bragadiru, jud. Ilfov, România, Romania, Tax ID RO48390650, Trade Register No. J23/4126/2023 ("we"). Contact us anytime at hello@getinimo.com.

In short

• We use your data to run Inimo: your account, listings, messages, appointments, organisation pages and adoption contracts.
• We do not sell data. We do not run targeted advertising. We make no automated decisions about you.
• Google Analytics starts only if you click "Accept". Without your consent we use only what is strictly necessary.
• Our database is stored in the European Union.
• You can download or delete your data at any time.

What data we use, why, and for how long

1. Your account

• What: email address, display name, account type (user, association, breeder, kennel, veterinary clinic, pet shop), language, country, city, date created. Optional: phone number, which we verify with a code. If you sign in with Google or Facebook, we receive from them only an account identifier, your email address and your name.
• Why: to create your account, let you sign in and use Inimo.
• Legal basis: our contract with you, i.e. these terms (Art. 6(1)(b) GDPR).
• How long: for as long as you have an account. After you delete your account, we delete the data within 30 days. We delete accounts unused for 24 months, after notifying you by email.
• Your phone number is not public unless you choose to show it.

2. Sign-in and security

• What: a session cookie, verification codes sent by email or SMS (we keep only a cryptographic fingerprint of the code, not the code itself), IP address, date and time of access, technical browser data, number of attempts.
• Why: to keep you signed in, protect your account and stop spam, fraud and attacks.
• Legal basis: the contract (Art. 6(1)(b) GDPR) and our legitimate interest in keeping Inimo secure (Art. 6(1)(f) GDPR).
• How long: the session until you sign out or at most 60 de zile / 60 days. Codes expire within minutes and are deleted within 24 hours. Technical logs containing IP addresses are kept for up to 90 days.

3. Listings and photos

• What: everything you write in a listing (species, name, sex, age, breed, description, health, microchip, city, country, how far you are willing to travel, price for sales), the photos and the listing status. Data about the animal is not personal data, but the listing is linked to your account.
• Why: to publish your listing and show it to interested people.
• Legal basis: the contract (Art. 6(1)(b) GDPR).
• Public: listings are public and may appear in search engines. Next to the listing we show your display name and city. We do not show your email.
• Photos: we automatically remove location metadata (GPS) from photos. Do not include people's faces, number plates or addresses in photos.
• How long: while the listing is active. Closed listings (adopted, sold, withdrawn) are deleted after 12 months, or earlier if you delete them.

4. Lost or found animals

• What: the listing, the approximate area and photos.
• Our advice: give the area, not the exact address. Contact details stay in in-app messages.
• Legal basis and retention: as in section 3.

5. Messages

• What: message text, date and time, whether the message was read, and the listing it refers to.
• Why: so you can talk to other users.
• Legal basis: the contract (Art. 6(1)(b) GDPR).
• Who sees them: only you and the person you are talking to. The Inimo team sees them only when a message is reported to us, in cases of fraud, abuse or security, or when the law requires us to. Automated anti-spam filters use only technical data, for example the number of messages sent.
• How long: for as long as you have an account. When you delete your account, we delete your messages within 30 days. Reported messages are kept as long as needed for moderation (section 11).

6. Favourites and follows

• What: saved listings and organisations you follow.
• Why: so you can find them easily and get updates from organisations you follow.
• Legal basis: the contract (Art. 6(1)(b) GDPR).
• The organisation sees the number of followers, not who they are.
• How long: until you remove them or delete your account.

7. Appointments, bookings and reminders

• What: name, contact details, date and time, the service or visit, your notes and the booking status.
• Why: to make the appointment, pass it to the organisation or provider and send you reminders.
• Legal basis: the contract (Art. 6(1)(b) GDPR).
• Who receives them: the organisation or provider you book with. For the data it receives, it becomes a separate controller and is responsible for it.
• How long: 12 months from the appointment date.

8. Services and transport runs

• What: the information you publish about a service (description, area, countries, price, authorisations, whether you are a trader or a private individual) and scheduled runs (route, dates, available places).
• Legal basis: the contract (Art. 6(1)(b) GDPR).
• Public: yes. How long: while the service is published, then 12 months.

9. Organisation pages

• What: name, type, description, city, address, phone, website, registration number and authorisations, verification date, photo gallery, video links, team (name and role), visiting hours, volunteer requests, needs list and cases.
• Legal basis: the contract with the organisation (Art. 6(1)(b) GDPR). For team members: the legitimate interest of the organisation and of Inimo in showing who works there (Art. 6(1)(f) GDPR). The organisation must inform its team members. Any team member can ask us directly to remove their name.
• Volunteer applications and messages sent to an organisation reach that organisation, which becomes a separate controller for them.
• Videos: the page shows only a preview image. The YouTube or other video is loaded only after you click on it. From that moment the video platform receives your IP address and may set its own cookies, under its own policy.
• Needs lists may link to external shops. When you click, you go to the shop's website and its policy applies.
• How long: while the page exists. After it is closed, we delete it within 30 days.

10. Electronically signed adoption contract

• What: the details entered in the contract by the two signatories (name, address, phone, email, identity document details if the template asks for them), the animal's details and photo, the drawn signature, the date and time of signing, the IP address, technical browser data and a cryptographic fingerprint of the signed text. We do not ask for national ID numbers (such as the Romanian CNP). Do not write them in the contract.
• Why: to generate the contract, give both signatories a copy and make it possible to prove what was signed and when.
• Legal basis: the contract with you for the signing tool (Art. 6(1)(b) GDPR) and the legitimate interest of the signatories and of Inimo in being able to prove the signature (Art. 6(1)(f) GDPR).
• Who sees it: only the two signatories. Each of them is responsible for their own copy.
• How long: 5 years from signing, to cover the periods in which a claim may be made under the contract. Then we delete it.

11. Reports and moderation

• What: the reported content, the reason, the reporter's name and email, the decision, the statement of reasons and any appeal.
• Why: to run the reporting, statement-of-reasons and appeal procedure.
• Legal basis: our legal obligation under Regulation (EU) 2022/2065, the Digital Services Act (Art. 6(1)(c) GDPR) and our legitimate interest in keeping the platform safe (Art. 6(1)(f) GDPR).
• We do not tell the reported person who reported them, unless the law requires us to.
• How long: 12 months from the decision. If we close an account for a serious breach, we keep a fingerprint of the email address for 2 years so that the same email cannot be used to return.

12. Support

• What: tickets, messages exchanged with the team and attached files.
• Legal basis: the contract and our legitimate interest in answering and defending ourselves against complaints (Art. 6(1)(b) and (f) GDPR).
• How long: 24 months after the ticket is closed.

13. Payments

• Payments are not active. The "Payment history" section is empty. Before payments start, we will update this policy and name the payment processor.

14. Emails

• We send you emails strictly related to your account: sign-in codes, new messages, reminders, moderation decisions, changes to the terms. Legal basis: the contract (Art. 6(1)(b) GDPR). Some notifications can be turned off in your settings.
• We do not send newsletters or offers without your separate consent. If we start a newsletter, you will be able to ask for it with a separate checkbox and unsubscribe with one click.

15. Cookies and Google Analytics

Strictly necessary (no consent needed, Art. 4(5) of Romanian Law 506/2004 implementing the ePrivacy Directive):

• the session cookie inimo_s, which keeps you signed in;
• your choice in the cookie banner, stored so that we do not ask you on every page;
• Cloudflare security cookies (for example `__cf_bm` or Turnstile), which stop bots and attacks.

Only with your consent:

• Google Analytics 4 (cookies `_ga` and `_ga_ID`). It shows us which pages are used and where people get stuck. The data is pseudonymous: a random identifier, pages visited, device type, browser and approximate location (city or country). Google states that Analytics 4 does not store the IP addresses of users in the EU. We have set data retention to 2 months and the cookies expire after at most 13 months.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Law 506/2004).
• Google Analytics does not load at all until you click "Accept". If you click "Refuse", it does not load. You can change your choice at any time using the "Cookie settings" link in the page footer.

We do not use advertising cookies, social media pixels or remarketing.

Who we share data with

We never sell or rent data. Processors act only on our instructions, under a written contract (Art. 28 GDPR). We share data only with:

• other users, to the extent you choose: public listings and pages, messages to the recipient, bookings to the organisation or provider, the contract to the other signatory;
• Cloudflare, Inc. (processor): app hosting, database (configured to store data in the EU), photo storage, protection against attacks;
• Brevo (Sendinblue SAS, Franța) (processor): sending emails;
• — (nu folosim SMS deocamdată / no SMS for now) (processor): sending verification codes by SMS, if you verify your phone;
• Google Ireland Ltd. and Google LLC (processors): Google Analytics, only with your consent;
• separate controllers, only when you use their service: Google or Meta if you sign in with their account; YouTube or another video platform after you click a video; external shops in needs lists; organisations and providers you contact;
• public authorities, only where the law requires it.

Transfers outside the EU

Cloudflare and Google are US companies and may access data from outside the European Economic Area. Such transfers rely on the EU-U.S. Data Privacy Framework, under which both are certified, and on the European Commission's Standard Contractual Clauses. We require the same safeguards from any other provider outside the EU.

Minimum age

Inimo is for people aged 16 or older. Listings, services, bookings and adoption contracts are only for people aged 18 or older. If we learn that an account belongs to someone under 16, we delete it.

Automated decisions

We make no automated decisions that produce legal effects for you and we do not profile you. Anti-spam filters may temporarily block sending messages. In that case a person reviews it on request.

Security

The database is in the EU. Sessions and codes are stored only as cryptographic fingerprints. Connections are encrypted. Team access is limited to those who need it and protected by two-factor authentication. If a personal data breach occurs that may affect you, we notify the authority within 72 hours and notify you too where the law requires it.

Your rights

• You may ask to access, correct or delete your data, restrict its processing, receive a copy in an easy-to-use format (portability), and object to processing based on legitimate interest.
• You can withdraw your consent at any time (for example for Google Analytics, in "Cookie settings"). Withdrawing consent does not affect anything done lawfully before.
• You can change or delete most data directly in your account. For the rest, write to hello@getinimo.com. We reply within one month.
• If you believe we have breached your rights, you can lodge a complaint with the Romanian data protection authority (ANSPDCP, www.dataprotection.ro) or with the data protection authority in your own country.

Change of controller

Inimo may be taken over by a company set up specifically for the project. If that happens, we will email you before the transfer, tell you who the new controller is, and you can close your account if you disagree.

Changes

If we change anything important in this policy, we will tell you by email or in the app before the change takes effect.

Contact: hello@getinimo.com

← Tillbaka till Inimo