Legal
Privacy Policy
Last updated: October 29, 2026
This Privacy Policy explains how we handle personal data when you visit our website, create an account or use the NotificationStream Service, and what rights you have. It also explains our role when we process data about the end users of our customers' applications. It is provided under Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR").
1. Who we are
The controller of your personal data is RCHITECTED QUBILA SRL, trading as NotificationStream, a limited liability company registered in Romania with the Trade Register under no. J12/4516/2022, sole registration code (CUI) 46532650, VAT no. RO46532650, with its registered office in Cluj-Napoca, Cluj County, Romania ("we", "us"). You can reach us about anything related to your personal data at support@notificationstream.com. We are not required to appoint a data protection officer and have not done so.
2. Our two roles
- Controller for data about our customers, their team members and visitors to our website. This policy covers that data.
- Processor for data about our customers' end users ("End User Data"), such as user ids, names, email addresses, locales, custom attributes, tags and notification read, seen, archived and clicked state. We process End User Data only on our customers' instructions, under the Data Processing Agreement. If you are an end user of an app that uses NotificationStream, that app's operator is responsible for your data: please contact them to exercise your rights. We will help them respond.
3. Data we collect
- Account data: your name, email address and password (stored only as a salted hash). If you log in with GitHub or Google, we receive your name, email address, profile picture and account identifier from that provider.
- Organization data: organization names, memberships and roles, and the email addresses of people you invite.
- Billing data: your plan, subscription status, billing interval, trial dates, purchased request packs, and Stripe customer and subscription identifiers. Stripe (through its Link merchant of record service) collects your payment details and billing address directly; we never see your full card details.
- Usage data: the number of API requests your organization makes, and the projects, API keys and settings you create.
- Technical data: the IP address and browser user agent of your dashboard sessions, and request logs kept by our hosting provider, which include IP addresses.
- Communications: the messages you send us, for example support requests.
We collect this data from you, from the members of your organization (for invitations), from GitHub or Google (if you use them to log in) and from Stripe (billing status). We do not use advertising or analytics trackers on our website or dashboard. Providing account data is necessary to create an account; without it we cannot provide the Service.
4. Why we use it and our legal bases
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Creating and running your account, organization and the Service | Performance of a contract (b) |
| Service emails, such as password resets, email verification and notices about changes to the Service or these policies | Performance of a contract (b) |
| Sending organization invitations to people who do not have an account yet | Legitimate interests (f): letting our customers add their team |
| Billing, plan limits, accounting and tax | Performance of a contract (b); legal obligation (c) |
| Answering support requests | Performance of a contract (b); legitimate interests (f) |
| Security, preventing fraud and abuse, and debugging | Legitimate interests (f): keeping the Service and our customers safe |
| Complying with the law and establishing or defending legal claims | Legal obligation (c); legitimate interests (f) |
We do not send marketing emails. We do not sell personal data, and we do not make decisions about you based solely on automated processing.
5. Who we share it with
| Recipient | Role and purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Processor: hosting, database, email delivery, request logs, network and DDoS protection, and the Turnstile bot check on the log in, registration and password reset forms | United States; Cloudflare's global network |
| Stripe acquiring affiliates, such as Stripe Payments Company and Stripe Technology Europe, Limited | Independent controller: Stripe (through its Link merchant of record service) is our reseller and merchant of record, which processes payments, taxes, invoices, fraud prevention and refunds. See Stripe's privacy policy. | Ireland; United States |
| GitHub, Inc. and Google LLC | Independent controllers, only if you choose to log in with them | United States |
Members of your organization can see your name, email address and role. We may also disclose personal data to our professional advisers (such as accountants and lawyers), to authorities when the law requires it, and to a successor if our business is sold or merged.
6. International transfers
Some recipients process data outside the European Economic Area. Transfers to the United States rely on the EU-U.S. Data Privacy Framework, under which Cloudflare, GitHub and Google are certified, and on the Standard Contractual Clauses adopted by the European Commission. You can ask us for more information about these safeguards.
7. How long we keep it
- Account and organization data: while your account exists. When you ask us to close your account, we delete it within 30 days, except data we must keep by law.
- Session data (IP address and user agent): until you log out or the session expires, which happens 7 days after it was last used.
- Request logs: up to 7 days.
- Invitations: until they are accepted, cancelled or expire.
- Billing and accounting records: for as long as Romanian accounting and tax law requires, usually 5 years after the end of the financial year.
- Support correspondence: up to 3 years after the request is resolved.
End User Data is kept as described in the Data Processing Agreement.
8. Security
Data is encrypted in transit with TLS and at rest by our hosting provider. Passwords and secret API keys are stored only as hashes. Access to production systems is limited to the people who need it. No system is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires.
9. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive data you gave us in a structured, machine-readable format and have it transmitted to another controller (portability);
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation; and
- withdraw any consent you gave, without affecting earlier processing.
To exercise these rights, email support@notificationstream.com. We will answer within one month. We may extend this by two further months for complex or numerous requests, in which case we will tell you why. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro.
10. Cookies
We only use cookies and similar storage that are strictly necessary or that remember a choice you made. See our Cookie Policy.
11. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal data as a controller.
12. Changes
We may update this policy. We will post the new version on this page with a new date and notify account holders of material changes by email or in the dashboard.
13. Contact
RCHITECTED QUBILA SRL, trading as NotificationStream, a limited liability company registered in Romania with the Trade Register under no. J12/4516/2022, sole registration code (CUI) 46532650, VAT no. RO46532650, with its registered office in Cluj-Napoca, Cluj County, Romania. Privacy contact: support@notificationstream.com.