Privacy notice
Last updated 22 September 2026
You send us a message about your codebase. This is what happens to it, who sees it, and how to get it back or deleted. Cookies are a separate question, answered in the cookie policy.
Who is responsible
HYCAD SOFTWARE SRL, Calea Turzii 241/E, Cluj-Napoca, Romania, CIF 42122453, J12/149/2020, is the controller of the personal data described here. Write to office@hycad.eu; the same two people who do the reviews read that inbox.
What we collect
What you type into the form: your name, your email address, and the description of what you are building. Please do not put credentials, customer data or anything else confidential in that box; it is a first message, not a place for secrets.
What the request itself carries: your IP address, your browser's user agent and language header. We keep these with the enquiry, because they are what tells a real enquiry from an automated one and what a rate limit is applied to.
Where you came from: the campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid) and the referring page. These are read from the address bar and travel with the form. Nothing is stored on your device for this.
If you accept the cookie banner: analytics about how the page was used, described in the cookie policy. What you type into the form is masked and never appears in a recording.
Why, and on what legal basis
- To answer you and agree a piece of work. Steps taken at your request before a contract, Article 6(1)(b) GDPR. Without a name and an email there is nobody to reply to.
- To keep a record of enquiries, stop abuse of the form, and see which campaigns bring the enquiries we can actually help with. Our legitimate interest in running and improving a small business, Article 6(1)(f). You can object at any time, and for the measurement part pressing "Necessary only" is that objection.
- Analytics cookies. Your consent, Article 6(1)(a), given through the banner and withdrawable from the cookie policy page.
Who else sees it
- Our own server, rented from netcup in Germany, where the enquiry is stored in a database that only we can reach.
- Bunny, the content delivery network that serves this page. It sees the request for the page, not the contents of your message.
- Slack, where a new enquiry pings us. That message carries the enquiry's id, where it came from, and how many characters the description has. Not your name, not your email, not a word of the text. Slack is a third party and does not need to hold what you told us.
- Amazon SES, when we send you the acknowledgement. That email is sent by hand, after one of us has read the enquiry, so it carries your address by necessity.
- Microsoft, only if you accepted analytics cookies, as described in the cookie policy.
We do not sell anything to anyone, we run no mailing list, and we do not add you to a sequence. If we ever need to pass an enquiry to someone else to answer it, we will ask you first.
How long we keep it
An enquiry stays while the conversation is alive and for up to twelve months after the last exchange, so that a conversation which resumes does not start from nothing. Ask us to delete it sooner and we will, without asking why. Where a review was actually carried out, the invoice and what Romanian accounting law requires us to keep stay for as long as that law says, separately from the enquiry.
Your source code, if a review goes ahead, is handled under the contract for that work and our copy is deleted within fourteen days of delivering the report, confirmed to you in writing. That is in the terms, and it is a promise we keep whether or not anyone asks.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to the processing we base on legitimate interest, and ask for it in a portable form. Write to office@hycad.eu. We answer within a month, usually the same week, and we do not charge for it.
If we get it wrong, you can complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority where you live.
What we do not do
No automated decision-making with legal effects, no profiling, no advertising tags on this site today. If that changes, this page changes with it and the banner will ask again.