Privacy policy

Controller and privacy contact

Plain Plan SRL is the controller for enquiries received through this website. Contact ask@debitcredit.md, +373 69 434 905, or bd. Mircea cel Bătrân 11/6, floor 3, office 300, Chișinău, MD-2075, Republic of Moldova.

This notice covers browsing, requests for proposals and initial communications. Processing accounting records, employee information or other data under an agreed service is addressed separately in the relevant contractual documents and arrangements.

Information collected and optional fields

The form asks for your name, email, requested service and a short message. Company, phone number, document volume, employee count, VAT / IT Park status and countries of operation are optional. Do not provide individual employee information through this form.

We record the enquiry ID, submission date, language, originating page without URL parameters, enquiry status and the version of the form notice. Required fields allow us to understand and answer your enquiry; the form cannot be submitted without them. You have no legal obligation to use the form and may contact us by email or phone instead.

Do not submit national ID numbers, identity documents, passwords, banking login details, health information or payroll lists. We will agree an appropriate separate channel for accounting documents.

For the administrator, we store the email address, display name, password hash and information needed for sessions, access recovery and abuse prevention. The password is neither stored in plain text nor sent by email. We use this information for website administration and security on the basis of legitimate interests.

Purposes and legal grounds

We use the information to assess your enquiry, discuss services and prepare a proposal. If you contact us in your own name about a potential contract, the basis is taking steps at your request before entering a contract — Article 6(1)(b). If you represent a company, the basis is our legitimate interest in answering a professional enquiry and managing that business relationship — Article 6(1)(f).

Preventing form abuse relies on our legitimate interest in website security and availability. Handling requests about personal data rights relies on applicable legal obligations.

Submitting the form does not subscribe you to a newsletter or advertising. This version has no newsletter subscription, personalised advertising or commercial profiling. We do not make solely automated decisions about you that have legal or similarly significant effects.

Access to enquiries and service providers

Complete enquiries are held in the website’s private register and are accessible to the authorised Plain Plan administrator. We do not publish or sell them. Information may be disclosed to authorities where legally required.

Current hosting: ChatGPT Sites / OpenAI and Cloudflare Workers and D1 infrastructure provide website operation, enquiry and content storage, authentication and security. They may process submitted form information, administrative information and technical connection data for these purposes. The actual database region and the contractual terms applicable to our account have not yet been confirmed; we do not claim that all data stays in Moldova or the EEA.

Notifications: we use Resend, provided by Plus Five Five, Inc. in the USA. After saving an enquiry, we send a generic alert and a link to the protected dashboard from notificari@debitcredit.md to ask@debitcredit.md. The email does not contain the visitor’s name, email, phone number, message or workload details. Resend receives the sending and receiving addresses, the alert and a technical enquiry identifier to prevent duplicate sending; it may retain delivery logs.

Resend also handles administrator account recovery: it receives the administrator’s email address and a single-use password reset link valid for 30 minutes. It does not receive the password. According to Resend’s published information, service data is stored in the USA even when email sending is configured in a European region.

Email and correspondence: ask@debitcredit.md uses Google Workspace Business Starter (Gmail). When you email us directly, Plain Plan and Google process the message, sender and recipient addresses, any attachments and technical data needed to deliver, store and protect the correspondence. This mailbox also receives the generic notifications sent by the application through Resend. Our team’s replies are handled through the email service.

The billing document reviewed identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Admin console records acceptance of the Cloud Data Processing Addendum (CDPA) on 21 October 2026. The invoice issuer still needs to be reconciled with the entity named in the contractual terms applicable to our subscription. Business Starter does not include a choice of storage region through the Data regions feature. We do not have confirmation of storage exclusively in the European Union. Deleting an enquiry from the website dashboard does not automatically delete Gmail correspondence.

The form is not connected to an external CRM or newsletter platform. The website code does not load Google Analytics, Google Tag Manager or Meta Pixel or send form information to these tools.

Fornex — planned hosting

A Cloud NVMe 2 VPS has been selected and paid for to migrate to Fornex; the account lists Germany as its location. The existing WEB-25 package is a separate service, listed in Switzerland. The new website and its enquiry register have not yet been transferred to Fornex.

After migration, Fornex will participate in hosting and protecting website data. The exact contracting entity must be identified from the account’s invoice or contract. The primary server’s location alone does not establish the locations of backups, support access or other subprocessors. We will update this notice after these details have been checked and the transfer has taken place.

Processing abroad and safeguards

International providers may process data outside the Republic of Moldova. USA storage is confirmed for Resend. Germany is the location shown in the account for the selected Fornex VPS, where the new website has not yet been installed. The existing WEB-25 package is located in Switzerland. The actual countries involved in the current platform, email, support and backups are not yet fully documented for our accounts.

Resend publishes a Data Processing Addendum (DPA), which the provider states applies on account signup and includes EU Standard Contractual Clauses. The document and subprocessor list are linked below. Whether the safeguards apply to our transfers under Moldova’s Law No. 195/2024 requires a separate assessment; these documents do not automatically establish compliance for every transfer.

To ask about recipients and processing countries, or request a copy or description of applicable safeguards, contact ask@debitcredit.md. Details that are not yet confirmed are expressly identified in this notice and will be updated after the account documents are checked.

How long information is kept

We keep an enquiry while needed to answer it, prepare a proposal and continue the discussion you initiated. Once that purpose ends, the information should be deleted unless another justified basis applies. Where a contract is concluded, a legal obligation applies or legal claims need to be addressed, relevant records are managed separately under the applicable purpose and retention period.

The dashboard flags an initial retention review 90 days after receipt. The administrator can delete the enquiry or record the reason for continued storage and a next review date. Ninety days is an internal review interval, not a universal statutory deadline or automatic deletion period.

At the check on 21 October 2026, automatic email deletion was disabled for the debitcredit.md domain. This setting therefore does not apply a general automatic deletion period to messages in the inbox and archive. This is not an indefinite-retention policy: an internal retention period and review procedure for enquiry correspondence still need to be established separately. The service’s deletion rules and any additional retention or backup rules are checked separately.

The pseudonymised anti-abuse identifier expires at the end of its hourly window. Expired entries are removed at the next validated form request or access to the enquiry register. Providers’ log and backup retention is reviewed separately; deletion from the active register does not automatically remove emails or exported files.

Backups and the effect of deletion

The application does not implement its own automated backup system. Dashboard revision history and enquiry exports are not a complete database backup. The location, retention period and restoration procedure for the current platform’s backups have not yet been confirmed for this project.

Backup arrangements for the future Fornex VPS must be agreed and verified before migration, including location, frequency, retention and restoration. The published WEB-25 shared-hosting policy does not establish these terms for a VPS or prove that Fornex holds backups of the new website.

Deleting an enquiry in the dashboard removes its record from the active database. It does not automatically delete email correspondence, Resend notifications and logs, exported files or provider backups. These require separate handling according to their purpose, legal obligations and service terms. The precise retention periods for our email and backup accounts still need documentation.

Google Maps, WhatsApp and other links

Activating the map connects your browser to Google Maps. Google may receive your IP address and browser information and may use cookies under its privacy policy. The map component does not send proposal form information to Google.

WhatsApp is an optional external contact channel. The link opens WhatsApp only when you choose it; this website does not load a WhatsApp widget. Communication through that service is also subject to WhatsApp’s privacy policy. We use messages received to respond to your enquiry.

Your rights and how to exercise them

Subject to the law, you may request access, correction, erasure, restriction of processing and portability. You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. The optional map can be closed using the button next to it.

Email ask@debitcredit.md with the subject “Personal data”, the right you wish to exercise and the email used for your enquiry. Do not attach identity documents without being asked. Where there are reasonable doubts, we may request only the additional information needed to verify identity.

We normally respond within one month of receipt. Where the law permits an extension of up to two further months, we inform you within the first month and explain why. Rights are subject to statutory conditions and exceptions; any refusal must be explained.

You may complain to Moldova’s National Centre for Personal Data Protection (CNPDCP): datepersonale.md, centru@datepersonale.md, +373 22 820 801. Official links are provided below.

Security, cookies and updates

The website uses HTTPS, administrative access checks, form validation and anti-abuse limits. The application does not save raw IP addresses in the enquiry register; rate limiting uses a fingerprint calculated for each hourly window. This is pseudonymisation, not anonymisation. The hosting platform may separately process technical connection and security data.

Google Analytics, Google Tag Manager, Meta Pixel and embedded external videos are not loaded. Google Maps is optional and loads only when you press its button on the Contact page; you can close it in the same area. See the Cookies page for details.