Privacy policy in brief
What data we collect, why, where we store it, who we share it with, how long we keep it and how we protect it.
On this page
The “Politica de confidențialitate” (Privacy policy) page (blackbox.md/info/privacy) describes how BLACKBOX processes your personal data. To open it, choose “Informații” (Information) → “Politică de confidențialitate” (Privacy policy) in the top menu (in the “Companie” (Company) column), or click the link with the same name in the footer of any page. This article summarizes the version marked “Ultima actualizare: 21 septembrie 2026” (Last updated: September 21, 2026).
Available to: any visitor to blackbox.md; no account needed. The policy also applies to users of the app.blackbox.md panel.
The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.
Note This is a summary. The legally binding text is the Romanian one at
https://blackbox.md/info/privacy. The Russian version is a translation provided for convenience. If this summary differs from the policy, the policy text applies.
How you accept the policy
- When you create your account, tick the box “Am citit și accept Termenii și Condițiile și Politica de Confidențialitate” (I have read and accept the Terms and Conditions and the Privacy Policy), followed by the version number. Until you tick it, the “Creare cont” (Create account) button stays inactive.
- If you sign up with Google or GitLab, there is no box. Below the buttons you see the text “Continuând, acceptați Termenii și Condițiile și Politica de Confidențialitate.” (By continuing, you accept the Terms and Conditions and the Privacy Policy.)
- You must tick the same box again before you pay for an order and before you top up your balance.
Who processes the data
- The data controller is Click Expert S.R.L. (IDNO 1021600002628, legal address: Moldova, mun. Chișinău, Vadul lui Vodă 78/2), the company that manages the BLACKBOX brand. All of the company's details: Legal details and BLACKBOX company details.
- For any question about personal data, write to support@blackbox.md. The company has not appointed a data protection officer (DPO), so this address is the contact point for data protection.
- The policy is drawn up in accordance with Law No. 195/2024 on personal data protection (in force since August 23, 2026, replacing Law No. 133/2011) and with Law No. 20/2009 on preventing and combating cybercrime, in the part that concerns service providers.
- It applies to the data you give us directly (your account, orders, contact forms) and to the data collected automatically when you use blackbox.md or the app.blackbox.md panel.
Important The policy does not cover the data of your own users stored on your server (for example, the visitors to your website). For that data, you are the controller and Click Expert S.R.L. is the processor. See Data Processing Agreement (DPA) for companies and Responsibility for server data and backups.
What data we collect
| Category | Data |
|---|---|
| Contact details | name, email, phone number |
| Billing details | company name (optional), billing address |
| Technical service data | server IP address, configuration |
| Sign-in data | password (stored as a hash), the TOTP secret for two-factor authentication (2FA), SSH keys |
| Access logs | IP address, browser (user-agent), time of access |
Why we process it
| Legal basis (Law No. 195/2024) | Purpose |
|---|---|
| Contract, Art. 6(1)(b) | providing the services you order |
| Legal obligation, Art. 6(1)(c) | invoicing, accounting, responding to lawful requests from authorities |
| Legitimate interest, Art. 6(1)(f) | security, fraud prevention, improving the services |
Where the data is stored
According to the policy, primary data is stored on servers that Click Expert S.R.L. manages through the cloud infrastructure provider FoxCloud, in the Republic of Moldova and the European Union. Data is not transferred outside the EU and the Republic of Moldova without an appropriate legal basis or your explicit consent. For emails, the policy separately mentions the Resend service (see the table below).
Who we share the data with
Your data is not sold, rented out or handed over unnecessarily. The policy names the recipients with whom we share only what is strictly necessary:
| Recipient | Role and data |
|---|---|
| FoxCloud | the provider of the cloud infrastructure the servers run on |
| Paynet Services SRL | card payment processor, only for the transaction concerned. You enter your card details directly on Paynet's secure page: BLACKBOX does not store them and has no access to them. |
| Resend | transactional email service: the recipient's address and the content of the message. It may process email addresses outside the Republic of Moldova, with appropriate safeguards. |
| Infrastructure monitoring provider | infrastructure monitoring (the policy does not name it) |
| Competent authorities | only on the basis of a written, reasoned request with a legal basis (see below) |
In addition, optional features that you choose to use exchange data with the external service you pick: signing in with Google or GitLab, and connecting a Cloudflare or GoDaddy account for DNS. See Signing in with Google or GitLab and Connecting Cloudflare or GoDaddy on the DNS page.
How long we keep the data
| Data | How long |
|---|---|
| Account and service data | the term of the contract plus 3 years after it ends |
| Issued invoices (accounting documents) | 5 years, as required by law |
| Technical access and authentication logs | at least 180 days (Art. 7(f) of Law No. 20/2009); in practice longer, for security and incident investigation |
| Communications with support | 2 years |
You can ask at any time for the deletion of data that the law does not require us to keep. To delete your whole account, use the “Ștergerea contului” (Account deletion) card on the “Profilul meu” (My profile) page: the request takes effect after a 7-day grace period, during which you can cancel it. Invoices and access logs are still kept for the periods above. Steps: Deleting your account.
How we protect the data
- encryption in transit (TLS 1.2+) and encryption at rest for sensitive data;
- passwords are stored as hashes (bcrypt), not in plain text;
- TOTP secrets and server access credentials are kept in an encrypted vault;
- two-factor authentication is mandatory for staff with access to production systems;
- regular security audits;
- least-privilege access: each person gets only the access they need.
What you can do yourself: Security recommendations for your account.
Requests from authorities
- Data is provided to authorities (police, prosecutors, courts) only on the basis of a written request with an explicit legal basis, in accordance with Art. 7 of Law No. 20/2009. We do not disclose data in response to verbal requests or requests without a legal justification.
- Requests for the immediate preservation of data are carried out confidentially, for a period of up to 120 calendar days.
- Requests from foreign authorities are honored only through international legal assistance (Art. 48 of Law No. 195/2024), on the basis of a treaty in force between the requesting state and the Republic of Moldova.
Security incidents
- If a security breach may affect your data and creates a high risk to your rights and freedoms, we notify you by email without undue delay: what happened, which data is affected, what measures we have taken and what steps we recommend.
- We also report significant incidents to the National Center for Personal Data Protection, within 72 hours of detection at the latest (Art. 33 of Law No. 195/2024).
To receive these messages, make sure your account's email address stays valid. You change the email address through support: My profile: name, phone number and email.
Marketing and cookies
- We do not use your data for third-party marketing. According to the policy, you receive emails about BLACKBOX news only if you have explicitly subscribed, and you can unsubscribe at any time with one click from the email. Creating an account does not subscribe you to such emails.
- Emails about your account, orders and servers are described in Emails you receive from BLACKBOX.
- We use only technical and session cookies, which are needed for signing in and for the panel to work. We do not use marketing, tracking or third-party analytics cookies. The full list: Cookies on blackbox.md and app.blackbox.md.
Your rights in brief
You have the right of access, rectification, erasure, portability, restriction of processing and objection (Articles 15–22 of Law No. 195/2024). On the “Profilul meu” (My profile) page (blackbox.md/account, “Contul meu” (My account) → “Profil” (Profile)):
| What you want | Where |
|---|---|
| A copy of your data | the “Datele mele” (My data) card: Downloading your data (“Datele mele”) |
| Correct your name or phone number | the “Date personale” (Personal details) block: My profile: name, phone number and email |
| Delete your account | the “Ștergerea contului” (Account deletion) card: Deleting your account |
| Other requests (objection, restriction, changing your email address) | an email to support@blackbox.md, sent from your account's email address |
We reply without undue delay and within one month at most; in complex cases this period can be extended by two more months, and in that case we tell you the reasons. Complaints and the Center's contact details: Your rights regarding personal data.
Frequently asked questions
Does BLACKBOX have access to the data on my server? Under the DPA, BLACKBOX does not access or read the content of your applications, except for technical support you explicitly request or a legal obligation. In the second case, we inform you in advance, unless the law prohibits it.
What does Paynet receive when I pay by card? For that payment, Paynet receives the name, email address and phone number from your account (if you filled in the phone number), the amount and description of the payment, plus the technical identifiers of the transaction. You enter your card details only on the Paynet page; they do not pass through BLACKBOX servers. See Paying by card (Paynet).
Does the website use Google Analytics or other tracking scripts? No. There are no third-party analytics, advertising or tracking scripts on blackbox.md or in the panel.
I have an urgent question about my data. Who do I contact? Write to support@blackbox.md. For urgent requests, the policy also lists the phone number +373 78 003948. Hours are Monday–Friday, 09:00–18:00 (Moldova time).