プライバシー通知。

Controller and contact

The controller for this website is MAR & PET GRUP S.R.L., fiscal ID 15455744, trade-register number J2004001290293, EUID ROONRC.J2004001290293. Its registered office is 41 Școlii Street, Drăgănești village, Drăgănești commune, 107210, Prahova, Romania. Privacy requests may be sent to partener@marpet.ro. See company information.

What we collect and why

We process the contact details, project description, page and campaign attribution, and—when used—the validated Vision 3D technical snapshot you submit. The purpose is to review your request, contact you, prepare a quotation, maintain a reliable Lead ID audit trail and measure platform-originated opportunities. We do not use a request as a marketing subscription without separate consent.

Legal bases and required information

For an individual asking about a potential contract, we use information supplied in an enquiry to take steps at that person’s request (GDPR Article 6(1)(b)); without contact details and a description we cannot respond. For business representatives and limited security, abuse-prevention and lead-audit data, we rely on the legitimate interest in answering enquiries and protecting the service (Article 6(1)(f)), subject to your rights. Optional product and contact-click analytics use your separate consent (Article 6(1)(a)), which you may refuse or withdraw. Contractual, accounting or legal records are processed where a legal obligation applies (Article 6(1)(c)). Romanian Law 190/2018 supplements the GDPR where applicable; it does not replace these grounds. There is no solely automated decision with legal or similarly significant effect: Mara and Vision 3D do not approve offers, prices or technical feasibility.

Lead ID and returning-visitor key

Each accepted request receives a unique Lead ID whether or not optional analytics is accepted. Only after optional consent, a first-party, HTTP-only pseudonymous cookie may be retained for up to 24 months to link later enquiries. After refusal, the enquiry still works without this cookie. The database stores only a one-way fingerprint, not its raw value.

Who receives the data

Operational notifications are sent to the approved MAR&PET and PXP500 recipients responsible for commercial follow-up and reporting. Infrastructure providers include Supabase for the lead register and authentication, Cloudflare for network delivery, Hetzner for application hosting, and Resend for transactional email.

International processing

The lead database is hosted by Supabase. Transactional notifications sent through Resend include the lead’s contact and request content as well as delivery metadata; Resend may process this information in the United States under its contractual transfer safeguards. Strict EU-only processing is therefore not claimed for the current notification path.

Optional analytics: product journeys and commercial contact clicks

Only if you accept optional analytics, content-free lifecycle events record the product, language, an allowlisted step and a random first-party browser UUID. The UUID contains no account or contact data, stays in localStorage for no more than 30 days, and is then rotated; the server stores only a separately domain-separated HMAC. Reports count active pseudonymous browser clients, sessions and sessions per client. These are not people or accounts: one person can be counted on several browsers or devices, several people can share a browser profile, and clearing storage creates a new client. We may also record activation of an explicitly marked commercial email or telephone link. That event contains the channel, selected MAR&PET contact, link placement, pathname, language, limited UTM values and time. Neither telemetry path contains your message or call content, email address, telephone number, full URL, referrer, raw IP address, User-Agent or the cookie key used for leads. A separate one-way rate-limit token derived from the network address is retained for no more than 48 hours and is never shown in the report. A click indicates contact intent only: it does not prove that a message was sent or a call was made and does not create a Lead ID, commercial alert or marketing subscription. Contact-click events and content-free product telemetry have an approved 90-day retention period. You may decline or withdraw permission at any time from Analytics settings without affecting product use or contact links.

Retention

The attribution cookie is kept for no more than 24 months. Prospect lead records with personal data have an approved retention period of 365 days from their latest recorded activity. Converted or won customers follow the separately applicable contract, dispute, accounting and legal-obligation periods.

Your choices and rights

You may request access, correction, deletion, restriction, portability where applicable, or object to legitimate-interest processing, and may withdraw consent where it is the applicable basis. You may complain to the Romanian supervisory authority, ANSPDCP, or another competent authority. Withdrawing consent does not affect processing already performed lawfully. Our cookie policy explains browser storage and how to change analytics consent.

Security and data minimisation

Access to the lead register is restricted to five approved identities with role-based permissions and an immutable event trail. Vision 3D submissions store a reduced technical snapshot; locally selected photographs and raw editor history are not included in the lead record.

Maraとの会話

Maraは言語とブラウザータブごとに最大24件のメッセージだけをローカル保存します。セッションは24時間以内に自動失効・削除され、「新しい会話」で直ちに削除されます。

サーバーAIが有効な場合に限り、メッセージと直近の履歴がOpenAIへ送信されます。モデレーションと生成の前に、検出可能な氏名、メール、電話、住所、郵便番号のパターンを自動置換します。これは追加保護であり自由文すべての匿名化を保証しないため、個人情報を入力しないでください。リクエストはstore: falseを使用します。ネットワークアドレスは一時HMACへ変換され60秒以内に削除され、元の値は保存されません。

回答の生成前に、OpenAIのモデレーションサービスが現在のメッセージとクライアント提供の最近の会話履歴を確認する場合があります。フラグ付けされた行は、生成用に送信される文脈から除外されます。安全管理のため、ファーストパーティのHttpOnly CookieにランダムなUUIDを保存し、/api/maraのみに限定して最長30日間保持します。OpenAIに送信されるのは派生HMACのみで、元のUUID、訪問者のネットワークアドレス、ブラウザーのUser-Agentは送信されません。内部計測サービスが有効な場合、内容を含まないテレメトリにはセッションのライフサイクル、言語、許可済みステップが含まれ、AI呼び出しには処理、状態、モデル、プロンプト版、正確な遅延時間、トークン数が含まれます。費用は版管理された料金が設定された場合のみ表示され、それ以外は「neinstrumentat」です。セッション識別子はHMAC処理され、メッセージと会話履歴は保存されません。任意分析に同意した場合、ランダムなファーストパーティのブラウザーUUIDがlocalStorageに保存され、30日以内にローテーションされます。サーバーには別ドメインのHMACのみが保存されます。これは人やアカウントではなく、アクティブな仮名ブラウザークライアントとクライアント当たりのセッションを測定し、同じ人が複数端末で複数回数えられる場合があります。承認済みポリシーでは、内容を含まないテレメトリを90日間保持します。

見積フォームの連絡先情報が会話に自動的にコピーされることはありません。分析用に送信されるページ情報には許可された公開パスのみが含まれ、URLのクエリパラメーターや#以降の部分は含まれません。

Vision 3Dの自然言語入力はまずローカルで解釈されます。任意のAI補正が有効な場合に限り、個人情報を置換した依頼と縮小した技術構成がstore: falseでOpenAIへ送信される場合があります。連絡先と画像は含まれず、モデルは確定的な技術値を設定できません。