Terms and conditions, privacy and cookies

RHAM (the "Service") is operated by Badea Ana-Maria, as a natural person, until the company that will take over the service is incorporated (the company's details will be published on this page the day it is registered).

You can write to us at any time at support@rham.ro. The same address receives requests about personal data, complaints and the notices these terms provide for.

Data controller. Within the meaning of Regulation (EU) 2016/679 (the "GDPR"), the controller of your personal data is the entity above. We are not required to appoint a data protection officer; requests go to support@rham.ro.

By creating an account or using the Service you accept these terms. If you do not agree with them, do not use the Service.

What the Service is. RHAM is a web application which, from a brief you write, produces the elements of a brand identity: strategy, logo concepts, a colour palette, typography, copy, website layouts, marketing materials and a brand guideline, all editable and exportable. Part of the content is generated by a deterministic engine running on our servers, and part (the copy and the photographic mockups) by an artificial-intelligence model operated by a third-party provider, described in the privacy policy.

The account. You must be at least 16 years old. An account belongs to one person; the credentials are yours and you are responsible for what happens under them. Every account confirms its email address before the workspace opens. Write to us if you suspect somebody else has used your account.

Your content. The briefs, uploaded logos, inspiration images and texts you write remain yours. You warrant that you have the right to use them and that they do not infringe anybody's rights. You grant us only the technical licence needed to store, process and display them to you and to the people you send a review link to.

What the Service produces is yours. Palettes, logo concepts, copy, the brand guideline and exported files belong to you, on the free plan included, with no claim from us and no attribution required. The software, the engine, the templates, the ten site designs and the text of this website remain ours.

Fonts. Every typeface the engine can choose is distributed under the SIL Open Font License or Apache 2.0, licences that permit commercial use and embedding in web pages. The text of each licence accompanies the font where we ship it ourselves and is published by Google Fonts for the rest.

Automatically generated content. A generated logo, name or text may resemble an existing one. We do not check availability as a trademark, domain name or company name, and we do not guarantee the uniqueness or registrability of any result. Before using an identity commercially, checking with OSIM, the EUIPO and the relevant registers is your responsibility. Texts written by the artificial-intelligence model may contain errors and must be read before publication.

Acceptable use. Do not use the Service to produce content that is unlawful, misleading, defamatory or infringing, to overload or attack our systems, to circumvent plan limits or to resell access. We may suspend an account used in this way, with notice by email, and in serious cases immediately.

Plans, payment, trial. The Solo plan is free. Paid plans are billed in advance for the period chosen, monthly or yearly, in euro, plus VAT where it applies. Changing plan takes effect immediately and starts a new billing period, without proration. Cancelling stops the next renewal and leaves access active until the end of the period already paid for. A trial lasts 14 days, is available once per account and ends by returning you to Solo, not by charging you. Until paid plans open, nothing on this site takes a payment.

Plan limits. The number of projects, text generations, photographic mockups and team seats is the one shown on the pricing page for each plan. Moving to a smaller plan deletes nothing; the limit applies only to creating new projects.

Availability and changes. We aim to keep the Service available at all times but do not guarantee uninterrupted operation. We may modify, add or withdraw features; a change that significantly reduces what you paid for entitles you to a proportional refund of the remaining period. Keep exports of work you depend on.

Liability. The Service is provided as is. To the extent the law allows, we are not liable for indirect losses, loss of profit or loss of data caused by using or being unable to use the Service, and our total liability to you is limited to the amounts you paid in the last 12 months. Nothing in these terms limits the rights you have as a consumer under the law, nor liability for fraud or gross negligence.

Termination. You can delete your account yourself, at any time, from Account → Security; deletion is immediate and final. We may close an account that breaches these terms or that has not been used for 24 months, with notice by email sent 30 days in advance.

Changes to the terms. We may update these terms. Significant changes are announced by email at least 15 days before they take effect; using the Service after that date means accepting them. The date of the last update is shown at the top of the page.

Governing law. These terms are governed by Romanian law. Disputes are settled by the competent courts of Romania; for consumers, by the court of the consumer's domicile where the law so provides.

This section says which personal data we process, why, on what basis, for how long and with whom we share it. It applies to visitors of the website and to account holders.

What data we process.

• Account data: your name, email address, an optional company name, a scrypt hash of your password (never the password), the language you chose, whether you opted into product emails, your plan and your invoice history.
• Project data: briefs, strategies, palettes, logo concepts, copy, uploaded logos, saved inspiration images, notes left on review links and published sites. A brief may contain personal data if you choose to write it in.
• Technical and security data: for each session, a hashed session token, the browser identifier (user agent) and the IP address; an audit log of sign-in and administrative actions (date, action, email address, IP address); failed sign-in attempts, used to lock the account temporarily after eight wrong passwords.
• Correspondence with us, when you write to us.
• We do not process special categories of data and we make no automated decisions with legal effects on you.

Why, and on what basis.

• Providing the Service, that is performing the contract with you (Art. 6(1)(b) GDPR): the account, the projects, the sessions, the confirmation, reset and billing emails.
• Legal obligations (Art. 6(1)(c)): issuing and keeping invoices as fiscal and accounting law requires.
• Our legitimate interest (Art. 6(1)(f)): the security of the account and of our systems, preventing abuse and throwaway accounts, the audit log, anonymous traffic measurement. You have the right to object to this processing; see "Your rights".
• Your consent (Art. 6(1)(a)): emails about product news, which you can stop at any time from your account or from the link in every email.

Who else sees the data (processors). We do not sell data and do not use it for advertising. We share it only with the providers the Service needs in order to work, each bound by contract to process it solely on our behalf:

• Hosting: the servers the Service runs on and the database are located in the European Union.
• Transactional email: an email provider (Brevo or Resend) receives your address and the content of the email we send you, in order to deliver it.
• Artificial intelligence: when you use the features that write copy or produce photographic mockups, the brief, the brand name, the strategy and the relevant logo are sent to the Google Gemini API (Google Ireland Limited, with possible processing in the United States). Under the paid API terms, Google does not use this data to train its models. The transfer relies on the EU–US Data Privacy Framework and standard contractual clauses. Nothing is sent there until you press the button in question.
• Payments: when paid plans open, card details are entered on the page hosted by Stripe and never reach us; we keep only the subscription, its period and the invoices.
• Traffic measurement: we currently run no traffic-measurement tool.

How long we keep the data.

• Account data and projects: as long as the account exists. Deleting the account removes them from the server immediately, together with the sessions, the review links and the published sites.
• Sessions: until they expire (12 hours, or 30 days if you chose "keep me signed in") or until you end them from Account → Security.
• The audit log and failed sign-in attempts: at most 12 months.
• Invoices: for the period fiscal and accounting law requires, currently 5 years, even if you delete the account.
• An account whose address was never confirmed has no projects; its address is released to whoever registers with it again, and the account is deleted after 30 days.
• Database backups are overwritten within 30 days at most.

Your rights. You have the right of access to your data, of rectification, of erasure, of restriction of processing, of portability, of objection to processing based on legitimate interest, and of withdrawing consent, without the withdrawal affecting earlier processing. The Account page shows everything we keep about you and lets you change or delete it; every project exports to JSON, a portable format. For anything else write to support@rham.ro; we answer within 30 days at most. If you are not satisfied with the answer, you may contact the Romanian supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro, or the supervisory authority of your own country.

Security. Passwords are stored as scrypt hashes; sessions use signed, hashed tokens; all traffic is encrypted (HTTPS, HSTS); the account locks temporarily after repeated wrong passwords; changing the password ends the other sessions and sends a warning email; administrative access is logged. No system is perfectly secure; if we learn of an incident affecting your data, we notify you without undue delay, as the law requires.

Children. The Service is not directed at people under 16 and we do not knowingly collect data from them. If you learn that a minor has created an account, write to us and we will delete it.

Changes. We update this policy when something it describes changes. Significant changes are announced by email; the date of the last update is at the top of the page.

We use only strictly necessary and preference cookies, for which the law (Article 4 of Romanian Law 506/2004 and the ePrivacy Directive) requires no consent. That is why there is no cookie banner.

• rham_session: keeps your session. It is http-only, same-site and holds a signed pointer to the session, not personal data. It expires with the browser or, if you chose "keep me signed in", after 30 days.
• rham_lang: the language chosen for the interface. It expires after one year.
• The theme (light or dark) is kept in the browser's local storage, not in a cookie, and never leaves your device.

There are no analytics, advertising or third-party cookies.

Sites published by users at rham.ro/s/… set no cookies.

Right of withdrawal. As a consumer in the European Union you have 14 days to withdraw from a distance contract without giving a reason. RHAM is digital content supplied immediately: by starting a paid plan you ask for the supply to begin at once and acknowledge that you lose the right of withdrawal once it has been fully supplied. Until then, write to support@rham.ro and the amount paid is returned.

Complaints and alternative resolution. Write to us first. If we do not reach a resolution, you may contact the Romanian National Authority for Consumer Protection (ANPC), www.anpc.ro, or an alternative dispute resolution (ADR) body from the list ANPC publishes.

Legal guarantee of conformity. Digital content must match its description on the pricing page and on this site. If it does not, you are entitled to have it brought into conformity, to a price reduction or to end the contract, under Romanian Government Emergency Ordinance 141/2021.