Privacy Policy
Version 2.0. In effect since 8 October 2026.
This policy explains what personal data DreadRow collects when you use this website or contact us, why we collect it, who else sees it, how long we keep it, and what you can require us to do about it. It is written to be read, not to be survived. If anything here is unclear, ask and we will explain it in plain words.
1. Who is responsible for your data
The data controller, meaning the party that decides why and how your personal data is processed, is:
We are a one person business and are not required to appoint a Data Protection Officer. All privacy matters are handled directly at the address above.
2. Who this policy covers
It covers visitors to dreadrow.com, people who submit the audit request form, people who email us, and contractors we contact directly by email.
It does not cover the advertising accounts of clients who later give us access to their Google or Meta accounts. Section 7 explains how that access is handled, and the relationship itself is governed by a separate written agreement in which the client is the controller and we act on their instructions.
3. What we collect, why, and on what basis
We only collect what we actually use. Nothing here is collected speculatively.
| Data | Why | Legal basis |
|---|---|---|
| Name, company, email, phone, advertising platforms, monthly ad spend range, and anything you write in the message field | To prepare the audit you asked for and to reply to you | Steps taken at your request before entering a contract, Art. 6(1)(b) GDPR |
| Emails you send us, and our replies | To keep a usable record of what was discussed and agreed | Our legitimate interest in running and documenting a business, Art. 6(1)(f) |
| Business contact details gathered before we write to you, when we contact you first. Section 4 lists exactly where these come from | To offer a service relevant to your trade | Our legitimate interest in direct B2B outreach, Art. 6(1)(f). You can object at any time and we will stop |
| Whether an email we sent was delivered, opened, or replied to | To know whether to follow up, and to stop sending when you are clearly not interested | Our legitimate interest in not sending unwanted mail, Art. 6(1)(f) |
| Technical request data recorded by our host: IP address, browser and device type, pages requested, timestamps | To serve the site, keep it available, and defend it against attacks | Our legitimate interest in security and reliability, Art. 6(1)(f) |
| Analytics and advertising measurement data: pages viewed, approximate location derived from IP, device and browser, referring link or campaign, and identifiers stored in cookies | To understand how people find the site and whether our own advertising works | Your consent, Art. 6(1)(a), given through the cookie banner and withdrawable at any time |
Providing form data is voluntary. If you leave the required fields empty we cannot contact you, and that is the only consequence.
4. If we contacted you first, where your details came from
We approach painting contractors directly by email. If a message from us arrived without you asking for one, this section tells you where we found you. You are entitled to know, and we would rather write it down than be asked.
Where we look
- Your own website, including whatever contact details you publish on it and the tracking code visible in its source.
- Google Maps and Google Business Profiles, which list trading name, address, phone number and website for local businesses.
- Instantly.ai, the platform we use to find business contacts and to send email. Its contact database compiles professional details such as name, job title, work email address and employer. Instantly decides for itself how that database is built, under its own privacy notice, so requests about the database itself have to go to Instantly. What we hold is only the records we pulled into our own campaigns, and those you can ask us about directly.
- The Google Ads Transparency Center and the Meta Ad Library, public archives showing the ads a business is currently running. These describe the company, not you personally.
What we take, and what we ignore
Only what is needed to write something relevant: your name, your role, your work email address, your company, your city, and what your company's advertising looks like from the outside. We do not collect personal email addresses, home addresses, social media activity, or anything unrelated to your trade. We do not build profiles of you as an individual.
Why we are allowed to
Our legitimate interest in offering a professional service to a business likely to need it, Art. 6(1)(f) GDPR. We have weighed that against your interests and consider it proportionate: the contact is business to business, low in volume, specific to your trade, and every message we send says plainly how to stop it. That balance is our judgement, and you are entitled to disagree with it, which is what the next paragraph is for.
Your rights here
You can ask which of the sources above your details came from, and we will tell you which one specifically rather than repeat the list. You can object to the processing, ask for a copy, or ask us to delete everything. An objection to direct marketing is absolute, so we simply stop.
One exception worth stating: when you ask us to stop, we keep a minimal record of your email address and the fact that you asked. That record exists only so that you are never contacted again by mistake, and it is not used for anything else. If you want that removed too, say so and we will remove it, understanding that we then have no way of recognising you if your details resurface in a future list.
5. How we follow up
If you contact us, or if we contacted you first, we send at most two follow up emails and then stop. Every message includes a plain way to opt out. Reply asking us to stop and you are removed from all future outreach immediately, with no reply required from you and no explanation needed.
Our email practices follow the US CAN-SPAM Act as well as the GDPR, which means a real sender address, an honest subject line, a working opt out, and a postal address in commercial messages.
6. Cookies and tracking
Nothing that is not strictly necessary runs before you choose. On your first visit a banner asks whether you accept analytics and advertising cookies. If you decline, or simply ignore the banner, the scripts behind them are never loaded, so no cookie is written and no request reaches Google or Meta.
If you accept, Google Analytics 4 and the Meta Pixel load. Google Analytics measures visits and traffic sources. The Meta Pixel measures whether our own advertising leads to enquiries. Neither receives your name, email address, phone number or anything else you typed into the form.
Your choice is stored locally in your own browser, not on our servers, so it does not identify you. You can withdraw consent at any time: and pick Reject All. Clearing your browser storage for this site has the same effect. Where your browser sends a recognised opt out preference signal, such as Global Privacy Control, we treat it as a refusal.
The full list of what is set, by whom, and for how long is on our cookie policy page.
7. If you give us access to your ad accounts
No account access is needed for the free audit. The first pass uses public data and your website only.
If you decide to go further, you grant us viewer level access to your Google Ads or Meta Ads account. In that case:
- we use that access only to analyse the account and prepare findings for you;
- we make no changes to your account without your explicit permission;
- we do not export, store or share your account data with anyone else;
- you can revoke the access yourself at any time, from inside your own account, without telling us first.
Access is removed once the work is finished, unless we are in an ongoing engagement. Any personal data inside those accounts belongs to you and remains under your control, not ours.
8. What we deliberately do not do
- We do not ask for, want, or knowingly collect special category data: health, political opinions, religion, trade union membership, biometrics, sexual orientation or similar. Please do not put such information in the message field.
- We do not sell personal data, and we do not trade or rent contact lists.
- We make no decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.
- We do not ask for payment card details on this website.
- This site is aimed at business owners. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.
9. Who else processes your data
We use a small number of established providers. They act on our instructions under data processing agreements, and none of them is permitted to use your data for their own purposes beyond what their own terms describe.
| Provider | Role | Where |
|---|---|---|
| Netlify | Hosts the website and receives form submissions | United States |
| Google (Workspace) | Provides our email, so correspondence is stored there | United States and EU |
| Instantly | Stores our outreach lists and sends our outreach email | United States |
| Google (Analytics) | Traffic measurement, only with your consent | United States and EU |
| Meta | Advertising measurement, only with your consent | United States and EU |
Google Maps, the Google Ads Transparency Center and the Meta Ad Library, named in section 4, are sources we read rather than processors we send data to. We do not upload your enquiry or your correspondence to any of them.
We may also disclose data where the law requires it, for example a valid order from a public authority, or where it is necessary to establish, exercise or defend a legal claim. If the business is ever sold or restructured, client and enquiry records may transfer to the acquirer, who would remain bound by this policy until you are told otherwise.
10. Transfers outside the European Economic Area
The providers listed above are based in the United States, so your data is transferred there. Google and Meta are certified under the EU to US Data Privacy Framework. Where a provider is not covered by an adequacy decision, transfers rely on the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguards that apply to any particular transfer.
11. How long we keep things
| What | How long |
|---|---|
| Enquiries that do not become clients | Up to 24 months after our last contact, then deleted |
| Client correspondence and project records | For the duration of the engagement, then up to 3 years |
| Accounting records, once we invoice you | As required by Romanian tax and accounting law |
| Details of prospects who never replied | Up to 12 months from the last message we sent |
| The fact that you asked us to stop contacting you | Kept indefinitely as a suppression record, unless you ask us to remove that too |
| Ad account access | Revoked when the work ends, unless the engagement continues |
| Host request logs | Short retention set by our host, typically weeks |
| Analytics data | 14 months, as configured in Google Analytics |
12. How we protect it
The site is served over HTTPS. Accounts that hold your data are protected with strong, unique passwords and two factor authentication. Access is limited to one person. We keep no local database and no spreadsheet of enquiries beyond what is needed to work on them.
No system is perfect. If a breach occurs that is likely to result in a high risk to your rights, we will tell you without undue delay, and we will notify the supervisory authority within 72 hours where the law requires it.
13. Your rights under the GDPR
If you are in the European Union, the European Economic Area or the United Kingdom, you have the right to:
- be told what we hold about you and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data deleted, where we have no overriding reason to keep it;
- restrict how we use your data while a dispute about it is resolved;
- object to processing based on legitimate interest, including direct marketing. Where you object to direct marketing, we stop, with no balancing test and no questions;
- receive the data you gave us in a portable, machine readable format;
- withdraw consent at any time, which is as easy as giving it and does not affect what was lawful before.
14. If you are in the United States
Most of the people who contact us are in the United States. Depending on your state, including Texas, California, Virginia and Colorado, you may have the right to confirm whether we process your data, to obtain a copy, to correct it, to delete it, and to opt out of targeted advertising or any sale of personal data.
We do not sell personal data for money. Advertising measurement runs only if you accept the cookie banner, and declining or withdrawing serves as your opt out. We will not treat you differently for exercising any of these rights.
If we refuse a request, you may appeal by replying to our decision. We will respond to the appeal within 60 days and, if we still refuse, tell you how to complain to your state Attorney General.
15. How to exercise any of this, and how to complain
Write to claudiu@dreadrow.com and say plainly what you want. There is no form to fill in and no fee.
We reply within 30 days. If a request is unusually complex we may extend that by up to two months and will tell you why within the first 30 days. If we cannot confirm who you are from the email address you use, we may ask for something that reasonably establishes the connection, and we will not use that information for anything else.
If you think we have handled your data badly, tell us first. We would rather fix it than argue about it. You also have the right to complain to a supervisory authority, whether or not you contact us. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro. If you live elsewhere in the EEA or the UK, you may complain to your own national authority instead.
16. Links to other sites
This site may link to pages we do not control, such as a client's website or a platform's documentation. We are not responsible for what those sites do with your data. Their policies apply once you leave here.
17. Changes to this policy
If we change how we handle data, this page changes with it and the version and date at the top change too. Substantial changes, such as adding a new processor or a new purpose, will be summarised at the top of this page for at least 30 days. If a change requires your consent, we will ask for it rather than assume it.