Version 2026-10-19. This Privacy Policy explains how DYNAMIC RESOURCES SRL (“dynares”, “we”, “us”) collects, uses, shares and protects personal data when you visit our website (dynares.ai), use the dynares platform (dynares.app) and its services (together, the “Service”), or when we contact you about dynares as a business prospect.

1. Who We Are

The controller of your personal data is DYNAMIC RESOURCES SRL, a Romanian company registered with the Trade Register under no. J2025076565002, sole registration code (CUI) 52645980, VAT number RO52645980, with its registered office at Șoseaua București-Ploiești 19-21, Băneasa Business Center, Office MR8, Floor 6, Sector 1, 077190 Bucharest, Romania.

For any privacy question or request, write to [email protected]. We have not appointed a data protection officer, because we are not required to. Our privacy contact handles all requests.

We have two roles:

Controller for data about our website visitors, our customers’ users (account, billing, support), and business prospects we contact.
Processor for data our customers collect or manage through the platform: leads and form submissions on their landing pages, their landing page visitors, call recordings, CRM records and lead enrichment. For this data, the customer is the controller, and our Data Processing Agreement applies (see Section 12).

2. Data We Collect

Identity and contact data: name, business email address, company name, phone number, billing address and VAT number.
Account data: login details (passwords are stored hashed), roles, workspace settings, plan and subscription details, accepted Terms version with time and IP address, and activity logs.
Payment data: invoices, payment status and billing history. Card details are entered on our payment provider’s page (Revolut). We receive only a reference to the card, never the full card number.
Technical data: IP address, browser, operating system, device identifiers, access times and referring pages, from server logs and security tools.
Usage data: pages and features used, clicks, session duration and errors in the platform.
Content you submit: landing pages, campaigns, keywords, images, branding, chat messages to the in-product assistant, and content extracted from websites you ask us to analyse (including your own website and competitors’ public pages).
Company enrichment data: when you sign up, public business information about your company (such as industry, size and location) obtained from business data providers such as Apollo.io, to set up your workspace.
Integration data: when you connect Google Ads, Meta Ads, HubSpot, Pipedrive, Slack, Twilio or other integrations, we store OAuth tokens or API keys and account identifiers, and we read and write the data needed for the features you enable.
Authentication data: if you enable two-factor authentication or passkeys (WebAuthn), we store the secret key (encrypted) or the public key credential. Private keys never leave your device.
Prospect data: if we contact you as a business prospect, see Section 8.
Data processed for our customers: lead and form data, landing page visitor data (including fraud signals), call recordings and transcripts, and enriched lead data, processed on our customers’ behalf (see Section 12).

3. Why We Use Your Data and on What Legal Basis

Purpose	Legal basis (GDPR)
Creating and running your account, providing the Service, support, and the managed Google Ads service on Business+	Contract (Art. 6(1)(b))
Billing, invoicing, usage charges and collection of overdue amounts	Contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c))
Recording your acceptance of the Terms (version, time, IP)	Legitimate interest in being able to prove the contract (Art. 6(1)(f))
Service emails (verification, security, billing, notices about the Service and changes to the Terms)	Contract (Art. 6(1)(b))
Optional account emails (summaries, tips). You can unsubscribe at any time	Legitimate interest (Art. 6(1)(f))
Setting up your workspace with public company information	Legitimate interest in a fast, relevant onboarding (Art. 6(1)(f))
Security, fraud and abuse prevention (including bot checks at sign-up and trial abuse checks)	Legitimate interest (Art. 6(1)(f))
Improving the Service and measuring our website	Legitimate interest (Art. 6(1)(f)); consent for optional cookies (see Section 10)
Contacting business prospects (see Section 8)	Legitimate interest in B2B direct marketing (Art. 6(1)(f), Recital 47)
Answering authorities, defending legal claims	Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f))

Where we rely on legitimate interest, you can object at any time (see Section 9). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

4. Integrations

When you connect an integration, you authorise us to access the connected account and to send data to it as needed for the features you enable. You can disconnect an integration at any time in your settings. We then stop using it and delete or invalidate the stored tokens, unless we must keep a record for legal or security reasons.

Google Ads and other Google APIs

What we access: your Google Ads account data (campaigns, ad groups, ads, keywords, search terms, budgets and performance), and with your permission we make the changes you request or approve. On Business+, your account manager makes changes as described in the Terms.
What we send to Google: campaign, ad and keyword changes, and offline conversion data (such as GCLID, conversion value and time).
Limited Use: dynares’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you use. We do not sell it, use it for advertising to you, or use it to train general-purpose AI models. People at dynares read it only with your permission, for security, to comply with the law, or (on Business+) to run your campaigns as agreed.

Meta Ads

We read campaign metrics, audience and creative performance, and lead form submissions, for reporting and optimisation.

HubSpot, Pipedrive and other CRMs

We send the lead and contact data you configure (such as name, email, phone, company and deal information) to keep your CRM in sync.

Slack

We post the performance summaries, alerts and insights you configure to the channels you choose.

Twilio (call tracking)

If you enable call tracking, we provision tracking numbers and process call metadata (caller number, duration, time) and, if you enable it, call recordings, which may be transcribed and analysed by AI to score lead quality.

5. AI Features

The Service uses AI to generate and optimise landing pages, ads, keywords and messages, to analyse calls and leads, and to answer questions in the in-product assistant. To do this, we send the relevant content (for example page text, campaign data, chat messages and, where enabled, call recordings) to AI providers acting as our sub-processors. Under the API terms we use, these providers process the data to return results to us, and we do not authorise them to use it to train their models. We do not send more personal data than the task needs.

AI output can be wrong. AI does not make decisions about you that have legal or similarly significant effects (see Section 7).

Sub-processors that help us run the Service: cloud hosting (Amazon Web Services, EU region), payments (Revolut), email delivery, real-time messaging, DNS and bot protection (Cloudflare), AI providers, telephony (Twilio) and business data (Apollo.io). The current list, with each provider’s purpose and location, is on our sub-processors page.
Integrations you enable, at your direction (Section 4).
Advisers and authorities: our accountants, auditors and lawyers under confidentiality duties, and public authorities or courts when the law requires it.
A buyer or successor if our business is reorganised or sold, under the same protections.

We do not sell personal data, and we do not share it for third parties’ own advertising.

International transfers

We store the Service’s main data in the European Union. Some sub-processors (for example AI providers, Twilio and Apollo.io) are based in the United States or process data there. For these transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses with additional safeguards where needed. You can ask us for more information at [email protected].

7. Automated Processing and Profiling

The Service scores leads and traffic automatically: for example, it estimates lead quality, flags likely bots or click fraud, and scores companies by fit. These scores help our customers (and us, for our own prospects) decide where to focus. They do not produce decisions about individuals that have legal or similarly significant effects. If a customer blocks traffic or excludes an IP address from its ads based on fraud signals, that is the customer’s decision as controller.

8. Business Prospects

We contact businesses that we think may benefit from dynares. If you received an email from us, this section explains where your data comes from and what we do with it (Article 14 GDPR).

Data: your name, job title, company, business email address, professional profile links, company website and public information about your company’s advertising and landing pages.
Sources: business data providers (Apollo.io), your company’s public website and public advertising information.
Purpose and basis: to contact you about dynares in a professional capacity, based on our legitimate interest in direct marketing to businesses (Art. 6(1)(f), Recital 47). We check that the message is relevant to your role and company.
Limits: we do not send cold emails to prospects in Germany or Austria. Every email says how to stop further emails, and we honour that immediately.
Your right to object: you can object at any time by replying “no thanks”, using the unsubscribe link, or writing to [email protected]. We then stop contacting you and keep only your email address (or domain) on a suppression list so we do not contact you again.
Retention: up to 24 months after our last interaction with you, unless you become a customer or object earlier.

9. Your Rights

Under the GDPR you have the right to:

access the personal data we hold about you and get a copy;
have inaccurate data corrected;
have your data deleted, where there is no longer a reason to keep it;
restrict our use of your data in certain cases;
receive data you gave us in a machine-readable format, or have it sent to another provider (portability);
object to processing based on legitimate interest, and to direct marketing at any time (after which we stop);
withdraw consent at any time, where we rely on consent.

To exercise your rights, write to [email protected]. We answer within one month. We may extend this by up to two more months for complex requests, and we will tell you if we do. We may ask you to confirm your identity. If your request concerns data we process for one of our customers (for example, a lead form you filled in on a customer’s landing page), we pass it on to that customer, who decides on it.

You also have the right to complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro. You can also complain in the EU country where you live or work.

10. Cookies and Tracking Technologies

We use cookies, local storage and similar technologies on dynares.ai, grouped into the categories below. Except for the strictly necessary ones, nothing is set until you agree in the cookie banner. You can change or withdraw your consent at any time via Cookie settings (also linked in the footer of every page).

Strictly necessary (always active): remember your cookie choice (dynares_consent, 6 months) and your light/dark theme, and keep the Website secure.
dynares visitor analytics (always active, first-party): our own analytics, the same system our customers use on their landing pages. It stores a random visitor identifier and the campaign parameters of your first visit (such as utm_source or gclid) in your browser's local storage, and records the pages you view, time on page, scroll depth, referrer, approximate location derived from your IP address, and device characteristics (including a technical device fingerprint used to recognize returning visitors and filter fraudulent traffic). When you follow a link to sign up on dynares.app, the visitor identifier is passed along so we can attribute your account to the page that brought you. The data is processed only by dynares, on our own servers in the EU, and is never shared with third parties. Legal basis: our legitimate interest in measuring and securing our Website (Art. 6(1)(f) GDPR). You can object at any time by contacting us.
Marketing (with consent): Google Ads (Google Ireland Ltd.) measures our advertising campaigns; Apollo (Apollo.io, Inc.) helps us recognize companies interested in dynares and follow up with them.

Google tags use Google Consent Mode: until you consent, they do not set advertising cookies and only send cookieless signals. If you withdraw consent, we delete the cookies these providers set on dynares.ai and stop loading their scripts. You can also block or delete cookies in your browser settings.

11. How Long We Keep Data

Data	How long
Account and workspace data	While your account is active, then up to 24 months after it closes (to handle questions, disputes and claims), unless you ask for earlier deletion and no legal reason prevents it
Invoices and accounting records	10 years from the end of the financial year, as required by Romanian accounting law (Law 82/1991)
Evidence of Terms acceptance	For the duration of the contract plus the limitation period for claims (generally 3 years)
Customer data (leads, pages, campaigns, recordings)	While the subscription is active and for 30 days after it ends, so you can export it. Then deleted, except where the law requires us to keep it
Call recordings	Up to 90 days, or a shorter period you set. Transcripts and analysis while the subscription is active
Integration tokens	Until you disconnect the integration or the account closes
Security and server logs	Up to 12 months
Prospect data	Up to 24 months after the last interaction; suppression list entries for as long as needed to respect your objection
Backups	Deleted data remains in backups until they are overwritten in the normal backup cycle

12. Data We Process for Our Customers

When customers use dynares to publish landing pages, collect leads, track visitors and calls, enrich leads or manage their CRM, they decide why and how this data is processed. They are the controller, and we are their processor under our Data Processing Agreement, which is part of our Terms. We process this data only on the customer’s documented instructions and to provide the Service, never for our own marketing.

Customers are responsible for having a legal basis for this processing and for informing their visitors and leads (including through their own privacy policy and cookie banner). If you are a visitor or lead of one of our customers, please contact that customer to exercise your rights. If you contact us, we forward your request to them.

13. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption of sensitive secrets such as two-factor keys, role-based access control, two-factor authentication and passkeys, logging, and hosting in the EU with a major cloud provider. The measures are described in the DPA. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the authority and, where required, you, as the GDPR requires.

14. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect data about children. If you think a child has given us personal data, write to [email protected] and we will delete it.

15. Third-Party Websites

Our Website and the Service link to other websites and services. Their own privacy policies apply to them.

16. Changes to This Policy

We may update this Privacy Policy. For significant changes we will notify you by email or in the Service before they apply. The current version is always at dynares.ai/privacy-policy, with its version date at the top.

17. Contact

DYNAMIC RESOURCES SRL
Șoseaua București-Ploiești 19-21, Băneasa Business Center, Office MR8, Floor 6
Sector 1, 077190 Bucharest, Romania
Privacy requests: [email protected]
Other questions: [email protected]

Privacy Policy