Privacy Policy
What we collect, why, and your rights. Short and plain.
Last updated 23 October 2026
Who we are
Trial Fit is operated by the data controller:
FRIDAY CORP S.R.L. (trading as The Friday Labs)
Bd. Pipera nr. 1-VIIIJ, et. 3, ap. 38, Voluntari, Ilfov 077190, Romania
Tax ID (CUI) 34239160 · Trade Register J23/889/2015 · EUID ROONRC.J23/889/2015
lex@thefridaylabs.com
For anything about your data, write to the address above. We reply within 30 days.
What we process
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Trial input: NCT ID, pasted criteria or the text of an uploaded protocol (files are converted to text in your browser; only the text is sent) | Translate criteria and compute your result | Contract (6(1)(b)) |
| Work email | Deliver your report and answer you | Contract (6(1)(b)) |
| Payment details: name, email, billing country, card (entered on Stripe's page; we never see the full card number) | Take payment, prevent fraud, keep accounting records | Contract; legal obligation (6(1)(c)) |
| Consent record: time, document version, user agent, a one-way hash of your IP address | Prove that you accepted these terms | Legal obligation; legitimate interest (6(1)(f)) |
| Technical logs: IP address, browser, pages requested | Run, secure and debug the service | Legitimate interest (6(1)(f)) |
Do not upload documents containing personal or health data about identifiable people. Protocols and criteria are not expected to contain any. We do not use your input to train AI models. We do not sell or share personal information for advertising, and we make no automated decisions with legal effects about you.
Who helps us
We use these service providers (processors), bound by data processing agreements:
- Vercel Inc. (USA): hosting, serverless functions and private Blob storage for reports and consent records.
- Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc.: payment processing. Stripe is also an independent controller for its own fraud and legal duties.
- Google LLC (Gemini API, paid tier): translates eligibility criteria into rules. Under the paid tier Google does not use the content to train its models.
- Resend (USA): sends the email with your report link.
- ClinicalTrials.gov (US National Library of Medicine): when you enter an NCT ID, we fetch the public trial record. No personal data is sent.
International transfers
Some providers process data in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914), with additional safeguards such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Paid reports and their inputs: 12 months from purchase, then deleted. Your report link stops working at that point.
- Unpaid checkout drafts: up to 12 months.
- Consent records: for the period in which a claim may be brought, up to 5 years.
- Invoices and payment records: 10 years, as required by Romanian accounting law.
- Server logs: kept by our host for a short period, normally under 30 days.
Cookies and storage
We do not use advertising or analytics cookies, and there is no tracking. Your browser stores only what the site needs to work: your theme choice (local storage) and your progress in the report wizard (session storage, cleared when you close the tab). Stripe sets its own cookies on its payment page, to prevent fraud. Because all of these are strictly necessary, no cookie banner is required.
Your rights
Under the GDPR you may ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. Email us; we may need to verify your identity.
You may complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro, or to the authority where you live or work.
California residents (CCPA/CPRA)
In the last 12 months we collected identifiers (email, IP address), commercial information (purchases) and internet activity (server logs), from you, for the purposes above. We disclose them only to the service providers listed. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics.
You have the right to know, delete and correct your personal information, and the right not to be discriminated against for using these rights. Send a request to lex@thefridaylabs.com; an authorised agent may make it on your behalf. We honour Global Privacy Control signals, although we have nothing to opt out of.
Security
All traffic uses HTTPS. Reports are stored in private storage, behind long random links that are not indexed. Only the operator has access to the systems. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Children
Trial Fit is a professional tool, not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
Changes
We will post any change here and update the date at the top. If a change is material, we will tell customers by email before it takes effect.