GeoStru AI is the platform of web applications and cloud services accessible at geostru.ai and comprising, among others, the GeoStru NX (nx.geostru.ai) and GeoStru GeoDropbox (geodropbox.ai) applications. The GeoStru AI platform is operated by EngSoft, a company incorporated under Romanian law. This policy describes how the personal data of GeoStru AI users is processed pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR). Last updated: July 2026.
1. Data controller
The data controller is ENGSOFT SRL (CUI 30277934; Trade Register no. J2012001517126), a company incorporated under Romanian law with registered office in Cluj-Napoca, Str. Sarmisegetusa 17/19, Romania, which operates the GeoStru AI platform. For any matter relating to data processing: privacy@geostru.ai.
2. Types of data processed
- Registration and account data: name, email address, credentials.
- Usage and authentication data: user identifiers, session tokens, logs, IP address.
- User-uploaded content: project files, price lists, bills of quantities and other documents, which may contain personal data of third parties (e.g. the user's end clients).
- Data derived from processing: extracted text (OCR), vector representations (embeddings), price items, AI assistant conversation history.
- Payment data: handled by the payment provider (Stripe); we do not store full card details.
- Support data: communications sent to the support channels.
- Cookies and similar technologies (see the Cookie Policy).
3. Purposes and legal bases
- Provision of the GeoStru AI services and account management — performance of the contract (Art. 6.1.b).
- Billing and tax/accounting obligations — legal obligation (Art. 6.1.c).
- Security, prevention of abuse and fraud, service continuity — legitimate interest (Art. 6.1.f).
- Processing of uploaded content, including the artificial intelligence features — on the user's instructions, in order to provide the service.
- Promotional communications, where applicable — consent (Art. 6.1.a).
4. Nature of the provision
Providing account data and the data necessary to deliver the service is optional, but failure to provide it makes it impossible to create an account and use GeoStru AI. Providing data for marketing purposes is always optional.
5. GeoDropbox and artificial intelligence
The files and content you upload to GeoStru GeoDropbox are hosted on cloud infrastructure located in the European Union and Switzerland (a country covered by a European Commission adequacy decision) and are encrypted in transit.
The artificial intelligence features (item extraction, OCR, assistant) process content through Google (Gemini API) on a paid plan: under the applicable terms, content is not used to train artificial intelligence models.
6. Processing roles
- For account and usage data, EngSoft (GeoStru AI) acts as data controller.
- For the content you upload (and any third-party data contained therein), you are the controller and EngSoft acts as data processor (Art. 28), processing it exclusively on your instructions. Upon request we make available a data processing agreement (DPA).
7. Recipients and external processors (sub-processors)
To deliver the service we rely on selected providers, each with their own data processing agreements:
- Google — cloud infrastructure (EU/Switzerland hosting) and artificial intelligence features (Gemini API);
- Stripe — payment processing.
An up-to-date list of external processors is available on request at privacy@geostru.ai. We do not sell personal data to third parties.
8. Transfers outside the EU
The hosting infrastructure is located in the EU and Switzerland. Some artificial intelligence processing (Google) may take place outside the EU (United States); such transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission.
9. Data retention
We retain data for as long as necessary to provide the service and to comply with legal obligations (e.g. accounting and tax). Upon termination of the relationship or at your request, data is erased, except where the law requires retention. Derived content (OCR, embeddings, AI assistant history) is erased together with the source content.
10. Security measures
We adopt appropriate technical and organisational measures (Art. 32 GDPR), including: encryption of data in transit (HTTPS/TLS), dedicated authentication, per-customer data isolation, access controls and security monitoring.
11. Automated decision-making
The artificial intelligence features assist the user in processing their own documents; we do not carry out automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Art. 22 GDPR.
12. Your rights
You may exercise at any time the rights provided under Articles 15–22 GDPR: access, rectification, erasure, restriction, portability and objection, as well as withdraw consent where given. To exercise them, write to privacy@geostru.ai; we will respond within the statutory time limits.
13. Complaint to a supervisory authority
You have the right to lodge a complaint with the competent supervisory authority. As the controller is established in Romania, the lead authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, www.dataprotection.ro). You may also contact the supervisory authority in your country of residence.
14. Related documents
This policy is part of GeoStru AI's data protection documentation, which comprises:
- Privacy Policy (this document);
- Cookie Policy — use of cookies and similar technologies;
- General Terms of Service (Terms of Use);
- Data Processing Agreement (DPA, Art. 28) — available to customers processing third-party data through the platform;
- List of external processors (sub-processors);
- Specific notice on the use of artificial intelligence (where applicable).
The current versions of these documents are available on geostru.ai or on request at privacy@geostru.ai. [Insert links to the published documents.]
15. Changes
We may update this policy: the current version is always published on this page, with the date of last update.