EN
Plan your trip

Privacy Policy

Effective date: 18 October 2026 · Version 2.4

This page explains what happens to your personal data when you write to us: through the website corneliuscurtu.md, the chat window on it, the contact form, or the Moldova4You Tours messaging assistant that answers on WhatsApp, Instagram and Facebook Messenger. We wrote it the way we would explain it out loud, so you can read it once and know where you stand.

Who is responsible for your data

Corneliu Scurtu works as a licensed guide within a company, and that company is the controller of everything described here. We handle your data under Law of the Republic of Moldova No. 195/2024 on the protection of personal data.

What we collect

When you write to us

On WhatsApp, Instagram, Facebook Messenger, in the site chat or by email, we end up with:

  • your name, or the profile name the messaging platform shows;
  • the contact details you give us: a phone number, an email address, a messaging account;
  • the content of your messages, including the trip details you choose to share: dates, group size, language, where to pick you up, what you would like to see.

When you send the form on this site

The fields you filled in reach us as an email. Our server adds three technical items to that email: your IP address, the Referer (the page the form was sent from) and the User-Agent (the browser and device string your browser announces). They are there for one reason, to tell a real inquiry from an automated one, and they live inside that email and nowhere else. Before the form goes out, a Cloudflare Turnstile check confirms that it is being sent by a person and not by a script; for that, Cloudflare receives your IP address and technical signals from your browser, and nothing of what you typed. If the form is sent from a tour page or from the trip planning page, our internal request system on our own server records a note about it: where you came to the site from (the address of the site that sent you, any campaign tags in the address, the arrival page) and which page the form was sent from. We do not look up your country or device here. If a tour is chosen in the request, the request itself goes there too, and we get a short notice about it on Telegram.

When you tap a WhatsApp button

The site sends our server a short note that the button was pressed, so that we know a conversation is about to start. The note carries the page you were on, the page you arrived at and the site that sent you there (a search engine, a social network, or nothing if you typed the address yourself), any campaign tags in the address, your browser language and time zone, how long you had been on the page and on the site and how many pages you had opened, and the same IP address and User-Agent as the form. Our server also asks ipinfo.io which country and city the IP address belongs to and which provider it comes from. To remember the arrival page while you browse, the site keeps one entry called cc_src in your browser's session storage, and it is gone as soon as you close the tab. All of this, except the IP address itself and the full User-Agent string (from which our server takes only the device type and browser), is recorded in the same internal system, and we get a short notice on Telegram: the tour or page, the channel you came through, the country, the device, the time on the site and the number of pages, without the city or the provider. After 12 months the details about you are erased from that record: country, city, provider, device, browser language and time zone; only the type of event, the time, the channel and the page remain. If the internal system or Telegram fails, the note arrives as before in one internal email, together with the IP address and User-Agent. This data serves two purposes: to tell a real traveler from an automated visit, and to understand which channels bring people to us. The WhatsApp conversation itself never passes through the site.

When you open the chat window

The chat saves one entry called cs_chat in your browser's local storage: a session number and a timestamp, so your conversation is still there if you reload the page. It expires after 30 days, and clearing your browser data removes it right away. The messages themselves go to our own server. When you send the first message of a new conversation, the site records a note in the same internal system that a chat has started: where you came to the site from (the site address, campaign tags, the arrival page), the page you wrote from, how long you had been on the page and on the site, how many pages you had opened, and the device type and browser. The note holds neither the text of your message nor your contact details, we do not look up your country here, and the device is erased from the record after 12 months.

When you visit the site

On the first page you open in a tab, the site tells our server which site you came from (only the site's address, not the exact page), any campaign tags in the address, the arrival page and the page language. That is how we count visits by channel. To avoid counting one visit twice, the site checks the cc_src entry described above. No cookies are needed for this, and neither the IP address nor details about your device go into the visit count, so no one can be recognized from these records.

What we never ask for

We do not ask for payment card numbers. We do not ask for identity documents: at the border you show your own passport yourself, and it never passes through us. We do not collect health data, religious or political views, or anything else the law treats as a special category, and we would rather you did not send such things to us either.

Why we use it, and on what grounds

  • To answer your inquiry and put together an offer. This is the run-up to a contract, at your own request.
  • To organize and run the tour you booked. This is the contract between us.
  • To issue documents and keep the books. This is a legal obligation the company has to meet.
  • To keep the contact form and the WhatsApp buttons usable. Our legitimate interest in knowing that an inquiry comes from a person and not from a script, which is what the technical items above and the Cloudflare check are for.
  • To understand which channels bring us visitors and clients. Search engines, AI assistants, social networks, partners: this shows us where our effort is worth putting. This is our legitimate interest, and it is what the visit count and the notes on where you came from are for.

We do not build advertising profiles, we do not target ads at you, and we do not sell or rent your data to anyone.

Who else sees it

  • The platform you wrote from. A conversation on WhatsApp, Instagram or Messenger passes through that platform under its own terms.
  • Our hosting provider. The site, the chat and our internal request system run on our own server, placed with a hosting provider; up-to-date information on where that server is located is available on request.
  • Anthropic PBC (USA), the AI provider that drafts our replies. It processes the text of a message on our instructions and for us, as a processor, not for its own purposes. Under Anthropic's commercial terms, what we send through its API is deleted within 30 days and is never used to train its models.
  • Partners involved in your particular tour. A winery expecting your group, a hotel holding a room, a colleague driving a second car, and only what they need in order to do it.
  • Our second company mailbox, vetok@carpoint.md, which receives a copy of every message sent through the site form so that no inquiry is lost.
  • ipinfo.io, which receives the IP address from a WhatsApp click, returns the country, the city and the provider of that address, and gets nothing else from us.
  • Cloudflare, Inc. (USA), whose Turnstile check runs on the booking form before it is sent: it receives your IP address and technical signals from your browser in order to tell a person from a script, and does not see what you typed into the form.
  • Telegram Messenger Inc. (UAE / British Virgin Islands), whose messenger brings us short notices: about a new request from the site (tour, dates, group size, tour language and your name or contact) and about a WhatsApp click (tour or page, channel, country, device, time on the site, number of pages, without the city or the provider), as well as the cards with the text of your messages and the draft reply that a person reads and approves before sending.

That is the whole list. Nobody receives your data for their own marketing.

Data that leaves the country

Five things happen outside the Republic of Moldova, and we would rather say so plainly than hide it in a footnote:

  • messaging platforms store and process your conversation on their own infrastructure abroad, under their own terms, which you accepted when you installed them;
  • Anthropic PBC (USA), the AI service that drafts our replies, processes the text of your message on its servers outside the country, as our processor; under its commercial terms the data is deleted within 30 days and is not used to train models;
  • ipinfo.io (USA) looks up the country, city and provider of an IP address on its own servers abroad;
  • Telegram (UAE / British Virgin Islands) delivers to us the notices about requests and WhatsApp clicks, as well as the cards with draft replies, through its servers abroad;
  • Cloudflare (USA) runs the anti-spam check on the form on its own servers abroad.

For these transfers we rely on the contractual safeguards the providers offer, including the standard contractual clauses adopted by the European Commission where the provider includes them in its terms (Article 46 of Law No. 195/2024); Anthropic includes them in its commercial terms. If our server turns out to be hosted outside the Republic of Moldova, the same rules apply to it. You can ask us for a copy of the safeguards that apply to a particular provider.

If you would rather not use any of them, call +373 60 721 721 or write to corneliu.scurtu@carpoint.md, and we will handle your request that way instead.

How long we keep it

  • Correspondence and contact details: while we are handling your inquiry and for as long as the trip that follows from it needs them, and no longer than 12 months after your last message. Conversations from the site chat and the messaging assistant are deleted from our server automatically once that period is over; documents issued for a booking stay with the accounting records (next item).
  • IP, Referer and User-Agent from the form, and the fallback email about a WhatsApp click: they exist only inside the notification email and go when that email goes.
  • Notes on WhatsApp clicks and chat starts in the internal system: after 12 months the details about you (country, city, provider, device, browser language and time zone) are erased; the type of event, the time, the channel and the page remain.
  • The visit count: with no time limit, because no one can be recognized from it.
  • Invoices and accounting documents: for the period set by the accounting legislation of the Republic of Moldova.
  • The cs_chat entry in your browser: 30 days, or until you clear your browser data, whichever comes first.
  • The cc_src entry in your browser: until you close the tab.

Cookies, chat storage and tracking

This site has no third-party analytics, no advertising pixels and no third-party trackers: it counts its visits itself, on our own server and without cookies. The fonts are served from our own server. The one outside call happens on pages with a booking form, where the Cloudflare Turnstile check loads to keep spam out; it may keep a technical entry in your browser for the duration of the check and identifies no one. Two entries live in your browser: cs_chat, described above, which exists solely to keep your own chat open in front of you, and cc_src, which holds nothing but the address you arrived from and disappears when you close the tab. Neither identifies you or follows you to other sites, so there is no consent banner here to click away.

AI, and who actually answers you

An AI assistant prepares a draft reply to your message. A human, Corneliu or someone from his team, reads and approves every reply before it reaches you. Nothing is sent automatically. No decision about you is made by a machine alone: the price, the availability and the answer to your request are decided by people.

Your rights

Whatever channel you wrote from, you can ask us to:

  • tell you what data we hold about you and give you a copy of it;
  • correct it, if something is wrong;
  • delete it;
  • restrict what we do with it while a question about it is open;
  • stop processing you object to, where we rely on our legitimate interest;
  • hand back the data you gave us in a machine-readable form so you can take it elsewhere;
  • withdraw a consent you gave, which does not undo what was lawful before you withdrew it.

One email is enough: write to corneliu.scurtu@carpoint.md and say what you want done. If you are not happy with how we handled it, you can complain to the National Center for Personal Data Protection of the Republic of Moldova (str. Serghei Lazo 48, MD-2004 Chișinău, datepersonale.md). If you live in the European Union, you can also turn to the supervisory authority of your own country.

Changes to this policy

When something changes in the way we handle data, we change this page along with the effective date and the version number at the top of it. Nothing is edited quietly.

Contact

CAR POINT GROUP S.R.L., Chișinău, Republica Moldova.
Data questions: corneliu.scurtu@carpoint.md
Phone: +373 60 721 721

Back to homepage →