Privacy Policy

The data controller is the Țara Dornelor Destination Management Organization (DMO), which runs the destination's virtual assistant — an artificial-intelligence conversation service that answers questions about the destination (accommodation, restaurants, events, routes, transport) based on information published by the DMO and its members. The conversation requires no account and asks for no personal data. You can write to us any time at contact@taradornelor.online.

Conversations are anonymous: there is no account, and the platform does not ask for your name, e-mail, phone number or any other identifying data. Specifically, we process:

• A session identifier — the chatbot_session cookie, an opaque randomly generated code that links the messages of the same conversation. It contains no personal data and is not used for advertising or tracking.
• The content of the conversation — the messages you write and the assistant's answers, together with technical metadata (detected question type, response time, sources used) and, where needed, a technical security flag if a message resembles an attempt to manipulate the assistant.
• Itineraries built in the conversation — the list of places, tied to the same anonymous session; you can export them through a personal link.
• Unanswered requests, in aggregate form — when the assistant cannot answer, only the category and a synthesized description of the need are kept, deduplicated, without the raw text of your message and without any link to your session; this is how we learn what information the destination is missing.
• The IP address — used strictly to limit the number of requests (anti-abuse protection), held only in the server's working memory; it is never stored in the database and never associated with the conversation.

We collect no payment, location or profile data and we use no tracking cookies. Please do not write personal data in your messages (names, phone numbers, addresses): the assistant does not need them to answer, and everything you write is stored as conversation history.

The conversation starts only after your consent, given in the banner shown before the first interaction — you can refuse or withdraw it at any time (see the cookies and consent section below). The technical protections (request limiting, detection of manipulation attempts) and the aggregate statistics about unanswered requests rest on the legitimate interest of the DMO in keeping the service safe and improving it; they identify no individuals.

• To hold the conversation — the session history gives the assistant the context of previous answers.
• For your itineraries — building, keeping and exporting the list of places from the conversation.
• To improve the service — aggregate statistics about what is asked and what remains unanswered, without identifying visitors.
• For the security of the service — limiting abusive requests and flagging attempts to manipulate the assistant.

The data is not used for marketing, is not sold, and no individual profiles are built from it.

To generate the answers, the text of your messages is sent to our language-model provider: Mistral AI (a French company), through the access point dedicated to processing within the European Union. The automated safety check of your message happens there as well. The provider receives only the text of the conversation — it does not receive your session cookie or your IP address from us. The search in the destination's knowledge base happens there too: the text of your question is turned into a numerical representation by the same provider, through the same access point within the European Union. The platform itself is hosted in the European Union (Hostinger, Lithuania). For weather forecasts, the Open-Meteo service receives only the name of the locality you ask about — no personal data. There are no other recipients; the DMO administrators of the platform have access to the data above to operate and oversee the service.

The chatbot_session cookie expires after 7 days — after that, a new conversation receives a new identifier. The personal link of an exported itinerary is valid for 30 days, after which its page can no longer be accessed.

The conversation history is kept, in the anonymous form described above, for 180 days from the conversation's last activity; after that period the conversation and its messages are deleted automatically, by a scheduled routine. You can request earlier deletion of your conversations at any time — see the Your rights page — and the controller deletes the data on request. Unanswered requests are kept only in aggregate form, with no link to any session.

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, objection and data portability. As conversations are anonymous, identification is done through the session on your device or through the information you give us in your request — the Your rights page explains each right and how to exercise it here in practice.

For any request or question, write to us at contact@taradornelor.online. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP).

The assistant's public pages use no tracking cookies and no traffic-analytics service. A single strictly necessary cookie — chatbot_session, described above — is set only when you use the chat, so that the messages of the same conversation stay linked; merely visiting the pages sets no cookie from us.

Your choice in the consent banner (accepted or declined) is kept only in your browser, in local storage, under the key td-asistent-consimtamant — it is not sent to the server and does not identify you. You can withdraw your consent at any time, on this page, and declining leaves the rest of the site fully functional. The administration areas of the platform (accessible only to DMO staff) use their own strictly necessary authentication cookie.