Privacy notice
Last updated: 23 August 2026.
Who is responsible
Growth Path Agency S.R.L. ("Growth Path", "we", "us") is the controller of personal data processed through this website, bisceanu.com, the site of Vlad Bisceanu, founder of GrowthPath AI.
Registered office: Str. Drumul Putnei nr. 38-42, Et. 4, Ap. 33, Sector 3, Bucuresti, Romania. Trade Registry: J2025042918007 (Oficiul Registrului Comertului de pe langa Tribunalul Bucuresti). Unique Registration Code (CUI): RO51980049.
Privacy contact: privacy@growthpath.systems.
What we collect, and why
Server and hosting logs. Our hosting provider (Vercel) records technical metadata when you load a page: IP address, user-agent string, timestamps, and response status. These logs help us investigate errors and detect abuse.
Aggregate site analytics. We use Umami, which we host ourselves on our own hardware, to count page views. It sets no cookies and stores nothing on your device. It counts unique visitors with a salted hash of IP plus user-agent. The salt rotates monthly, so the identifier changes every month, and it is specific to this site — it cannot follow you anywhere else. Because we host it, no third party receives this data.
Contact form. When you submit the form, we collect the name, email address, and message you provide so we can reply. Vercel BotID invisibly checks whether the submission comes from a genuine browser. Our in-house email service, hosted by Railway and delivered through Amazon SES, sends the message to our mailbox. Ticking the optional marketing checkbox creates a pending marketing subscription and sends you a confirmation email. The subscription becomes active only after you click its confirmation link; until then, you receive no marketing messages. Every marketing message includes an unsubscribe link. Leaving the box unticked does not create a marketing contact or change an existing preference.
Legal bases
Hosting logs and analytics aggregates run on Art. 6(1)(f) GDPR: our legitimate interest in operating a working, abuse-free site. Contact-form processing runs on Art. 6(1)(b): steps taken at your request prior to entering a contract. Occasional marketing messages run on Art. 6(1)(a): the consent you give by ticking the optional marketing checkbox and confirming your email through the link we send, withdrawable any time via the unsubscribe link in any message or the privacy contact above.
Processors and recipients
We share personal data with a short list of processors that run the site:
Vercel Inc.: site hosting, BotID abuse protection, serverless contact processing, and operational logs. Our function runs in an EU region. DPA
Cloudflare, Inc.: authoritative DNS. DPA
Railway Corporation: hosting for our in-house email service and contact database, deployed in Amsterdam. Railway also operates in the US. DPA
Amazon Web Services EMEA SARL: email delivery through Amazon SES in Ireland. GDPR Center
International transfers
Railway's primary operations are in the US. Transfers are covered by its EU-US Data Privacy Framework certification and Standard Contractual Clauses. Vercel, Cloudflare, and AWS may also process operational data outside the EEA; their Data Processing Agreements include the applicable Standard Contractual Clauses. You can request a copy of the relevant safeguards at the privacy contact above.
Retention
Contact-form correspondence is retained for up to 36 months after the last exchange. Marketing contact data is kept until you withdraw consent or it is no longer needed; after unsubscribe, we retain a minimal suppression record so your choice is not silently reversed. Hosting logs are short-lived operational data. Analytics data is deleted after 24 months.
Your rights
You can request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest. Email privacy@growthpath.systems; we respond within 30 days (Art. 12(3) GDPR). You can also complain to the Romanian supervisory authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucuresti, Romania.
Cookies
This site stores nothing non-essential on your device, so no consent banner is required (Art. 5(3) of Directive 2002/58/EC, transposed by Legea 506/2004). BotID may use short-lived first-party challenge state during form submission; it is strictly necessary spam defense, not analytics or advertising.
Other things worth knowing
We have not appointed a Data Protection Officer; our processing does not meet the thresholds in Art. 37 GDPR or Law 190/2018. This is a B2B site: we do not process special-category data, we do not collect the Romanian CNP, and we do not knowingly collect data from anyone under 16. When this notice changes, we update this page and the date at the top.