Privacy policy
Privacy policy
Last updated: 30 August 2026
The short version
Ithacos (“we”, “us”) is operated by Ithaca Project S.R.L., a Romanian limited liability company, registered with the Trade Registry under no. J40/2300/2020, fiscal code (CUI) 42279386, with its registered office at Str. Transilvaniei nr. 54, et. 1, ap. 4, Sector 1, Bucharest, Romania. Ithacos.com is a workspace that helps small manufacturers prepare and organise their Cyber Resilience Act documentation. Ithaca Project S.R.L. is the data controller for the personal data described on this page. For anything privacy-related, contact hello@ithacos.com.
We collect nothing about you automatically beyond what is described in the technical section below. Personal data only reaches us when you submit one of these forms:
Waitlist
Your email address and which form on the site you used. We use it to send one email when early access opens — no newsletter. Legal basis: your consent, which you can withdraw at any time by asking us to remove you from the list.
CRA scope check
Your email address, an optional company or product name, your answers, and the generated result, so we can email you a private link to that result. Legal basis: taking steps at your request. We contact you about Ithacos beyond the result email only if you tick the separate opt-in checkbox, which is unticked by default. Scope-check records are deleted automatically after 12 months.
CRA readiness survey
Your answers about how your company is handling the CRA. The survey is anonymous unless you choose to leave an email address to receive the findings report, an early-access invite, or a scope check. Anonymous responses are not personal data; if you leave an email, the legal basis is your consent.
Accounts
When the product opens for early access, creating an account will store your name, email address, a hashed password, and optional two-factor or passkey credentials. Legal basis: performing our contract with you.
Technical & security
To protect the site from abuse we rate-limit form submissions by IP address; those counters live in a short-lived cache and are not joined to your submissions. Our servers also keep standard, short-lived request logs. Legal basis: our legitimate interest in keeping the service secure.
We set only strictly necessary first-party cookies — the kind that make the site function and that EU law exempts from consent. That is why our cookie notice informs you instead of asking you to accept anything: there are no analytics, tracking, advertising, or third-party cookies to accept or refuse.
ithacos-session
Keeps your session together while you move through the site — for example your progress in the scope-check wizard. Expires after a short period of inactivity.
XSRF-TOKEN
Protects forms against cross-site request forgery, so a submission can only come from you.
Dismissing the cookie notice is remembered in your browser’s local storage (ithacos-cookie-notice), not in a cookie, and never leaves your device. If we ever introduce non-essential cookies, we will ask for your consent first and update this page.
We do not sell or rent personal data, and we do not share it with advertisers. Your data is processed by the small set of infrastructure providers we need to run the service — hosting and transactional email delivery — acting under data-processing agreements and only on our instructions. We would disclose data beyond that only if legally required to.
Under the GDPR you can ask us for access to the personal data we hold about you, have it corrected or deleted, restrict or object to how we use it, receive a copy in a portable format, and withdraw any consent you have given — withdrawal does not affect processing that happened before it. Email hello@ithacos.com and we will respond within one month. You can also lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or with the data-protection authority in your own EU country.
All traffic to ithacos.com is encrypted in transit. Passwords are stored hashed, never in plain text. Access to production data is restricted to the people who operate the service, and we keep the data we hold to the minimum described above.
If we change what we collect or how we use it, we will update this page and its “last updated” date. For significant changes affecting data you have already given us, we will tell you by email where we can.