Privacy Policy

1. Who is responsible

The controller of the account and billing data is the operator of the platform.

We do not have a separate data protection contact unless one is stated here.

2. What we process

• Account data: your email address, a display name if you give one, the sign-in provider you used, and the workspaces you belong to.
• Workspace data: the business details of a workspace (name, address, tax numbers, currency, tax mode) and the people invited into it.
• Operational and bookkeeping data: the products, contacts, orders, documents, payments and the resulting journal entries that the workspace records. This is business data, and it is personal data only where a person is the subject of a record (a customer, a contact person).
• Content: images, files and documents you upload, including the files you generate or receive.
• Technical data: IP address, browser and device information, and the logs of what happened in the platform, kept for security and to investigate problems.
• Billing data: the plan you are on, invoices and their payment status. We do not store full card numbers; card details go to the payment provider.
• Marketplace data: your verified business identity, your listings and the counterparties and products you trade with, which are recorded on the platform's shared catalogue.

3. Why we process it, and on what basis

• To provide the platform and the plan you asked for — performance of a contract.
• To keep accounting and tax records and issue invoices — a legal obligation.
• To keep the platform secure and prevent fraud and abuse — our legitimate interest.
• To tell you about the service (changes, incidents, invoices) — performance of a contract or our legitimate interest.
• To send marketing about the platform — your consent, which you can withdraw at any time.

We do not profile you for automated decisions that have legal effect on you, and we do not sell personal data.

4. Who else sees the data

The platform is self-hosted: the database and the application run on infrastructure we operate, and the data stays there. We use a small number of providers to run it, and each is bound by a data processing agreement:

• Hosting and storage — Hetzner (servers and object storage for uploaded files).
• DNS and edge caching — Cloudflare.
• Transactional email — the provider named in the workspace's infrastructure settings.
• Card payments and subscriptions — a licensed payment provider; your card details are given to it, not to us.
• Fiscalization of receipts and invoices for Serbian users — the certified provider integrated with the tax administration's system.

We also disclose data if a competent authority requires it under the law, and to our professional advisers where necessary.

5. Data that becomes part of the catalogue

Every trade on the platform also builds a shared catalogue: the counterparty business, the product and its category are recorded in it, and a product you list publicly is visible to other verified businesses. This is how the platform works and it is the same for every workspace — it is described in the terms too.

Private business data — your books, your margins, your prices shown only to you — is never in that catalogue.

6. How long we keep it

• Account and workspace data: while the workspace exists, and for a short read-only export window after it ends.
• Invoices and accounting records: for the period the law requires — ten years for accounting records under Serbian law.
• Technical and security logs: a rolling window, kept long enough to investigate an incident.
• Support conversations: until the question is closed and for a short period after, in case it comes back.

7. Your rights

You can ask to see the personal data we hold about you, correct it, delete it, restrict what we do with it, receive it in a portable form, or object to processing based on our legitimate interest. Where we process on consent, you can withdraw it.

Write to the contact address in section 1; we answer within the statutory period. If you are not satisfied, you may complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, or to the supervisory authority where you live.

If your data is inside a workspace that belongs to a business, that business is the controller: ask them first, and we will help them answer.

8. If you use the platform for your own customers

You are the controller of the personal data you put into your workspace about your own customers and suppliers. You must have a lawful basis for it, tell those people what you do with it, and answer their requests. We process it only on your instructions, which are: run the platform, keep the books, send the documents you ask us to send, and secure it.

We will enter into a written data processing agreement with you on request, and we tell you before we add a sub-processor to the list in section 4.

9. How we protect it

Access to the data is governed by row-level security in the database itself, so a workspace can only read and write its own rows, and every role's rights are declared in the schema rather than in the application. Access between businesses is granted explicitly and can be revoked.

Data is encrypted in transit. Backups are taken and their restore is tested; the accounting record cannot be rewritten, so a corrupted or malicious edit shows as a correction rather than replacing history.

10. Cookies

Cookies and local storage are described in the Cookies Policy.

11. Changes to this policy

We announce a change in the workspace before it takes effect. The date at the top of this page says when it was last edited.