Privacy Policy

Version 1.0 · Effective [PUBLICATION DATE]

This Privacy Policy explains how we process personal data when you use the AutoEvidencija mobile application (the “App”) and the website autoevidencija.rs: what data we process, for what purposes, who we share it with, how long we keep it and what rights you have. Processing is carried out in accordance with the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of the RS, No. 87/2018; the “Law”).

This is a translation. If the Serbian and English versions differ, the Serbian version prevails.

Who controls your data

The controller of your personal data is Nikola Vasić, a natural person from Niš, Republic of Serbia, who develops and maintains the App. The terms “we”, “us” and “our” in this Policy refer to the controller.

For any question about how your data is processed, or to exercise your rights, write to us at autoevidencija@gmail.com.

If another person takes over the provision of the App, for example a company we set up, it becomes the controller of your data and processes it under the terms of this Policy. We will notify you at least 30 days in advance, and until then you can delete your account.

What data we process

We process data you give us and data that arises while you use the App. We describe it by type, with examples.

Account data

Data you use to create your account, sign in and manage it, such as your email address and username. Alongside it we keep your confirmation that you are of legal age and that you accepted the Terms of Use, with the time you did so. Your password is stored only in a protected form that not even we can read.

Data we receive from Google

If you sign in with a Google account, Google provides the basic data of your Google profile, such as your name, email address and profile picture, and your Google account identifier. Google shows you the exact list before your first sign-in.

Content you enter

Everything you enter into the App yourself, such as data about your vehicles, maintenance, costs and reminders.

The App is for keeping a record of vehicle maintenance and does not ask for personal documents or identification numbers. In free-text fields, such as the title and description of a record, enter only information about vehicle maintenance.

Do not enter:

personal identification numbers or data from personal documents, such as your national ID number (JMBG), ID card, passport or driving licence number;
data that identifies the vehicle or its owner, such as the licence plate number, the vehicle identification number (VIN) or the owner’s details from the vehicle registration certificate;
payment data, such as payment card or bank account numbers;
passwords or other access credentials;
data about other people, such as names, phone numbers and addresses;
sensitive data, such as health data.

We do not ask for such data and do not use it for anything other than keeping your records, and we do not monitor or check the content you enter. If you enter it anyway, you do so at your own responsibility, including responsibility for data about other people entered without their consent. Such data is still stored and protected in the same way as your other data, and is deleted when you delete it or delete your account. If a person whose data was entered without their consent contacts us, we may delete that data.

Settings and notifications

Your settings in the App and the notifications the App shows you.

Technical data

Data that arises when the App communicates with the server, such as your IP address and the time of access. If you allow notifications, we also process a device identifier that is used only to deliver them.

Correspondence

When you write to us, we process your email address and the content of the messages.

Why we process data and on what basis

Purpose	Legal basis
Providing the service. Running your account, storing your data and keeping it in sync between your phone and the server, reminders, and account deletion.	Performance of the contract you entered into with us by accepting the Terms of Use. Before you accept the Terms, the basis is steps taken at your request prior to entering into the contract.
Notifications on your phone. Delivering notifications, such as maintenance reminders.	Your consent, given in your phone’s system prompt or, on phones without such a prompt, in the App.
Security. Protecting accounts and the service from abuse, and fixing errors.	Our legitimate interest.
Answering messages and requests. Handling your enquiries and requests.	Our legitimate interest and, for requests to exercise rights under the Law, our legal obligation.
Evidence and legal claims. Proof that the Terms of Use were accepted and that we acted on your requests, and establishing or defending legal claims.	Our legitimate interest.

You can withdraw your consent to notifications at any time in your phone’s settings. Withdrawal does not affect the lawfulness of processing before it, nor any other feature of the App.

The data needed to create an account, the confirmation of legal age and acceptance of the Terms of Use are required to enter into the contract, so an account cannot be created without them. What other data you enter depends on the features you use.

We do not sell your data and do not use it for advertising. The App shows no ads and contains no third-party analytics or tracking tools. We do not profile you or make automated decisions that produce legal effects for you.

Who we share data with

Your data is not visible to other users of the App.

Service providers

The following service providers also process data, on our behalf and only to the extent needed for the App to work:

Supabase Inc. (USA): database, accounts and sign-in. Data is stored on servers in Germany.
Google LLC (USA), Firebase Cloud Messaging: delivering notifications to your phone. A notification contains its type, text written in advance for that type, and the internal identifiers the App needs to open the right screen. A reminder also contains the maintenance type, chosen from a fixed list, and the date. Text you entered yourself is never sent through this service.
[EMAIL SERVICE PROVIDER] ([COUNTRY]): sending the messages needed to access your account, such as an address confirmation message and a password reset message.
Vercel Inc. (USA): hosting the website autoevidencija.rs.

These service providers may engage their own subcontractors, under the same data protection obligations.

Correspondence

We handle correspondence through Gmail, a service of Google LLC (USA). Messages you send us and our replies are kept in that mailbox, for the periods set out in How long we keep data.

Google as an independent controller

When you sign in with a Google account, Google processes data about your Google account under its own privacy policy. The same applies to processing Google carries out through the Google Play store and Google Play services on your phone, when the App is downloaded, updated and its installation verified.

Public authorities

We disclose data to public authorities only when the law requires us to.

Where data is stored

The App’s database is located in Germany, in the European Union. A copy of your data is also kept on your phone, so that the App works without an internet connection.

Supabase, Google and Vercel are headquartered in the USA, so data may also be processed there. Such transfers are made under the safeguards in the data processing agreements we have concluded with these service providers. You can obtain a copy or a description of these safeguards on request. Correspondence through Gmail, including a copy of data you request, is transferred because this is necessary to answer your request.

How long we keep data

Account, content and settings are kept until you delete them yourself, and at most for as long as you have an account.
Account deletion. When you request deletion, it is scheduled, and the account and all App data are permanently deleted from the server 30 days after it was scheduled. Until then, you can cancel the deletion in the App or by writing to the address given under Contact. The exceptions are listed in the other items of this section.
Account without accepted Terms of Use. If you do not accept the Terms of Use, or do not confirm your email address through the link we send you, the account and all its data are deleted automatically once 24 hours have passed since it was created.
A previous username stays reserved for 30 days after a change, without any link to your account, so that another user cannot take it straight away.
The device identifier for notifications is deleted when you sign out on that device, turn off notifications in the App or delete your account, and when Google reports that the identifier is no longer valid, for example because you uninstalled the App. If you turn notifications off in your phone’s settings, the identifier is deleted the next time you open the App with an internet connection. If you sign out or turn off notifications while the device has no internet connection, the identifier may remain valid until you next open the App with a connection. Until then, a notification may still arrive on that device. It is not deleted because you have not opened the App for a while, so that reminders arrive even when they are scheduled far ahead.
Technical access logs are kept briefly, for the periods set by the data hosting provider, and serve only security and error fixing.
Correspondence is kept for no longer than three years from the last message. The message with which we send you a copy of your data is deleted from our mailbox immediately after it is sent; as proof that we acted on your request, we keep only a confirmation of sending, without your data.
Database backups. Data is removed from backups when the retention period of those backups at the data hosting provider expires.
The copy on your phone is deleted when you sign out. Changes that had not been synced with the server by then stay on the phone and are sent when you sign in again with the same account. The phone also keeps technical data that is not account content and is needed for the App and its notifications to work on that device, for example the recorded notification choice of the account that last made it. All of this is gone once you uninstall the App or clear its data in your phone’s settings.

Your rights

Under the Law, you have the right to:

request access to your data and a copy of it;
request correction of inaccurate data and completion of incomplete data;
request erasure of your data;
request restriction of processing;
receive your data in a structured, commonly used and machine-readable format and transmit it to another controller;
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

How to exercise your rights

You can change the data you entered directly in the App. You can delete your account in the App, under Settings, or as described on the Account deletion page. You can get a copy of your data on request, as described in How to get a copy of your data. To exercise any other right, write to us at autoevidencija@gmail.com.

We answer requests without undue delay and no later than 30 days from receipt. If a request is complex or there are many requests, we may extend this period by a further 60 days, in which case we will inform you, with reasons, within 30 days of receiving the request. To protect your data, we may ask for additional information to confirm your identity.

If you have a concern about how we process your data, please contact us first so that we can resolve it as quickly as possible. Independently of that, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).

How to get a copy of your data

The App has no option to download your data. You receive a copy of your data on request by email:

Send your request to autoevidencija@gmail.com from the email address of your App account. If you sign in with a Google account, that is the address of that Google account. If a request arrives from a different address, we will ask you to send it from your account’s address, as that is the only way we can confirm the account is yours.
We send the copy only to your account’s address, through Gmail, as a file in a structured, machine-readable format, within the period set out in Your rights.
Right after that, we send you a short confirmation with the date of sending and the name and checksum of the file sent. We delete the message with the copy from our mailbox, and keep the confirmation as proof that we acted on your request, for the period set out in How long we keep data.

Once an account is permanently deleted, your data no longer exists on our server and we cannot provide a copy. If you want a copy, request it before deleting your account or while the deletion can still be cancelled.

How we protect data

We apply technical and organisational measures appropriate to the type of data and the risks of processing. Data is encrypted in transit between the App and the server, and access rules on the server prevent other users from accessing your data. We access data only when needed to maintain and secure the service, act on your request or meet a legal obligation.

In the event of a personal data breach, we act in accordance with the Law, including notifying the Commissioner and you where required.

Minors

The App is intended only for adults, and you confirm that you are of legal age before you start using it. We do not knowingly process data of minors. If we learn that an account was created by a minor, we will delete it.

Website

The website autoevidencija.rs does not use cookies and contains no analytics or visitor tracking tools. The website hosting provider processes IP addresses and technical access data to deliver the website and protect it from abuse.

Changes to this Privacy Policy

We change this Policy when the way we process data changes or when the law requires it. The current version is always published on this page, with its version number and effective date.

Before introducing a feature that requires a new type of data, a new purpose of processing or a new recipient of data, we will update this Policy. We will notify you of material changes in the App before they take effect. A material change is any change that extends the types of data, the purposes of processing or the range of recipients, extends retention periods, or affects your rights. If a change introduces processing that requires your consent, that processing will not start until you give it.

Previous versions of this Policy are available on request.

Contact

Nikola Vasić, Niš, Republic of Serbia
Email: autoevidencija@gmail.com