Privacy policy

The controller of account data, contact messages and technical data is Dark Solutions PR, Novi Sad, Srbija, PIB 109848820, MB 64469401, [[email protected]].

For data on the invoices you issue (e.g. buyer identification), you are the controller and we process it on your behalf, solely to issue the invoices and keep their record in the service.

• Account data: email address, plus the name and profile picture provided by Google or GitHub if you sign in with them; your chosen language.
• Organization and membership data: the organization's name and tax ID (PIB), members and their roles, invitations (the invitee's email address).
• Location data: name, address, the secure element certificate with its password, PAC and JID, and details from the certificate (name, tax ID, expiry date).
• Invoice data: the content of the invoices you send (items, amounts, payment methods, order number, buyer identification if you provide it) and the VSDC responses.
• Contact form messages: name, email, company name and the message.
• Technical data: a record of actions in the organization (audit log), when an API key was last used, and, to prevent abuse, your IP address, which is kept only in the server's memory for a few minutes at most.

• Providing the service (account, sign-in, organizations, issuing invoices, reports, notices about failed invoices and certificate expiry) — performance of the contract, i.e. these terms of use.
• Security and abuse prevention (audit log, rate limiting) — legitimate interest.
• Replying to contact form messages — legitimate interest, or steps taken at your request before entering into a contract.
• Complying with legal obligations, where they apply — legal obligation.

We don't use data for advertising, don't build profiles and don't sell data.

• The Tax Administration of the Republic of Serbia (VSDC) — the invoices you issue, as that is the core of the service.
• The hosting provider whose servers run the service.
• useSend, the email delivery service, which runs on our own infrastructure.
• Google or GitHub, only if you choose to sign in with them; their privacy policies then also apply, and data may be transferred outside Serbia.

We don't share data with anyone else unless required by law or by an order of a competent authority.

• Organization data (locations, certificates, API keys, invoices, invitations) is kept while the organization exists and is permanently deleted when the owner deletes the organization.
• Account data is kept while the account exists. You can request account deletion at the contact address.
• The audit log is kept after an organization is deleted, without a link to it, for security and to resolve any disputes.
• Contact form messages are kept as long as needed to reply.
• Data may remain in backups for a limited time until they are replaced.

Note that you are required to keep fiscal invoices for the periods set by law; export your invoices before deleting an organization.

Certificates, passwords and PACs are stored encrypted (AES-256-GCM) and decrypted only in memory, at the moment an invoice is sent. For API keys we store only a hash, and the full key is shown only once. Connections to the service and to VSDC are encrypted (TLS), and organizations' data is kept separate.

We use only cookies needed for the service to work, with no analytics or tracking:

• sign-in cookies (Auth.js): your session and form protection during sign-in;
• an active organization cookie, so you see the same organization when you come back;
• a language cookie (NEXT_LOCALE), so you get the language you chose;
• your light or dark theme choice, stored in your browser's local storage.

You have the right to request access to your data, rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. Send your request to the contact address; we'll reply within 30 days.

If you believe the processing is unlawful, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).

For invoice data that you control, buyers should contact you, and we'll help you respond to their requests.

We may change this policy. We'll notify you of material changes by email or in the service before they take effect.

For any privacy questions: [[email protected]].