Privacy Policy

The controller of your personal data is VLAHOV TECH, obrt za usluge, vl. Franko Vlahov, Stjepana Radića 46, 22000 Šibenik, Croatia, OIB: 97659127676.

For any questions about this Privacy Policy or the processing of your personal data, or to exercise the rights described below, contact us at: privacy@moj-obrt.com.

We collect the following categories of personal and business data:

• Account data: full name, email address, password (stored hashed), language preference.
• The user's business data: company/trade name, OIB, address, IBAN, VAT ID (if any), domestic VAT-system status, name of the responsible person, contact email, phone and website, business location names and payment device identifiers.
• Company logo: a file the user uploads to display on issued invoices and offers (available on the Starter plan and above).
• Data about the user's clients: name, OIB or other identification number, address, VAT ID and similar data the user enters in order to issue invoices and offers to their clients. With respect to that data, the user is themselves the controller, and we act as a processor on the user's behalf.
• Invoice, offer, and line-item data: the content of issued documents, amounts, fiscalization JIR/ZKI codes, and payment history.
• Fiscalization data: the digital certificate (P12 file) and its password, which the user uploads to digitally sign and report invoices to the Tax Administration (FINA/CIS), stored by us in encrypted form (AES-256-GCM).
• Subscription and billing data: the selected plan (Free/Starter/Pro), subscription status, and billing period. We do not collect or store payment card details ourselves - these are processed exclusively by our payment provider, Stripe, Inc.
• Technical data: IP address, browser and device information, session cookies, API request logs (for users with API access), and error logs used to diagnose technical issues.
• Support communications: the content of inquiries you send us by email or other channels, including the name, email address and message you submit through the contact form on our website.
• Usage analytics data: the pages you visit, when and how often you use key features of the Service (e.g. issuing an invoice, logging project hours), your approximate device and browser type, and the page that referred you. We do not record the content you enter (such as client names, amounts, or notes) and we do not use session recordings or automatic capture of what you click. If you accept analytics cookies and are signed in, these events are linked to a pseudonymous identifier of your account (the internal account ID and plan, never your name or email address). If you reject analytics cookies, the data is collected without cookies or any identifier stored on your device (see section 8).

We process your data for the following purposes, under the following legal bases in Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b) GDPR) - to register your account, provide the Service, issue invoices and offers, perform fiscalization, and process your subscription and billing.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) - to meet obligations under the Croatian Fiscalization Act, VAT Act, General Tax Act, and other applicable regulations, including the mandatory retention of accounting and fiscal records.
• Legitimate interest (Art. 6(1)(f) GDPR) - to secure our systems, prevent misuse, resolve technical issues, protect our legal rights, and to measure in aggregate how the Service is used so that we can improve it. This last purpose is the basis for cookieless analytics (when you have not accepted analytics cookies): no cookies or identifiers are stored on your device and visits are counted using a privacy-preserving hash computed on our analytics provider's servers, which cannot be used to follow you across days or to identify you.
• Consent (Art. 6(1)(a) GDPR) - for analytics cookies and identifiers (which let us link your usage events to your pseudonymous account ID and recognise you across visits), and where we otherwise ask for your explicit consent (e.g. for marketing communications, if applicable). You can accept or reject analytics cookies in the cookie banner and change your choice at any time via "Cookie settings" in the page footer; withdrawing consent does not affect the lawfulness of processing before withdrawal.

We do not sell your data to third parties. To provide the Service, we share certain data with the following categories of recipients, who process it on our behalf and in accordance with our instructions and applicable data protection law:

• The Croatian Tax Administration (FINA/CIS system) - a mandatory recipient of issued-invoice data for fiscalization, under the Fiscalization Act.
• Stripe, Inc. - payment processing and subscription management. Stripe acts as an independent controller for payment data; we recommend reviewing Stripe's own privacy policy.
• Amazon Web Services (AWS S3) - storage of uploaded files (company logo).
• Our email delivery provider - for sending account verification, password reset, and Service-related emails.
• Cloudflare, Inc. - protection against automated abuse (CAPTCHA) during sign-up, sign-in and when you use the contact form.
• PostHog, Inc. - product analytics (the usage data described in section 2). We use PostHog's European cloud, which stores the data on servers in the EU (Frankfurt, Germany). PostHog processes the data on our behalf under a data processing agreement; events are sent through our own domain rather than directly from your browser to PostHog.
• Hosting infrastructure providers - for hosting the application and its database.
• Competent authorities - where necessary to comply with a legal obligation, a court order, or to protect our rights.

Some of our service providers (e.g. Stripe, AWS and PostHog, Inc., whose parent is based in the United States) may process data on servers located outside the European Economic Area (EEA), including the United States, or may be accessed from there (for example for support). In such cases, we ensure the transfer is subject to appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, or is based on an adequacy decision.

We retain account data for as long as you maintain an active account, and delete or anonymize it within a reasonable period after you stop using the Service, unless longer retention is required to comply with a legal obligation or to establish, exercise, or defend legal claims.

Invoice, offer, and fiscalization data is retained in accordance with the periods prescribed by Croatian tax and accounting legislation, currently up to 11 years for fiscalization-relevant data. These periods may change as the underlying legislation changes.

Support communication records are retained for up to 3 years from the last contact, unless longer retention is required for the reasons stated above.

Usage analytics data is retained for up to 12 months, after which it is deleted or irreversibly anonymized. The cookie choice you make is remembered on your device until you change it or clear your browser data.

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure ("right to be forgotten"), subject to legal exceptions (e.g. mandatory retention of fiscal records).
• Restriction of processing in certain circumstances.
• Portability of data you provided to us, in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, if you believe our processing of your data violates the GDPR.

The Service uses two kinds of cookies and similar technologies (such as your browser's local storage).

Strictly necessary: session cookies for sign-in and authentication, cookies and settings that remember your language, theme and active business, and cookies related to Cloudflare Turnstile CAPTCHA protection. These are needed for the Service to function and do not require consent under applicable e-privacy law.

Analytics (only with your consent): if you accept analytics cookies in the cookie banner, PostHog sets a first-party cookie and uses local storage on your device to recognise you across visits and link your usage events to your pseudonymous account ID. If you reject them, PostHog runs in cookieless mode: nothing is stored on your device (apart from a note of your choice, so that we do not ask again), and visits are counted anonymously using a hash computed on the analytics provider's servers. Until you answer the banner, the Service behaves as if you had rejected. If you accept, we also set a first-party cookie (30 days) that notes how you found us - the campaign tags in the link you clicked (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the website you came from, never your identity - so that when you register we can record which channel brought you. It is saved with your account and used only to measure which channels work.

We do not use advertising cookies or third-party cookies to track behavior outside our Service. You can change your choice at any time via "Cookie settings" in the page footer, and you can delete cookies and local storage in your browser settings. We reserve the right to introduce additional non-essential cookies with prior notice and, where required, your consent.

We apply appropriate technical and organizational measures to protect personal data, including: encryption of sensitive data at rest (e.g. fiscalization certificates are encrypted with AES-256-GCM) and in transit (TLS/HTTPS), password hashing, role-based access control, login rate limiting, and ongoing monitoring of security logs.

Despite these measures, no method of transmission or storage over the internet is completely secure. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the competent supervisory authority and, where legally required, you as the data subject, within the timeframes prescribed by the GDPR.

The Service is intended for business users (sole traders, companies, and similar entities) and is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have collected a minor's data without appropriate consent, we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in the law or our data processing practices. We will notify users of any material change by email or an in-Service notice at least 15 days before it takes effect. The date of the last update is shown at the top of this page.

For any questions about this Privacy Policy or the processing of your personal data, contact us at: privacy@moj-obrt.com.