Privacy Policy

Version 1.0.0, last updated 2026-10-23.

1. Who we are

This policy explains how cetirisape (operator to be named) with its registered address at Address to be added ("cetirisape", "we", "us"), processes personal data when you use cetirisape, our websites, applications, APIs and related services (the "Services").

For personal data we decide how and why to process (for example your account, website visits and billing), we are the controller. Contact: hello@cetirisape.localhost.

We have not appointed a Data Protection Officer because the law does not require it for our activities. Privacy questions go to hello@cetirisape.localhost.

2. Data we collect

We do not intentionally collect special-category data (health, biometrics, political or religious views and similar). Please do not submit it unless a feature explicitly asks for it. Where you submit such data anyway, you are responsible for having a lawful basis.

You are not obliged to give us personal data, but without some of it (for example an email address) we cannot provide an account.

3. Why we use your data, and our legal bases

Where we rely on legitimate interests we have weighed them against your rights; you can ask for details and you can object (section 10). Where we rely on consent you may withdraw it at any time; that does not affect earlier processing.

4. Who we share data with

We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising.

We share personal data only with:

• Service providers (processors) acting on our instructions under written agreements: hosting and infrastructure, email delivery, customer support tools, error monitoring. The current list is in our Sub-processor List.
• Platforms and app stores you use to access the Services (for example Apple, Google, console or PC storefronts), which handle payments and may provide us with limited purchase and account data;
• Other users or the public, only as you direct (for example content you choose to publish or messages you send).
• Professional advisers (lawyers, auditors, insurers) under confidentiality.
• Authorities, courts and affected parties where required by law, to respond to valid legal process, to protect rights, safety or property, or to investigate abuse and fraud. We check requests for validity and, where lawful, tell you.
• A successor in a merger, acquisition, financing or sale of assets, who must honour this policy; we will notify you of material changes in control that affect your data.
• Anyone else only with your consent.

5. International transfers

We operate from Serbia and store data mainly in European Union. Some providers process data in other countries, including the United States. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we use a recognised safeguard: the EU-U.S. Data Privacy Framework (or its UK/Swiss extensions) where the recipient is certified, otherwise the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum or Swiss amendments where relevant, plus supplementary measures such as encryption in transit and at rest. You can request a copy of the relevant safeguards at hello@cetirisape.localhost.

6. How long we keep data

When the purpose ends we delete or irreversibly anonymise the data.

7. Security

We use technical and organisational measures appropriate to the risk: encryption in transit, encryption of sensitive data at rest, access control with least privilege, authentication safeguards, logging, backups, vulnerability management and staff confidentiality obligations. No system is perfectly secure. Please use a strong, unique password, enable multi-factor authentication where offered, and tell us right away at hello@cetirisape.localhost if you suspect your account was compromised. See also our Security & Vulnerability Disclosure page.

If a breach is likely to put your rights and freedoms at risk, we will notify the supervisory authority within 72 hours of becoming aware where required, and notify you without undue delay where the law requires it.

8. Children

The Services are not directed at children. You must be at least 16 years old to hold an account. We do not knowingly collect personal data from anyone under 16 (or the higher age of digital consent in their country; in the United States, under 13 for COPPA purposes). If you believe a child has given us personal data, contact hello@cetirisape.localhost and we will delete it and close the account. Where a parent or guardian has validly consented to use by a minor, that consent can be withdrawn at any time.

9. Third-party sites and services

The Services may link to or integrate with third-party sites, plug-ins and apps, including sign-in providers. We do not control them and are not responsible for their privacy practices; their own policies govern what they collect. Disconnect integrations in your account settings or in the third party's settings.

10. Your rights

Depending on where you live, you can:

• access your data and get a copy;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to processing, including direct marketing at any time;
• port your data to another provider in a machine-readable format;
• withdraw consent at any time;
• not be subject to solely automated decisions with legal or similarly significant effects;
• complain to a supervisory authority.

Deleting your account. You can delete your account and personal data in your account settings on our website, or by email; we do not require you to contact support if self-service is available. Deleting an account is permanent after the grace period we show you. Uninstalling an app does not delete your account.

To exercise a right, email hello@cetirisape.localhost or use the settings in your account. We may need to verify your identity and, if the request is manifestly unfounded or excessive, may charge a reasonable fee or decline, as the law permits. We respond within one month (extendable by up to two further months for complex requests; 45 days under US state laws, extendable by 45), and tell you the reason if we cannot comply. We will not discriminate against you for exercising your rights.

10.1 European Economic Area, United Kingdom, Switzerland

All the rights above apply. You may lodge a complaint with the authority in the country where you live, work or where the issue occurred (list of EEA authorities; UK: ICO; Switzerland: FDPIC). Our lead authority is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik).

10.2 Serbia

Where the Serbian Law on Personal Data Protection applies, you have rights equivalent to those above, and may complain to the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), www.poverenik.rs.

10.3 United States (California and other states)

This section supplements the above for residents of California and other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others as they take effect).

• Categories collected in the last 12 months: identifiers (name, email, IP address, online identifiers); customer records; commercial information (plans, purchases); internet or network activity; approximate geolocation and precise geolocation with your permission; content you submit; inferences limited to operating the Services. We disclose these to service providers for the business purposes in section 3.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioural advertising. We do not knowingly sell or share the data of anyone under 16.
• Sensitive personal information: we do not use it to infer characteristics, and do not use it beyond what is necessary to provide the Services.
• Your rights: know/access, delete, correct, portability, opt out of sale/sharing and of targeted advertising or profiling, limit use of sensitive data, and non-discrimination. We honour Global Privacy Control and similar browser opt-out signals as a valid opt-out request.
• Authorised agents and appeals: an authorised agent may submit requests with your written permission. If we deny a request, you may appeal by replying to our decision; if you remain dissatisfied you may contact your state attorney general.
• California: you can request a list of third parties to whom we disclosed personal information for their direct marketing in the previous calendar year ("Shine the Light"); we make no such disclosures. California residents under 18 who are registered users may request removal of content they posted publicly.

10.4 Brazil (LGPD)

You may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about the entities we share data with, information about the possibility of refusing consent and its consequences, and review of automated decisions. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

10.5 Other regions

If you are elsewhere with a data-protection law we honour the equivalent rights your law grants. In particular:

Grievance / privacy contact for all regions: hello@cetirisape.localhost, cetirisape (operator to be named), Address to be added. We acknowledge requests within 72 hours and resolve them within the time the applicable law allows.

11. Changes to this policy

We may update this policy to reflect changes in the Services or the law. For material changes we will give at least 30 days' notice by email or in the Services before they apply to you, and ask for fresh consent where the law requires it. The "last updated" date above shows the current version; earlier versions are available on request.

12. Contact

hello@cetirisape.localhost · cetirisape (operator to be named), Address to be added