Privacy notice

1 Who is responsible

Dealisa is run by one person in his own name. Under the Serbian Law on Personal Data Protection, and under the GDPR if you live in the European Union, he is the controller of your data: the one who decides what is collected and why, and the one you write to about it.

There is no data protection officer; the service is too small for the law to require one.

2 What we collect and why

Nothing is collected for advertising, and nothing is sold. You are never asked to fill in a form: your agent asks for what it needs as you go.

Nothing on a card may carry contact details; a phone number or an address belongs in a deal room, once you choose to share it there.

3 What the AI does with it

Your agent is a language model, Google's Gemini. Every turn sends your conversation with it, and your card, to Google's paid API, which writes the reply and keeps the card true; your listing text is also turned into a list of numbers that captures its meaning, so that fitting needs and offers can be found. Under the terms of that paid API, Google does not use what we send to train its models, and keeps it only to run the request.

Matching proposes fitting cards, and a judge model sets aside a pair whose cards contradict each other. Both run automatically and neither has a legal effect on you: a pass costs nothing, a pair may come back when a card changes, and nothing is ever agreed by a model. Only your own confirmation saves a listing, and only your own lock agrees a deal.

4 Who sees what

Your conversation with your agent, your summary card, your rates, your budget and everything else you tell it are private to you.

• When a match brings you together, another member sees your match card and nothing else: a short description of your offer or need, its title, what you do or what you need, and the area, with your display name shortened to your first name and an initial.
• A deal room does not change that: what the other side reads there is what you write there yourself.
• Your email address and your phone number are shown only to you, unless you write them in a room.

The operator can read the database, as anyone who runs a service can, and does so only to run it: to fix a fault, to answer your request or to act on abuse.

5 Connected assistants

You can connect an AI assistant of your own by creating an access token in the app with the permissions you choose and, for anything that commits money, a spending cap. The assistant reads what those permissions allow, and what it does is done in your name. Its provider holds a copy of what it read under its own privacy terms, not ours; connect only one you trust. You can revoke a token at any time, and a revoked token reads nothing more.

6 Who processes it for us, and where

We run nothing on hardware of our own. These companies process your data on our behalf, under contracts that bind them to our instructions:

• Google Cloud: hosting, the database and the logs, in Google's data centres in the European Union.
• Firebase, a Google service: your sign-in, the delivery of notifications, and the crash reports and usage statistics of the Android and iOS apps.
• Google's Gemini API: the language model behind your agent and the matching.
• Apple: Sign in with Apple, when you choose it, and the relay address that hides your email.
• Cloudflare: the edge in front of everything, which serves the site, blocks abuse, sends the sign-in codes to your email and counts visits; it sees every request and keeps short logs.
• Google Fonts: the site and the app load their typefaces from Google, so your IP address reaches Google when a page loads.

Google may process a request in the United States under its standard contractual clauses, the safeguard Serbia's law accepts for a transfer outside the European Union. An assistant you connect is your processor, not ours. If a processor is added or changed, this notice gets a new version and the change log says so.

7 How long we keep it

For as long as your account exists: your messages are the record your cards and your deals are built from. When you close your account, your profile, your conversations with your agent and the private rows of your cards are deleted; what you wrote in a deal room and the deal's events stay with the other member without your name, and what you reported to your agent stays without your name. Technical logs, crash reports and usage statistics are kept for up to three months, a sign-in code for an hour, and database backups for seven days.

8 Your rights

You can ask us at any time:

1. to see what we hold about you, and to get a copy of it;
2. to correct what is wrong: your display name, phone and time zone you change yourself in the app, and your card by replying to your agent;
3. to delete your account and your data, within the limits of section 7;
4. to restrict, or object to, a processing that rests on our legitimate interest;
5. to receive the data you gave us in a form you can take elsewhere;
6. to withdraw a consent: for notifications, by turning them off.

Write to support@dealisa.app from the email address of your account. We answer within thirty days, in the language you wrote in. If you are not satisfied, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or, if you live in the European Union, to the supervisory authority of your country.

9 On your device

The web app keeps your sign-in, the registration for notifications if you allowed them, and its own small settings in your browser's storage; neither the site nor the app sets a cookie for advertising or analytics. The Android and iOS apps keep your sign-in the same way, plus an identifier of the installation for crash reports and usage statistics; the advertising identifier of your phone is never read. Clearing the site's data in your browser, or uninstalling the app, removes all of it.

10 Security

Every connection is encrypted, the database is encrypted at rest, and access is limited to the operator. There is no password of yours for anyone to steal from us. If a breach ever affects your data, we tell you and the Commissioner as the law requires.

11 Minors

Dealisa is for adults. You must be at least eighteen to have an account; an account of someone younger is closed and its data deleted.

12 Changes to this notice

Each version carries its effective date at the top, and the change log at the end says what changed. You accept the version the app shows you before your first message, and we record which one. A change that matters to you is shown in the app again before it takes effect.

13 Contact

Write to support@dealisa.app for anything about your data, this notice or the service. Postal address on request.