Privacy policy
Effective from 11 October 2026
This policy explains which personal data Deoba processes, why, for how long and what your rights are. It follows the Serbian Law on Personal Data Protection ("Official Gazette of RS", No. 87/2018) and, for users in the European Union, the General Data Protection Regulation (GDPR).
1. Controller
The controller is [naziv firme], [adresa], tax ID (PIB) [PIB], registration number (MB) [MB]. Send any question about your data to [e-mail].
2. Two roles
- Data about you as a user (your account, sign-in, communication): the provider is the controller and this policy applies.
- Data you enter about others (team members, clients' contact persons, time records): the business using Deoba is the controller, and the provider processes the data only on its behalf, as described in section 6 of the Terms of use. If you are a team member or a contact person, contact that business about your rights; we will help it respond.
3. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (only its hash is stored), language, time zone | Opening and running the account, signing in | Performance of the contract (Terms of use) |
| If you sign in with Google or GitHub: your name, email and that account's ID | Signing in without a password | Performance of the contract |
| Date and time you accepted the terms | Proof of acceptance | Legitimate interest |
| IP address and browser details in sessions and server logs | Security, preventing abuse, fixing errors | Legitimate interest |
| On the sign-up, sign-in and forgot password forms: IP address, browser details and on-page behaviour collected by Google reCAPTCHA | Protection against automated attacks (bots) | Legitimate interest |
| Emails you send us | Answering and support | Performance of the contract, legitimate interest |
| Notifications we send you (address verification, password changes, invites, exports) | Running the service | Performance of the contract |
We don't use data for advertising, don't sell it and don't profile users. We make no automated decisions that have legal effects on you.
4. Cookies
Deoba only uses cookies it needs to work: the session and form protection (CSRF), your chosen language, theme and sidebar state. On the sign-up, sign-in and forgot password forms, Google reCAPTCHA sets its own cookies to protect against bots. We use no analytics or advertising cookies, so we don't ask for consent to them.
5. Who else processes data
The following sub-processors process data under a contract with the provider:
- Contabo GmbH: servers and data storage; Germany (EU)
- Functional Software, Inc. (Sentry): tracking errors in the app, without user details; Germany (EU)
We send emails through our own mail server, with no third party involved.
When you send an invoice to SEF, Deoba sends it to the Ministry of Finance on your behalf, with your API key. Deoba fetches exchange rates without sending any personal data. When you sign in with Google or GitHub, they handle that sign-in as separate controllers, under their own privacy policies. The sign-up, sign-in and forgot password forms are protected by Google reCAPTCHA (Google Ireland Limited and Google LLC), under Google's privacy policy.
6. Transfers out of Serbia
Data is stored in the European Union. EU member states are deemed to provide an adequate level of personal data protection (Article 64 of the Law on Personal Data Protection), so no special approval is needed for the transfer. Google reCAPTCHA may transfer data from the sign-in forms to the USA, under the safeguards in Google's terms.
7. How long we keep data
- Account data is kept while the account exists. When the owner deletes the account, the data is deleted at once, and from backups within 30 days.
- When a user is removed from a team, their time records stay in the business's account as part of its business records.
- Data exports are kept for 7 days and then deleted.
- Sessions expire after inactivity, and server logs are deleted within 30 days.
8. Security
Data is sent over an encrypted connection (HTTPS), passwords are stored as hashes, and only authorised people can access the servers. Each business's data is kept separate from other businesses' data.
9. Your rights
You have the right to:
- be informed and get a copy of the data we process about you;
- correct inaccurate data (you can change most of it yourself in your profile);
- ask for your data to be deleted (the owner can delete the account in Settings);
- ask for processing to be restricted and for data portability (the owner can download an export);
- object to processing based on legitimate interest.
Send your request to [e-mail]. We will answer within 30 days.
If you think the processing is unlawful, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs), and, if you are in the EU, to your country's supervisory authority.
10. Changes
We will tell you about material changes to this policy by email or in the app before they take effect. The effective date is always shown at the top.