Privacy policy

This policy explains what personal data Zakaži collects when you use our app and website, why we process it, who we share it with, and what rights you have. It is written to be readable – if anything is unclear, write to us.

1. Who the controller is

The data controller is Stevan Tošić pr ST-TECH, Stojana Protića 22/2, 34000 Kragujevac, company number 67993195, tax number 114971551.

For any question about how your data is handled: support@tryzakazi.com.

It matters that there are two controllers when you book an appointment:

• Zakaži – processes your account and bookings so the platform works.
• The salon you book with – independently decides what it does with your data as its own client (client records, internal notes, communication). The salon answers for that processing itself, under its own privacy policy.

There is a third case, described in section 7: when a salon enters your details itself and you have never used the app. There the salon is the controller and Zakaži is only a processor – we store and display the data on the salon’s instructions and never use it for our own purposes.

2. What data we collect

Data you give us

• Account data: your name, phone number, email address, your password in encrypted form, and a profile picture if you set one.
• If you sign in with Google: your Google account identifier, and the name and email address Google passes to us. We never receive or store your password in that case.
• Booking data: the salon, the service, the staff member you chose, the date and time, and the note you leave with a booking.
• Anything you send us when you contact support.
• The email address you leave on the waiting list while the app is not yet available, together with the language of the page you left it on and the moment you did so.

Data created by using the service

• Your history of bookings, cancellations and changes.
• The salons you have saved as yours, and the order you put them in.
• The notifications we have sent you and whether you read them.
• Data about the device where you enabled notifications: the delivery token, the platform (iOS or Android), the language and a random installation identifier.
• Technical data created by every call to our server: IP address, app and operating system version, device language, and error logs.
• If you use the Zakaži assistant: your conversation with it, described in section 5.
• If you own a salon: your selected subscription plan, billing country, subscription status, transaction and invoice references, and amounts needed to provide and support billing.

What we do not collect

• We neither ask for nor store full payment card details. Clients pay salons directly; salon owners enter card details in Paddle’s secure payment form for the business subscription.
• We do not collect health data or other special categories of personal data. If you type such information into the booking note yourself, it will be visible to the salon you are booking with.
• The app currently contains no behavioural analytics and no advertising tooling of any kind. We do not track you through the app, we build no profile of you, and we share nothing with ad networks.

3. Permissions the app asks for

The app asks for no permission up front. Each one is requested only at the moment you start an action that needs it, and you can refuse any of them – the rest of the app carries on working.

Permission	When we ask	What we do with it
Location	When you choose “nearby” in search	Your coordinates go with that single request so we can measure how far each salon is and order the results. We do not store them against your account.
Photos	When you pick a profile picture	We open your library so you can choose one image. The app does not access the rest of your library.
Camera	Never	Camera access is disabled in the app itself. A profile picture can only be chosen from your library.
Calendar	Only when you tap “Add to calendar” yourself	We write a single event with the appointment details. The app has no right to read your calendar.
Microphone	Only while you hold the voice message button	A recording lasts at most 60 seconds and is used solely to be turned into text. Details in section 5.
Notifications	When you turn on appointment notifications	We store your device token so we can send you the confirmation and the reminder for your appointment.
Motion (iOS)	Never	The system requires us to describe this permission because it is tied to the location component, but the app never requests it and never reads motion data.
Reminders (iOS)	Never	The same as above – the permission exists because of the system calendar component, but it is never requested.

A few things we deliberately do not do, though we could:

• We do not track your location in the background. Background location is switched off on both platforms.
• We do not read your calendar. On Android the calendar read and write permissions are explicitly blocked in the app, and “Add to calendar” there opens Google Calendar, which asks for your confirmation itself.
• The microphone never turns itself on. Recording lasts exactly as long as you hold the button, and you can see it on screen while it runs.

You can withdraw any permission at any time in your phone’s settings.

4. App updates

The app occasionally downloads fixes through the Expo update service. That check sends only technical data about the version and platform, with nothing about your account.

5. The Zakaži assistant

At salons that enable it, the app offers a booking assistant you talk to in ordinary sentences instead of working through forms. If the salon you are booking with has no assistant, nothing in this section applies to you.

What is processed

• The messages you write to the assistant and the replies it sends you.
• The salon data needed to answer: the list of services, staff and free slots.
• The draft booking the two of you assemble before you confirm it.
• If you send a voice message: the audio recording, only until it has been turned into text.

Who processes it

For the assistant to work, we pass the content of the conversation to OpenAI, which processes the text for us and turns voice messages into text. OpenAI processes the data on our instructions, under the terms that apply to business use of its service, which provide that the content we send is not used to train its models. The transfer goes to the United States, covered in section 10.

What is stored

We keep your conversation with the assistant on our servers so the conversation can continue and so we can check what happened if a booking does not go through. Alongside it we keep a technical record of each call to the assistant – time, model, usage and a short excerpt of the question and answer – for cost control and debugging.

Voice messages

The recording is held briefly in your phone’s cache, sent to our server and from there for speech recognition. Once it has been turned into text, the recording is deleted both from your phone and from our server – we keep only the recognised text, as though you had typed it. The speech recognition provider may hold the recording briefly, to prevent abuse of its own service. The recording never reaches the salon.

You can end your conversation with the assistant and start a new one at any time, from the conversation itself. The previous conversation then stops being used, but it stays stored on our servers – if you want it deleted too, write to us at support@tryzakazi.com. If you would rather not use the assistant, you can always book the classic way, through the service and slot screens.

6. What the salon sees about you

The salon you book with reaches its own slice of the data through the business dashboard. There it sees:

• Your name, phone number, email address and profile picture, so it knows who is coming and can reach you.
• Your full appointment history at that salon: services, staff member, dates, amounts and the status of each appointment.
• The note you left with a booking.
• An internal note the salon writes about you as its own client. Only that salon writes and sees this note; you do not see it in the app and Zakaži does not use it for anything.
• Aggregate statistics – how many times you have come, how many times you cancelled, and so on.

A salon sees only the appointments and data belonging to that salon. No salon can see that you are a client of another salon, nor your appointments there.

For everything a salon does with that data as its own business data – internal notes, its own communication, marketing – the salon answers itself, as an independent controller.

7. If the salon added you itself

A salon can enter a client by hand, for instance when you walk in or book by phone. In that case the salon enters your name and, if you give them, your phone number and email address – and you have no account with us and have never used the app.

For that data the salon is the controller and Zakaži is only a processor. We store and display it solely on the salon’s instructions, we send you nothing, and we use it for none of our own purposes.

So in that case you go to the salon, not to us, to access, correct or delete the data. If you write to us instead, we will pass the request on to the salon and help where we can.

8. Why we process data, and on what legal basis

Purpose	Legal basis
Opening and running your account, booking and cancelling	Performance of a contract
Sending appointment confirmations and reminders	Performance of a contract
Running the Zakaži assistant, when you use it	Performance of a contract
Managing business subscriptions and billing records	Performance of a contract and legal obligation
Customer support	Performance of a contract and legitimate interest
Security, abuse prevention and fixing faults	Legitimate interest
Access to location, calendar, photo library and microphone	Consent
Sending push notifications	Consent
Telling you the app is available, if you are on the waiting list	Consent
Meeting legal obligations	Legal obligation

You can withdraw consent at any time, in your phone’s or the app’s settings. Withdrawing it does not affect the lawfulness of processing carried out beforehand.

9. Who we share data with

• The salon you book with – receives the data listed in section 6. That is the point of the service: the salon has to know who is coming and for what.

• Service providers working for us (processors):

  • Cloudflare – website hosting, protection, aggregate traffic and performance analytics, and recording clicks on the website;
  • hosting and database providers – the servers that run the app and its database, in the European Union;
  • Expo – the service we send push notifications through, together with Apple’s and Google’s services for delivering them to your phone;
  • Google – sign-in with a Google account, if you use it;
  • OpenAI – running the Zakaži assistant, if you use it (section 5);
  • email delivery, for instance for password resets.

  All of them process the data solely on our instructions and under a contract that binds them to it.

• Paddle – handles subscription checkout, payments, invoices and refunds for salon owners. We share the owner and billing details needed for those functions; Paddle handles card details in its own secure form.

• Competent authorities – where we are legally required to.

We do not sell personal data and we do not pass it to third parties for their own marketing.

10. Transfers outside the Republic of Serbia

Some of our providers process data outside the Republic of Serbia. For the Zakaži assistant, data is transferred to the United States (OpenAI), and notification delivery and Google sign-in likewise involve providers based in the US. Our servers and database are in the European Union, in Frankfurt (Germany), as is most of the remaining infrastructure.

We make such a transfer only where an adequate level of protection is in place – to countries recognised as providing adequate protection, or under standard contractual clauses.

11. How long we keep data

• Account data: for as long as the account exists. What happens after deletion is set out in section 12.
• Booking history: up to 5 years, because it serves both you and the salon as a record of the service provided.
• Conversations with the assistant, and the technical record of its calls: these stay stored even after you delete your account. We delete them on request.
• Business subscription and payment records: retained for as long as required to handle billing, disputes and legal obligations, including after account deletion.
• Error logs and server technical logs: up to 12 months.
• Voice recordings: deleted as soon as the text has been recognised.
• A waiting-list address: until we send the notice that the app is available, or until you ask us to delete it, whichever comes first. We delete it immediately afterwards.
• Data we are required by law to keep: for as long as the law requires.

Once those periods pass we delete the data or anonymise it permanently.

12. Deleting your account

You can delete your account yourself, from the app’s settings. It requires an explicit confirmation, and deletion is permanent and cannot be undone. Here is exactly what happens.

Permanently deleted

• Your profile picture, from the server and from file storage.
• Every device you received notifications on, and the whole history of notifications sent to you.
• Every salon you had saved as yours.
• Every internal note salons had written about you.
• The notes you left with your appointments.
• Every signed-in session and every password reset request.

Anonymised

Your account is signed out and your name, email, phone number and Google account link are irreversibly replaced with meaningless values. The same happens to the client record at every salon you booked with: the name, phone and email are cleared, and the record stops being tied to you.

What remains

The appointments themselves stay in the salon’s records, but with nothing that identifies you – the salon is left with the fact that a service was performed that day, not with who the client was. The salon needs that record for its bookkeeping and statistics, and we need it for our legal obligations. In practice, after deletion the salon sees an appointment with no name, no contact details and no notes.

Your conversation with the Zakaži assistant also remains, if you used it, together with the technical record of its calls. Deleting your account does not currently remove it automatically. Write to us at support@tryzakazi.com and we will delete it.

If you owned a salon, subscription and invoice records may also remain for billing and legal obligations. Before deleting your account, we request cancellation of any remaining subscriptions. If Paddle cannot confirm cancellation, we keep the account open and ask you to retry or contact support@tryzakazi.com.

If you would rather not delete the whole account, you can act piece by piece: remove your profile picture, turn off notifications for a device, remove a salon from yours, or end your conversation with the assistant.

13. Your rights

Under the Personal Data Protection Act you have the right to:

• access – a copy of the data we process about you;
• rectification of inaccurate data and completion of incomplete data;
• erasure, where there is no longer a basis for processing;
• restriction of processing;
• portability – to receive your data in a machine-readable form;
• object to processing based on legitimate interest;
• withdraw consent at any time.

Send your request to support@tryzakazi.com. We answer within 30 days at the latest. For data a salon entered about you itself, contact the salon – see section 7.

If you believe we are processing data unlawfully, you have the right to complain to the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade.

14. Cookies and analytics

On this website we use only the cookies strictly necessary for it to work, such as remembering whether you chose the light or the dark theme. That setting stays in your browser and never reaches us.

The website uses Cloudflare Web Analytics to measure aggregate traffic and page performance. It records information such as the visited path, referral source, approximate country, device type, browser, operating system and page-load performance metrics. This tool uses neither cookies nor browser local storage, does not fingerprint devices and does not build profiles of individual visitors. Measurements are sent to Cloudflare through our own domain. The website contains no advertising scripts.

We also record what is clicked on the website: which link or button, on which page and in which part of it, together with the page language, approximate country and time. This is stored in our own database, hosted by Cloudflare. It uses no cookies or browser local storage, we store no IP address or device details, and we do not link clicks to you or to one another, so we cannot tell whose clicks are whose. Anything you type into a form field is never recorded.

15. Messages we send you

The messages you get from us relate to your appointments: a booking confirmation, a reminder before the appointment, notice that the salon has changed or cancelled something, and occasionally a message about the account itself, such as a password reset. These are service messages – they are part of the service and are sent for as long as you have an account and appointments booked.

We send no marketing messages. We keep no promotional mailing list, we do not sell or pass on your address or phone number for that purpose, and we do not send you offers from other salons. If we ever introduce any of this, we will ask for your consent first and give you a way to withdraw it in one tap.

The waiting list is the one exception, and you are on it because you asked to be. While the app is not yet available you can leave an email address on the site so we can tell you when it is. We use that address for that one message and nothing else: we add it to no other list, we pass it to nobody, and we delete it once the notice has gone out. If you change your mind before then, write to support@tryzakazi.com and we delete it straight away.

You can turn push notifications off at any time, in your phone’s or the app’s settings. That switches off appointment reminders too, so tracking your appointments is then up to you, in the app.

16. Children

The service is not intended for anyone under 15 and we do not knowingly collect their data. If we learn that we have collected such data without a parent’s or guardian’s consent, we delete it.

17. Security

We transmit data only over an encrypted connection, we store passwords in encrypted form, and we restrict access to the people who need it to do their work. Each salon sees only its own clients and its own appointments, and that separation is built into the system rather than into a setting. No measure is absolute, but we treat your data as we treat our own.

18. Changes to this policy

We may change this policy. The date of the last change is shown at the top of the page, and we will tell you about significant changes in the app or by email before they take effect.

19. Contact

Stevan Tošić pr ST-TECH Stojana Protića 22/2, 34000 Kragujevac support@tryzakazi.com