Privacy policy

This policy explains what happens to personal data on the VauMjau website and app, and on the page that opens when someone scans a tag. It follows Serbia's Law on Personal Data Protection (Official Gazette of the Republic of Serbia No. 87/2018, the “ZZPL”). Buying in the shop has its own section, “Orders and complaints”.

Who processes your data

The controller is:

Name: PR Dušan Stepanov
Registered in: Novi Sad, Serbia
Company number (MB): 68209234
Tax ID (PIB): 115241012
Email: office@dusanstepanov.com

For any question about your data, write to office@dusanstepanov.com.

What we process and why

When you open a page

Data: IP address, time, page address, type of browser and device, as every browser sends them.
Purpose: to deliver the page to you and to protect the site from attacks and abuse.
Legal basis: legitimate interest (ZZPL art. 12(1)(6)). The site cannot work without this data.
Retention: Vercel, our host, keeps technical logs for one day.

Your cookie choice

Data: a random number, your choice (analytics and marketing, yes or no for each), the version of the text you saw, the language and the time. No name, email or IP address is recorded.
Purpose: so the site respects your choice and we can prove that you gave consent, as the ZZPL requires (art. 15).
Legal basis: the legal obligation to prove consent (ZZPL art. 15(1) and art. 12(1)(3)).
Retention: six months in your browser, and our record at most three years from your choice.

Analytics, only with your consent

We do not use Google Analytics yet. When we switch it on, the site will offer it in the cookie question, and this will apply:

Data: Google Analytics 4 records which pages you open, clicks on important buttons, your approximate location (city), and your type of device and browser. It uses cookies with a random number for this. Google Analytics 4 does not store IP addresses. In the shop it also records the steps of a purchase: viewing the tag, adding it to the cart, starting the checkout and the order, with its number and amount, without names or addresses.
Purpose: to see what helps people and what needs fixing. We do not use analytics for ads and do not build visitor profiles.
Legal basis: your consent (ZZPL art. 12(1)(1)). The cookies are set only once you agree, as the Law on Electronic Communications requires (art. 160).
Retention: Google keeps the data for 14 months.
Withdrawing consent: at any time, through “Cookie settings” at the bottom of every page. Analytics then switches off and its cookies are deleted.
The app and the finder page have no analytics.

Marketing, only with your consent

Data: the Meta Pixel tells Meta Platforms Ireland Limited which pages of the site you open and the steps of a purchase: viewing the tag, adding it to the cart, starting checkout and the order, with its amount in dinars. Your name, email, phone, address and order number do not go with it. Meta also receives your IP address, the type of device and browser and a random number from the _fbp cookie, and, when you come from an ad, the click label from the _fbc cookie. Pages whose address holds an order number or a gift code are not reported as visits.
Purpose: to measure and improve our ads on Facebook and Instagram: how many people from an ad look at the tag or order one, and to show the ads to people they can help.
Legal basis: your consent (ZZPL art. 12(1)(1)). The Pixel loads and its cookies are written only after you consent (Electronic Communications Act, art. 160).
Who is responsible: we are responsible together with Meta for collecting the data on the site and sending it to Meta; Meta alone is responsible for what it does with it afterwards, under its own privacy policy.
Retention: the _fbp and _fbc cookies last three months; Meta keeps the data under its own rules.
Withdrawing consent: at any time, through “Cookie settings” at the bottom of every page. The Pixel is then switched off and its cookies are deleted.
The Pixel runs only on the site's pages and in the steps of a purchase (cart, checkout, order). The rest of the app and the finder page do not have it.

Account and sign-in

Data: your email address, the first name or nickname you give when you make the account (you change it in Account), sign-in times and a session cookie. There is no password: you sign in with a code we email to you.
Purpose: so your pets and settings stay yours, so we can write to you about your tag, and so your neighbours in the Community know you by your name or nickname. The finder page shows it only if you switch that on yourself.
Legal basis: the service you asked for (contract, ZZPL art. 12(1)(2)).
Retention: while the account exists. An account for which nobody entered the emailed code is deleted after 24 hours.

How a finder can reach you

Data: the name a finder may see, your phone number, and what a finder may do: call you, message you on Viber or through the form.
Defaults: messages through the form are on; your name, calls and Viber are off until you switch them on. Your phone number is never printed on the finder page: the finder's phone gets it only when they press “Call the owner” or “Viber”.
Legal basis: contract, and your choice in the settings for what a finder sees.
Retention: while the account exists, or until you change them.

Pets, photos and health record

Data: species, name, call name, breed, sex, coat color, birth date or approximate age, description, a health note for finders, microchip number, the pet's color, photos and the health record (vaccinations, parasite protection, check-ups, weight).
Who sees it: only you. A finder sees only the fields you switch on and the pet's age; never the birth date or the microchip number. The profile photo is public, and so are the photos you mark.
Photos: your phone shrinks them before sending, and the server makes new versions without any metadata, so neither the place a photo was taken nor details of the phone remain. We do not keep the original.
Legal basis: contract.
Retention: until you delete them, or while the account exists. When you mark a pet as no longer with you, the profile stays for you only, and reminders, notifications and public photos stop.

When someone scans a tag

Data: the time of the scan and the finder's browser language. The finder page sets no cookie and loads no third-party scripts.
Purpose: to tell you right away that your tag was scanned.
Legal basis: our contract with you; for the finder, the legitimate interest in getting the pet home (ZZPL art. 12(1)(6)).
Retention: 12 months.

Finders' data

A finder is a person who scanned a tag or opened a lost pet's public page.

Message to the owner: the text and a contact, if the finder writes one. The owner gets them by email and sees them in the app. We keep them for 90 days, and while the pet is being searched for, up to 365 days. The legal basis is the legitimate interest in getting the pet back to its owner.
Location: only if the finder agrees, after reading what is sent. The finder chooses an exact or an approximate location (about 100 m, rounded by the phone itself). Only the owner sees it. We delete the coordinates 30 days after they were sent, and no later than 7 days after the search is closed; the record that the finder agreed stays as proof of consent. The legal basis is the finder's consent (ZZPL art. 12(1)(1)).
A location sent from home shows where the finder lives, so the page then recommends the approximate one.

The lost-pet search and the public page

Data: when the pet went missing, the city, the approximate area (a part of town, never an exact address), your message and reward, and the pet's details you switched on for finders. Your phone number only if you switch on calls from the public page.
Who sees it: anyone with the link. The page is not shown in search engines.
Retention: once the owner marks the pet as found (“Pronađen!”), the page shows only its name and that it is home for 30 days; then we delete the area, the message and the reward, and only the date and how the pet was found remain, for our statistics of pets returned.

Notifications

Data: what happened (a scan, a location, a message, a reminder from the health record, a birthday, the weekly summary, news from the Community), for which pet or post, when, and whether the email was sent.
Retention: 12 months.
The email with a location has a link that opens Google Maps; Google receives the point only when you open the link.
Notifications on your phone (push): only if you switch them on for the device. Your browser's push service (Apple, Google, Mozilla or Microsoft) delivers them, and what they say (the pet's name or the post's title, what happened, part of a comment with the name of whoever wrote it, and the address of the post's picture) is encrypted so that the service cannot read it. The phone downloads the picture from our picture storage, as the post's page does. We keep the subscription's address and the device's keys while the subscription works: they are deleted when you switch notifications off, sign out on that device, or the service refuses them.
Reminders from the health record: an email a week before a vaccine or parasite protection is due, only if you switch reminders on in the settings, and only for a pet with a tag. The legal basis is your consent (ZZPL art. 12(1)(1)). You withdraw it with the same switch, and a reminder still waiting is then not sent.

Content reports

Data: the page a report is about, the reason, an explanation and, if the sender gives them, their name and email.
Purpose: to remove unlawful content, as the Law on Electronic Commerce requires (art. 20).
Legal basis: a legal obligation and legitimate interest.
Retention: the sender's name and email for 12 months after the decision, and the report for 24 months.

Protection against abuse

Data: counters of attempts, for example how many sign-in codes or messages were sent. Instead of the IP address, a counter carries an encrypted label that changes every day, so it cannot be linked to the address or to earlier days.
Checking that a person sent a request: sign-in, the lost pet's public page, the forms on the “Kontakt” and “Za veterinare” pages and, when someone tries to guess codes or floods messages, the finder page use Cloudflare Turnstile, which receives the IP address and technical details of the browser.
Legal basis: the legitimate interest in a secure service.
Retention: counters for two days.

Orders and complaints

Data: your full name, phone and delivery address, your account's email, what you ordered (for which pet, the name on the tag and its color), prices, the payment method and payment reference, the payment, the parcel's number and the fiscal receipt. For a complaint, also what is wrong, what you ask for and our answer. The cart keeps the tags you chose until you order.
Purpose: to make and send the tag, take payment for it, issue the receipt and settle complaints. The emails about the order (confirmation, payment, dispatch, receipt, complaint) come with this.
Legal basis: performing the contract (ZZPL art. 12(1)(2)) and the trader's legal obligations, such as receipts, business books and the complaints register (ZZPL art. 12(1)(3)).
Retention: orders and receipts for as long as the accounting and tax rules require, even after you delete your account; complaints for at least two years (Consumer Protection Law, art. 63); records of sent emails for 12 months.

When you email us or use a form

Data: your email address, your name if you give it, and the content of the message; through the form for vets also the clinic's name, the town and a phone number if you give one. A form's message reaches us by email, and the site does not keep it.
Purpose: to reply to you.
Legal basis: legitimate interest, and when you ask about a tag or an order, steps before a contract at your request (ZZPL art. 12(1)(2)).
Retention: for the length of the correspondence and one more year, then we delete the messages.

The community (neighbourhood)

Data: the city you pick for the community and whether you want its alerts; the posts you write (kind, title, text, part of town, pictures, the pet with the post, time), comments and replies, a picture with a comment, sightings of a lost pet (when and the part of town), "Helps", "Like" and "Going", the best answer to your question and the posts you follow; when you accepted the community's rules; the phone number from your account only on a post where you switch it on yourself; a ban for a while if you break the rules; a kennel's name and number if you report them.
Who sees it: posts and comments in the community are public: anyone sees them on the city's page, with your name or nickname (older posts without one as "Pet owner"), a comment with a small picture showing only the kind and colour of your first pet, the name and public photo of the pet with the post, and the part of town. Your city, your phone number, the posts you follow and who said "Helps" are not public; the number is shown only to signed-in owners, on that post, and that is counted. A warning is marked as not yet verified until we check it.
Purpose: so owners from the same city tell each other who is being looked for, who was found and where it is dangerous, ask and arrange a walk; to tell you when a pet goes missing, is found or a warning appears in your city, when someone comments on your post or replies to your comment, and of new comments on a post you follow (on your phone at most once in 15 minutes per post); a lost pet's owner hears of every sighting at once, and when the pet is home, everyone who looked for it hears so. All of it comes in the app and on your phone, never by email; you switch the city's news off in the Community ("Your city"), and following a post with the button on it.
Legal basis: performance of the contract (ZZPL art. 12 par. 1 item 2) for posts and the alerts you switched on; legitimate interest (art. 12 par. 1 item 6) for hiding content, bans and protection against abuse.
Retention: found pets and mating ads 60 days (you can extend), warnings 30 days, a walk until the day after, questions and posts until you close them; a closed post stays visible 30 more days, and a deleted one leaves the feed at once and the database after 90 days. A lost pet's post follows the lost report. Following a post lasts while the post exists or until you switch it off. Deleting your account deletes all your posts, comments and pictures.

Danas: your pet's day

Data: what we already know about the pet (species, breed from the list or in your own words, a mixed dog's size, sex, neutering, date of birth and the day it came home, entries in the health record, the latest weight), the city you picked for the community, the topics you switched off, and what happened with the cards: when each was shown, "Urađeno", "Ne danas", "Ne prikazuj više" and "Korisno?". Also the day the app was last opened: that one date only, without a history.
Purpose: so the app's home shows what matters for your pet today, does not show you the same thing again, and so we know how many people really use the app. The app chooses the cards from this data by the same rules for everyone; this has no legal effect on you and does not affect your rights, prices or what you can use.
Notifications: a birthday and the anniversary of coming home at 9 am, and the weekly summary on Monday mornings, in the app and on your phone when notifications are on for the device, never by email and never with an offer. You switch them off in Nalog, under "Danas". A pet that is no longer with you gets no cards and no greetings.
Legal basis: performance of the contract (ZZPL art. 12 par. 1 item 2) for the cards and notifications you use; legitimate interest (art. 12 par. 1 item 6) for the day the app was last opened.
Retention: what happened with the cards, while the pet and the account exist; the day the app was last opened, while the account exists; notifications 12 months.

Deleting your account

You can delete your account in the app's settings. We then delete the account, the pets, the photos, the health record, the scans, the messages and the notifications. Database backups are kept for seven days, so the data leaves them when they expire. Orders, receipts and complaints stay for as long as the law requires, no longer linked to the account.

What we do not do

We do not sell your data. For ads, Meta receives only the Meta Pixel's data, and only with your separate consent.
Advertising cookies and pixels never run without your consent, and never in the app outside the steps of a purchase or on the finder page.
We make no automated decisions that have a legal effect on you (ZZPL art. 38). The app chooses the Danas cards from your pet's data only to make them useful to you; they do not affect your rights or prices, and we build no profiles for advertising.
We never publish an owner's exact address, anywhere.

Who else receives data

These service providers process data for us. Each uses it only on our instructions and only for the work it does for us.

Provider	What it does for us	Where
Vercel Inc.	hosting the site and the app	USA; the server side of the site runs in Frankfurt (Germany)
Supabase Inc.	the database, accounts and photos	Frankfurt (Germany)
Resend Inc.	sending emails: sign-in codes, notifications and orders	USA and EU
Cloudflare, Inc.	Turnstile, checking that a person sent a request	USA and a worldwide network of data centers
Google	Google Analytics, only with your consent	EU and USA
Apple, Google, Mozilla, Microsoft	delivering notifications to your phone, only if you switch them on	USA and EU
Email service providers	forwarding and storing the messages you send us	EU and USA

Meta Platforms Ireland Limited receives the Meta Pixel's data only with your consent (see “Marketing, only with your consent”). It does not process the data on our instructions but as an independent controller, under its own privacy policy.

For delivery, the courier we have a contract with gets your name, address, phone and the cash-on-delivery amount. An IPS payment is handled by your bank and ours, under the payment rules.

We give data to public authorities only when the law requires it.

Transfers out of Serbia

Some providers are American companies and may process data in the USA. Vercel, Google and Meta take part in the EU–US Data Privacy Framework, which the European Union has found to ensure an adequate level of protection, so the ZZPL allows such transfers (art. 64(2)). For other providers, a transfer relies on that framework when the provider takes part in it, and otherwise on contractual safeguards (ZZPL art. 65).

Your rights

Under the ZZPL you have the right:

to find out whether we process your data and to get a copy (art. 26);
to have inaccurate data corrected or completed (art. 29);
to have it deleted (art. 30);
to restrict its processing (art. 31);
to get it in a common electronic format and pass it to someone else (art. 36);
to object to processing based on legitimate interest (art. 37);
to withdraw consent at any time, without affecting processing before the withdrawal (art. 15(3)).

You change and delete most of your data yourself, in the app. For anything else, send your request to office@dusanstepanov.com. We reply without delay, and within 30 days at the latest (art. 21(3)).

If you believe that the processing of your data breaks the law, you have the right to complain to the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, poverenik.rs (art. 82).

Security

The site and the app work only over an encrypted connection (HTTPS).
Every account sees only its own data; the database itself checks this for every query.
We keep only the data we really need, and only for as long as stated.
If a data breach happens, we notify the Commissioner within 72 hours of learning about it, and you without delay when the breach may seriously put your rights at risk (ZZPL art. 52 and 53).

Minors

The site and the app are meant for pet owners. If you are under 15, an account and analytics need a parent's consent (ZZPL art. 16), so ask a parent before you use them.

Changes to this policy

When we change the policy, we change the date at the top of the page. We announce important changes on the site and in the app before they take effect. The Serbian text applies. More about cookies is in the Cookie policy.