Privacy Policy

1. Scope and contact

The controller is the operator identified above. Use kontakt@sapicaapp.rs or its postal address for privacy questions and requests. This support and privacy contact does not imply that a formal data protection officer has been appointed.

This policy covers information processed through the sapicaapp.rs website, the Šapica mobile application for Android and iOS, accounts and support contact. Bookings and payments are not currently open. Descriptions of data associated with future walks apply only when the relevant feature becomes available and you use it.

2. Data we process and its sources

Walker applications require your own RSD current account number at a Serbian bank to prepare future earnings payouts. It is stored encrypted, is not part of your public profile and is available to you and authorised operator personnel; when a payout is made, it is provided to the bank or payment provider as necessary. We do not collect a PIN or CVV through this application. The information is retained while needed for engagement and payouts, subject to the retention rules below.

You provide your name, email, password stored as a hash, account role and information entered in your profile or sent to support. On new registrations, we record the 18+ declaration time, acceptance time and terms version; that step does not collect your date of birth or an identity document.

Dog profiles include a name, optional photo, breed, age, sex, size, behaviour and description. Walker profiles may include a name, photo, city and municipality, contact phone, experience description, availability and price. Do not enter other people’s information without an appropriate basis.

Technical processing includes IP addresses, browser, request, login, session and error information needed to operate and protect the system. We also receive information supplied by other users about particular events in reports or reviews.

The mobile application uses a sign-in access token stored in secure device storage and sends the device model name on sign-in or registration. If you allow notifications, we process an Expo push token, device platform and model name to send notifications; you can change permission in your phone settings. Photos are selected or captured only for a feature you request. You select the city and area manually; the first Android closed-testing version has no GPS tracking and does not request GPS permissions.

Uploaded photos may also contain information previously written into the file by the device, such as the capture time or location, if it has not been removed from the photo. This is not active GPS tracking by the application. You can remove location metadata using your photo tool before uploading; do not upload unnecessary personal information.

When walk features become available, processing may include times, handover locations, participants, messages, statuses, walk photos and reviews. GPS tracking in a future version will relate to an active walk and require a separate explanation and the relevant permissions, including background location when needed. Ordinary website browsing and manually choosing a city are not GPS tracking.

3. Purposes and legal bases

Creating and maintaining accounts, verifying email, recovering access and providing requested functions serve the platform agreement or steps you request before entering it. An account cannot be created without required information; a dog photo is optional.

Account and system security, fraud prevention, investigating reports and establishing legal claims may rely on legitimate interests, subject to assessing necessity and the effect on your rights. You may object to such processing. Compliance with legal requirements relies on the relevant legal obligation.

Where processing relies on consent, it is requested separately and may be withdrawn for the future. Withdrawal does not affect the lawfulness of earlier processing. Registration is not consent to marketing; verification, security and account operation messages have an operational purpose.

4. Visibility and recipients

Published walker profiles and public reviews can be seen by visitors and search engines. Publishing a profile is not private correspondence. Do not place your home address or other private information in a public description.

Dog photos are not a public gallery: the application restricts access to the owner and the assigned walker for the relevant booking. When walks are available, information needed to arrange and perform the service is shared with the other participant, not all users.

Authorised operator personnel may access information for support and maintenance. We use Laravel Cloud for hosting, databases and storage, and Resend for email delivery. When automatic translation is enabled, application message and note text is sent to Google Cloud Translation for translation; the original and translation are stored with the application. When enabled address suggestions are used, Geoapify processes the entered query. Mobile push notifications use Expo when you enable them.

Data may be disclosed to competent authorities on a legal basis or to protect legal claims. We do not publish card information and currently do not collect it through active online payments. Users will be informed about the payment processor before it is enabled.

5. Processing outside Serbia

Hosting and email delivery use international providers. The selected application and database region is Frankfurt and the email service region is Ireland; this does not mean all processing, support, logs and subcontractors are exclusively in those regions. Object storage uses global infrastructure.

Transfers outside Serbia are subject to applicable international transfer rules. Contact us for information about particular recipients, countries, the basis used and safeguards. This policy itself does not replace processor agreements or another necessary transfer basis.

6. How long information is kept

Account and profile information is kept while the account is active and it is needed for its functions. On closure or an erasure request, we assess what should be deleted and what must be retained on a limited basis for a legal obligation, unresolved complaint or legal claim.

Retention of correspondence, reports, terms acceptance and security records is determined by the purpose, length of proceedings and applicable statutory periods. Backups may temporarily retain earlier data until their cycle expires; account deletion does not instantly remove every copy from every supplier system.

You may request the retention period or criteria for particular data. We do not ask for identity document copies during ordinary registration; do not send them to support without a previously explained necessity and secure procedure.

7. Deleting your Šapica account and associated data

In the mobile application, open Profile, select Delete account, enter your current password and confirm deletion. On the website, the deletion option is in account settings. Deletion is available even if the account email has not yet been verified.

You can also request deletion without installing the application or signing in to the website: email kontakt@sapicaapp.rs from the address linked to your account with the subject “Delete Šapica account”, stating that you want your account and associated data deleted. If you cannot access that email address, contact support for proportionate verification that the account belongs to you. Do not send your password, PIN, CVV or a copy of an identity document.

Deletion removes the active account, access and push tokens, linked profiles, payout account number, walker application and its correspondence, and private photographs associated with the account. Limited retention of security records, backups and information held by service providers is explained in the retention section; account deletion does not instantly remove every backup copy. Support requests follow the procedure and time limits in the section about your rights.

Reports involve processing the reason, your description, participant identifiers, a copy of the reported content, and moderation decisions. Reports are not shown to the reported user. Blocks are stored to prevent contact. Limited safety records may remain after account deletion for an open case or legal claim, according to the retention criteria in this policy.

8. Cookies and browser settings

The website uses technical cookies and related mechanisms for sessions, login, form protection and language selection. Duration depends on the cookie and session settings; a remember-me option, if selected, may last longer than one visit.

This website version does not embed marketing pixels or visitor analytics tools such as Google Analytics. Hosting operational and security logs are not advertising tracking. Future optional tracking will be explained and a choice offered before activation where consent is required.

You can inspect, delete or block cookies in your browser settings. Blocking necessary cookies may prevent login and form submission. Merely opening the website is not consent to marketing cookies.

9. Your rights and making a request

Subject to applicable conditions, you have rights to information and access, rectification, erasure, restriction, portability and objection, and to withdraw consent when it is the basis. Email kontakt@sapicaapp.rs with the account email and your request, without passwords or document copies.

Proportionate identity confirmation may be needed to protect your information, preferably through your account or existing contact. Requests are answered without undue delay and within 30 days; a lawful extension of up to a further 60 days requires notification of the reasons within the first 30 days.

You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection and seek judicial protection. You need not waive these rights or first complete a support procedure.

English and Russian translations assist understanding but do not by themselves determine whether foreign law applies. If additional mandatory rights apply to your situation, including under EU or California law, this policy does not limit them. Applicability depends on the actual legal conditions, not merely the website language.

10. Security and minors

We use HTTPS, password hashing and authorisation checks for protected functions and photos. No system can guarantee complete security. Do not share passwords and promptly report suspected unauthorised access or exposure of data.

Accounts are exclusively for people aged 18 or older. Contact us if you suspect a minor has an account or their data has been entered, so we can investigate and appropriately restrict or erase it. An 18+ declaration is not documentary age verification.

The website has no system making solely automated decisions with legal or similarly significant effects on users. Technical access checks and profile sorting serve platform operation.

11. External links and policy changes

Partner links lead to separate websites with their own privacy rules. Opening those websites does not create a booking through Šapica. Read their information before submitting data.

The version date appears above. Material changes to purposes, recipients or the operator will be notified on the website or by email before taking effect, with separate consent requested where required. A new policy does not itself provide consent for a new processing purpose.