Privacy Policy

ZAGA is a platform for buying and selling clothing, footwear and fashion accessories. This privacy policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. It applies to the ZAGA mobile app and to the zaga.rs website (together: the "Service").

The data controller is Marijana Zagorac, Žabalj, Republic of Serbia ("ZAGA", "we"). For any privacy questions, you can write to us at support@zaga.rs.

We process personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia ("ZZPL"). The Service is intended for users in the Republic of Serbia. If you use the Service from the European Union, then to the extent the General Data Protection Regulation ("GDPR") applies to that processing, you can exercise the rights described in this policy in the same way.

Data you give us:

• Account data: email address, password (stored only in a protected, hashed form), first and last name, display name, profile photo and app language, and — at your choice — phone number, city and country.

• Content you post: listings (title, description, photos, price, category, size, condition and similar item details, optionally city and country), messages and photos you send in conversations, reviews and favorite listings.

• Reports and support: the reason for a report, your comment and any photo attached as evidence, as well as the content of messages you send us through the contact form or a technical issue report.

Data generated by using the Service:

• Device push token — if you enable push notifications, we store an identifier used solely to deliver notifications to your device. When you turn notifications off, the token is no longer used; it is deleted when you sign out, delete your account or uninstall the app.

• Error and crash reports and technical data: if the app encounters an error or crashes, we collect a technical report (device model, operating system and app version, description of the error). The report is linked only to a technical account identifier (a random UUID) that does not by itself reveal your identity — never your name, email or message content.

• Server logs: your IP address and access time are recorded short-term in the standard technical logs of our infrastructure, for security and troubleshooting.

• Aggregate counters: listing view counts and favorite counts are kept as aggregate values attached to a listing.

• Blocks: we record whom you have blocked, so that the block applies in both directions.

Data we receive from third parties:

• If you sign in with your Google or Apple account, we receive your name and email address from them (Apple also lets you use a private relay address). We never see your password for those services.

What we do NOT collect:

• We do not access your device's GPS location — city and country are details you type in yourself.

• Recent searches are stored only on your device and are not sent to our servers.

• We do not use advertising networks or ad-tracking tools.

• We do not sell your data.

Camera and photo library access is used only when you yourself choose to take or upload a photo (listing, profile picture, message, report).

Your display name, profile photo, city and country (if you entered them), your rating, the reviews you have received and your listings are visible to other users of the Service. Listing content may also be reachable by people outside the app through listing share links. Messages are visible only to the participants of that conversation. Your email address and phone number are not publicly visible.

We process data:

• to provide the Service — operating your account, publishing listings, exchanging messages, reviews, notifications (legal basis: performance of a contract);

• for safety and abuse prevention — content moderation, handling reports, blocks, preventing fraud and fake discounts (legal basis: legitimate interest);

• to fix technical errors and improve the app's stability (legal basis: legitimate interest);

• to send notifications you have enabled — push notifications and email notifications (legal basis: consent, which you can withdraw at any time);

• to comply with legal obligations (legal basis: law).

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you — decisions to restrict an account or remove content are made by a human.

• System messages (email verification code, password reset and similar account notices) are necessary for the Service to work and cannot be turned off while you have an account.

• Email notifications (e.g. about a new review) are optional — you can turn them off in the app settings or via the unsubscribe link included in every such email.

• Push notifications are optional — you control them through your operating system permissions and the app settings.

We do not sell your data. We share it only with service providers who process it on our instructions (processors):

• Supabase — database, sign-in and file storage;

• Resend — email delivery;

• Expo — push notification delivery and the app's technical infrastructure;

• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — channels for delivering push notifications to Android and iOS devices respectively;

• Sentry — receiving error and crash reports.

Each of these providers is bound by a data processing agreement obliging it to protect the data and to process it solely on our instructions. We may replace an individual provider with another that ensures at least the same level of data protection; the current list is always contained in the latest version of this policy.

In addition, we may disclose data where required by law or by a decision of a competent authority, and to protect the rights, safety and property of users or of ZAGA. In the event of a corporate change (e.g. merger or sale), data may be transferred to a legal successor, of which you will be notified.

Data is primarily stored with service providers on servers in the European Union. Some providers (e.g. Expo, Sentry, Google, Apple, Resend) may process part of the data in other countries, including the United States. In those cases the transfer takes place with the safeguards required by the ZZPL and the GDPR (e.g. standard contractual clauses).

• Account data and the content you posted are kept for as long as your account exists.

• In-app notifications are automatically deleted after 90 days.

• When you delete a listing, its full-size photos are permanently removed no later than 30 days after deletion; a small thumbnail may remain visible in existing conversations that refer to that listing, for as long as those conversations exist.

• When you delete your account, your profile, listings, photos, messages, reviews, notifications and all files are permanently deleted. You can delete your account yourself, in the app (Settings → Delete account), or by request to support@zaga.rs.

• Reports filed by other users against your account may remain stored after account deletion, in a form no longer linked to the deleted account, for moderation history and legal protection. Reports you filed are deleted together with your account.

• Exceptionally, we may retain certain data after deletion where we are required to do so by law or by an order of a competent authority, or where it is necessary for establishing, exercising or defending legal claims — only to the necessary extent and for as long as that obligation or need exists.

• Server logs are kept for at most 30 days, and error reports for at most 90 days. Any database backups are kept for a limited period and replaced in regular cycles.

We apply technical and organizational safeguards: all communication between the app and the servers is encrypted (HTTPS/TLS), access to data is restricted by database-level rules so that each user can only access what they are entitled to, passwords are stored only in hashed form, and access to production systems is strictly limited. No system is absolutely secure, but in the event of a data breach we will act in accordance with the law, including notifying the competent authority and affected users where required.

With respect to your data, you have the right to:

• access — to be informed about what data we process about you;

• rectification — you can also correct inaccurate data yourself, in the app, in the profile editing section;

• erasure — you can delete your account and data yourself in the app, or by request;

• restriction of processing;

• data portability — receiving the data you provided to us in a structured, commonly used and machine-readable format (e.g. JSON or CSV);

• objection to processing based on legitimate interest;

• withdrawal of consent at any time (e.g. turning off notifications), without affecting the lawfulness of processing before the withdrawal.

Requests can be sent to support@zaga.rs; we will respond without undue delay and at the latest within the statutory deadline. You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) and, if the GDPR applies to you, with the competent supervisory authority in your country.

The Service is intended exclusively for persons aged 18 or over. We do not knowingly collect data of younger persons; if we learn that an account is used by a person under 18, we will delete that account and the associated data.

The ZAGA mobile app does not use cookies or ad-tracking technologies. The zaga.rs website uses only technically necessary cookies, without which the site would not function properly.

We may update this privacy policy from time to time, for example when the Service's functionality or the regulations change. We will notify you of material changes through the app or by email before they take effect, and the date of the last update is always shown at the top of this document.

For all questions about privacy and exercising your rights:

support@zaga.rs