Privacy notice

1 Who is responsible

Dealisa is run by one person in his own name. Under the Serbian Law on Personal Data Protection, and under the GDPR if you live in the European Union, he is the controller of your data: the one who decides what is collected and why, and the one you write to about it.

There is no data protection officer: the service is too small for the law to require one, and every request reaches the operator directly.

2 What we collect and why

Everything below is collected because Dealisa cannot work without it, or because the law lets us keep it for a good reason. Nothing is collected for advertising, and nothing is sold.

You are never asked to fill in a form: your agent asks for what it needs as you go. Nothing on a card may carry contact details; a phone number or an address belongs in a deal room, once you choose to share it there.

3 What the AI does with it

Your agent is a language model. To write its replies and keep your card true, every turn sends your conversation with it, and your card, to Google's Gemini models over Google's paid API. Your listing text is also turned into a vector, a list of numbers that captures its meaning, so that fitting needs and offers can be found. Under the terms of that paid API, Google does not use what we send to train its models, and it keeps it only to run the request.

Two things happen automatically. Matching proposes a shortlist of fitting cards, and a judge model drops a pair whose cards contradict each other. Neither has any legal effect on you: a pass costs nothing, a dropped pair may come back when a card changes, and nothing is ever agreed by a model. The card built from your conversation is yours to correct by replying. Only your own confirmation saves a listing, and only your own lock agrees a deal.

4 Who sees what

Your conversation with your agent is private to you. So are your summary card, your rates, your budget and anything else you tell it: none of it is shown to another member.

• What another member sees, when a match brings you together, is the match card and nothing else: a short description of your offer or need, its title, what you do or what you need, and the area, with your display name shortened to your first name and an initial.
• Not your rate or your budget, not when you are free, not your details paragraph, not what you rule out, and not one word of your conversation with your agent.
• A deal room does not change that: nothing from your conversation or your summary card crosses into it. What the other side reads there is what you write there yourself.
• Your email address and your phone number are shown only to you, and to nobody else unless you write them in a room.

The operator can read the database, as anyone who runs a service can, and does so only to run it: to fix a fault, to answer your request, or to act on abuse. Nobody reads conversations out of curiosity, and no one else has access.

5 Connected agents

You can connect an AI client of your own, an assistant you already use, by minting an access token in the app with the permissions you choose and, for anything that commits money, a spending cap. What that client sees is what those permissions allow it to read, and what it does is done in your name. The provider of that client holds a copy of what it read under its own privacy terms, not ours; choose it as you would choose anyone you hand your keys to. You can revoke a token at any time, and a revoked token reads nothing more.

6 Who processes it for us, and where

We run nothing on hardware of our own. The companies below process your data on our behalf, under contracts that bind them to our instructions.

• Google Cloud: hosting, the database, queues, logs and traces. Data at rest sits in Google's data centres in the Netherlands and in Frankfurt, Germany.
• Firebase, a Google service: your sign-in and the delivery of notifications.
• Apple: Sign in with Apple, when you choose it, and the relay address that forwards mail to your own when you ask Apple to hide your email.
• Google's Gemini API: the language model behind your agent and the vectors behind matching. Google may process a request in the United States; the transfer is covered by Google's standard contractual clauses.
• Cloudflare: the edge in front of everything, which serves the site, terminates the encryption and blocks abuse; it sees every request and keeps short logs.
• Google Fonts: the site's pages load their typefaces from Google, so your IP address reaches Google when a page loads. The app itself loads no fonts from anyone.

Whatever AI client you connect is your processor, not ours; see section 5.

Serbia's law allows data to go to the European Union, and to other countries under appropriate safeguards; the clauses above are those safeguards. If a processor is added or changed, this notice gets a new version and the change log says what changed.

7 How long we keep it

For as long as your account exists. Your messages are the record your cards and your deals are built from, so they are kept, not expired. When you close your account, your profile, your private conversations with your agent and the private rows of your cards are deleted; what you wrote in a deal room stays with the other member as their record, without your name, and the deal's events stay in the log the same way. Technical logs are kept for up to thirty days. Database backups are kept for seven days and then overwritten, so a deletion reaches them within that week.

8 Your rights

You can ask us at any time:

1. to see what we hold about you, and to get a copy of it;
2. to correct what is wrong: your display name, phone and time zone you change yourself in the app, and your card by replying to your agent;
3. to delete your account and your data, within the limits section 7 describes;
4. to restrict, or object to, a processing that rests on our legitimate interest;
5. to receive the data you gave us in a form you can take elsewhere;
6. to withdraw a consent, which stops that processing from then on: for notifications, by turning them off in your browser.

Write to support@dealisa.app from the email address of your account. We answer within thirty days, in the language you wrote in. If you are not satisfied, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or, if you live in the European Union, to the supervisory authority of your country.

9 On your device

The app keeps a few things in your browser's storage: your sign-in, kept by Firebase so you do not sign in on every visit; the registration of this browser for notifications, if you allowed them; and the app's own small settings. Neither the site nor the app sets cookies for advertising or analytics, and there is no tracker to consent to. Clearing the site's data in your browser removes all of it and signs you out.

10 Security

Every connection is encrypted; the database is encrypted at rest; secrets live outside the code; and access is limited to the operator. Sign-in is by Google or Apple, so there is no password of yours for anyone to steal from us. No service is perfectly secure: if a breach ever affects your data, we tell you and the Commissioner as the law requires.

11 Minors

Dealisa is for adults. You must be at least eighteen to have an account; if we learn that a member is younger, the account is closed and its data deleted.

12 Changes to this notice

Each version of this notice carries its effective date at the top, and the change log at the end says what changed. Your first sign-in accepts the version of that day, and we record which one. A change that matters to you is announced in the app before it takes effect.

13 Contact

Write to support@dealisa.app for anything about your data, this notice or the service. Postal address on request.