shield Pravni dokument

Politika privatnosti

Vaša privatnost nam je važna. Ovaj dokument detaljno objašnjava koje podatke prikupljamo, zašto ih prikupljamo, kako ih koristimo i koja prava imate.

Poslednje ažuriranje: 22. maj 2026.

1. Rukovalac podacima

Uslugu StudyBuddy pruža StudyBuddy, sa sedištem u Srbiji (Beograd). Za sva pitanja u vezi sa obradom ličnih podataka, ostvarivanje vaših prava i podnošenje zahteva, možete nas kontaktirati putem e-pošte:

E-pošta: info@studdybuddy.rs
Lokacija: Beograd, Republika Srbija

2. Podaci koje prikupljamo

U cilju pružanja usluge i njenog kontinuiranog unapređenja, prikupljamo sledeće kategorije podataka:

2.1. Podaci o nalogu

E-pošta: za prijavu, oporavak naloga i obaveštenja
Ime: za personalizaciju iskustva u aplikaciji
Fakultet i godina studija: radi prilagođavanja sadržaja i preporuka
Pol: opciono, za korektnu jezičku formu u srpskom jeziku
Broj telefona: opciono, samo ako ga sami unesete (koristi se isključivo za potencijalnu hitnu komunikaciju u vezi sa nalogom, npr. potvrdu identiteta na zahtev)
Profilna slika: opciono, ako je sami otpremite

2.2. Sadržaj koji korisnik unosi

Otpremljeni fajlovi: PDF dokumenti, slike beleški i drugi materijali koje sami postavite
Sadržaj razgovora: poruke koje šaljete u čet sa AI asistentom
Generisani materijali: rezimei, kvizovi i flashcards kreirani na osnovu vaših unosa

2.3. Tehnički podaci

Identifikator uređaja: anoniman ID koji se koristi za prepoznavanje sesije
Tip uređaja i pregledača: radi optimizacije prikaza
Podaci o korišćenju: broj poruka, otpremanja i drugih radnji unutar dnevnih limita
Plan pretplate: informacije o tome da li ste na Free ili Plus planu

3. Svrha obrade podataka

Ne prodajemo, ne iznajmljujemo i ne razmenjujemo vaše lične podatke. Ne kreiramo profile za oglašivače. Ne primamo novac od trećih strana u zamenu za vaše podatke. Tačka.

Vaše podatke koristimo isključivo u sledeće svrhe (uz odgovarajući pravni osnov prema GDPR-u):

Pružanje usluge: generisanje AI odgovora, sinhronizacija razgovora između uređaja, čuvanje vaših materijala. Pravni osnov: izvršenje ugovora (čl. 6(1)(b) GDPR).
Naplata pretplate: obrada plaćanja Plus plana preko provajdera LemonSqueezy. Pravni osnov: izvršenje ugovora (čl. 6(1)(b) GDPR).
Tehnička podrška: odgovaranje na vaše upite i rešavanje problema. Pravni osnov: legitimni interes (čl. 6(1)(f) GDPR).
Analitika: isključivo agregirani i anonimizovani podaci o korišćenju radi unapređenja servisa (nikad pojedinačni profili). Pravni osnov: legitimni interes (čl. 6(1)(f) GDPR).
Bezbednost: sprečavanje zloupotrebe i otkrivanje neuobičajenih aktivnosti. Pravni osnov: legitimni interes (čl. 6(1)(f) GDPR).
Obaveštenja o proizvodu (opciono): povremene e-poruke o novim funkcijama i sadržajima. Ova obaveštenja možete isključiti u podešavanjima naloga u svakom trenutku. Pravni osnov: saglasnost (čl. 6(1)(a) GDPR).

4. Gde se vaši podaci čuvaju i obrađuju

Koristimo proverene servise koji ispunjavaju standarde zaštite podataka:

Supabase (EU region, Frankfurt), baza podataka i autentifikacija. Šifrovano u mirovanju (AES-256). Pristup zaštićen Row Level Security politikama tako da svaki korisnik može da čita samo svoje podatke.
Vercel: hosting aplikacije, CDN i agregirana analitika posete (bez kolačića, bez praćenja po korisniku)
LemonSqueezy: obrada plaćanja (mi ne vidimo i ne čuvamo podatke o vašoj kartici)
Resend: slanje transakcionih email-ova (potvrda registracije, podsetnici)
Sentry: praćenje grešaka. Konfigurisan tako da NE beleži sadržaj vaših poruka ni email adrese.
OpenAI, Anthropic i Google AI: obrada upita i generisanje odgovora AI modela

4.1. AI provajderi, šta tačno vide

Kada šaljete poruku ili otpremate fajl, sadržaj se prosleđuje izabranom AI provajderu isključivo radi generisanja odgovora. Prema njihovim javno objavljenim API uslovima na dan 22. maj 2026:

OpenAI: API podaci se NE koriste za obuku modela. Zadržavaju se do 30 dana radi nadzora zloupotrebe, zatim se brišu.
Anthropic: API podaci se NE koriste za obuku modela. Zadržavaju se do 30 dana radi sigurnosnog nadzora, zatim se brišu.
Google AI: Gemini API podaci se NE koriste za obuku modela na plaćenom planu. Kratko se keširaju radi performansi.

Pratimo izmene ovih uslova. Ako bilo koji provajder izmeni svoju politiku obrade API podataka, ažuriraćemo ovaj odeljak i, gde je to materijalno, obavestiti vas e-poštom.

Vaši razgovori su privatni, vidite ih samo vi (i članovi vaše studijske grupe, ako razgovor delite tamo). Mi sami ne čitamo vaše poruke. Pristup imaju samo automatizovani sistemi koji izvršavaju vaš upit.

4.2. Međunarodni transferi podataka

OpenAI, Anthropic i Google AI imaju sedište u SAD. Kada se vaš sadržaj prosledi njima, prenos je zaštićen EU-US Data Privacy Framework i/ili Standardnim ugovornim klauzulama (SCC) Evropske komisije, u skladu sa članovima 45. i 46. GDPR-a. To znači da vaši podaci uživaju isti nivo zaštite kao u EU.

5. Vaša prava prema GDPR-u

U skladu sa Opštom uredbom o zaštiti podataka (GDPR) i Zakonom o zaštiti podataka o ličnosti Republike Srbije, imate sledeća prava:

Pravo na pristup: možete tražiti kopiju svojih ličnih podataka
Pravo na ispravku: možete zatražiti ispravku netačnih ili nepotpunih podataka
Pravo na brisanje ("pravo na zaborav"), možete zatražiti brisanje svojih podataka
Pravo na prenosivost: možete dobiti svoje podatke u strukturisanom, mašinski čitljivom formatu
Pravo na povlačenje saglasnosti: saglasnost koju ste dali možete povući u svakom trenutku
Pravo na prigovor: možete uložiti prigovor na obradu vaših podataka
Pravo na pritužbu: možete podneti pritužbu Povereniku za informacije od javnog značaja i zaštitu podataka o ličnosti Republike Srbije. Korisnici iz EU imaju pravo da pritužbu podnesu i nadzornom organu za zaštitu podataka u svojoj zemlji prebivališta (čl. 77 GDPR).

Za ostvarivanje bilo kog od navedenih prava, pošaljite e-poštu na info@studdybuddy.rs. Na zahtev ćemo odgovoriti najkasnije u roku od 30 dana. Za pravo na prenosivost (izvoz podataka u mašinski čitljivom formatu), trenutno nemamo automatizovani alat za samostalni izvoz, pripremićemo i poslati izvoz u JSON formatu na zahtev u istom roku.

6. Čuvanje i brisanje podataka

Dok je nalog aktivan: podatke i sadržaj koji ste uneli čuvamo dokle god koristite servis. Možete u svakom trenutku obrisati pojedinačne razgovore, beleške ili fajlove iz aplikacije.

Brisanje naloga: nalog možete obrisati iz aplikacije preko Profil → Podešavanja → Obriši nalog. U roku od 30 dana trajno se uklanjaju:

vaši lični podaci (e-pošta, ime, fakultet, godina, pol, telefon),
otpremljeni fajlovi i sadržaj razgovora,
generisani materijali (rezimei, kvizovi, kartice),
podaci o planu i korišćenju.

Rezervne kopije (backups): kopije baze podataka se rotiraju i prepisuju u roku od 90 dana, tako da iz starih backupa vaši podaci nestaju automatski.

Pravna obaveza: evidencija o plaćanju Plus pretplate čuva se 10 godina, u skladu sa Zakonom o računovodstvu Republike Srbije (čl. 17). To su isključivo finansijski zapisi (datum, iznos, plan), ne i sadržaj vaših razgovora ili materijala.

7. Kolačići (cookies)

StudyBuddy koristi isključivo neophodne kolačiće za funkcionisanje servisa, pre svega kolačiće za autentifikaciju koji vas drže prijavljenim. Ne koristimo kolačiće za praćenje, reklamiranje, niti dele se sa trećim stranama u marketinške svrhe.

8. Korisnici mlađi od 16 godina

StudyBuddy je namenjen korisnicima koji imaju navršenih 16 godina ili više. Svesno ne prikupljamo lične podatke maloletnih lica mlađih od 16 godina. Ukoliko saznamo da smo prikupili podatke takvog lica, te podatke ćemo bez odlaganja obrisati. Ako ste roditelj ili staratelj i smatrate da je vaše dete unelo svoje podatke bez vaše saglasnosti, kontaktirajte nas na info@studdybuddy.rs.

9. Bezbednost podataka

Primenjujemo razumne tehničke i organizacione mere kako bismo zaštitili vaše podatke:

Šifrovanje u prenosu: sav saobraćaj između vašeg uređaja i naših servera ide preko HTTPS/TLS-a.
Šifrovanje u mirovanju: baza podataka je šifrovana (AES-256) na nivou diska.
Row Level Security: politike na nivou baze obezbeđuju da svaki korisnik može da čita samo svoje zapise. Neovlašćen pristup tuđim podacima sprečen je na samoj bazi, ne samo u kodu aplikacije.
Lozinke: nikad ne čuvamo lozinke u čistom tekstu. Supabase ih hešira po industrijskom standardu (bcrypt).
Zaštita od botova: registracija je zaštićena Cloudflare Turnstile sistemom.
Privatnost razgovora: vaši razgovori i fajlovi vidljivi su samo vama. Grupni razgovori vidljivi su samo članovima grupe. Mi sami ne čitamo vaše poruke.
Sentry (praćenje grešaka): konfigurisan da NE beleži sadržaj poruka ni email adrese.

Ako otkrijemo bezbednosni incident koji utiče na vaše podatke, obavestićemo vas i, ako je primenjivo, nadležnog Poverenika u roku od 72 sata, kako nalaže član 33. GDPR-a.

Napomena: nijedan sistem nije apsolutno bezbedan. Trudimo se da budemo razumno oprezni, ali ne možemo garantovati 100% sigurnost.

10. Izmene politike privatnosti

Ovu politiku možemo s vremena na vreme ažurirati kako bismo je uskladili sa promenama u zakonu ili u načinu rada usluge. O značajnim izmenama ćemo vas obavestiti putem e-pošte ili obaveštenjem u aplikaciji. Datum poslednjeg ažuriranja uvek je naveden na vrhu ovog dokumenta.

11. Kontakt

Za sva pitanja u vezi sa ovom politikom privatnosti i obradom vaših ličnih podataka, slobodno nas kontaktirajte:

E-pošta: info@studdybuddy.rs
Stranica za kontakt: studdybuddy.rs/contact

arrow_back Nazad na početnu

arrow_back Back to home

shield Legal document

Privacy Policy

Your privacy matters to us. This document explains in detail which data we collect, why we collect it, how we use it, and which rights you have.

Last updated: 22 May 2026.

1. Data Controller

The StudyBuddy service is provided by StudyBuddy, based in Serbia (Belgrade). For any questions regarding the processing of personal data, exercising your rights, or submitting requests, you can contact us by email:

Email: info@studdybuddy.rs
Location: Belgrade, Republic of Serbia

2. Data We Collect

In order to provide the service and continuously improve it, we collect the following categories of data:

2.1. Account data

Email address: for sign-in, account recovery, and notifications
Name: to personalise your in-app experience
University and year of study: to tailor content and recommendations
Gender: optional, used for correct grammatical forms in the Serbian language
Phone number: optional, only if you provide it yourself (used solely for any urgent account-related contact, e.g. identity confirmation on request)
Profile picture: optional, if you upload one yourself

2.2. User-submitted content

Uploaded files: PDF documents, images of notes, and other materials you upload yourself
Conversation content: messages you send in the chat with the AI assistant
Generated materials: summaries, quizzes, and flashcards created based on your input

2.3. Technical data

Device identifier: an anonymous ID used to recognise the session
Device and browser type: for display optimisation
Usage data: number of messages, uploads, and other actions within daily limits
Subscription plan: information about whether you are on the Free or Plus plan

3. Purpose of Data Processing

We do not sell, rent, or trade your personal data. We do not build advertising profiles. We do not accept money from third parties in exchange for your data. Full stop.

We use your data solely for the following purposes (each with the corresponding GDPR legal basis):

Providing the service: generating AI responses, syncing conversations between devices, storing your materials. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Subscription billing: processing payments for the Plus plan via the LemonSqueezy provider. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Technical support: answering your queries and resolving issues. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Analytics: strictly aggregated and anonymised usage data for service improvement (never individual profiles). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Security: preventing abuse and detecting unusual activity. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Product announcements (optional): occasional emails about new features and content. You can turn these off in your account settings at any time. Legal basis: consent (Art. 6(1)(a) GDPR).

4. Where Your Data Is Stored and Processed

We use vetted services that meet data protection standards:

Supabase (EU region, Frankfurt), database and authentication. Encrypted at rest (AES-256). Access protected by Row Level Security policies so each user can only read their own records.
Vercel: application hosting, CDN, and aggregated visit analytics (cookieless, no per-user tracking)
LemonSqueezy: payment processing (we do not see or store your card details)
Resend: sending transactional emails (sign-up confirmations, reminders)
Sentry: error monitoring. Configured to NOT capture the content of your messages or your email address.
OpenAI, Anthropic, and Google AI: processing of queries and generation of AI model responses

4.1. AI providers, what they actually see

When you send a message or upload a file, the content is forwarded to your selected AI provider solely to generate a response. Per their publicly published API terms as of 22 May 2026:

OpenAI: API data is NOT used to train models. Retained for up to 30 days for abuse monitoring, then deleted.
Anthropic: API data is NOT used to train models. Retained for up to 30 days for safety monitoring, then deleted.
Google AI: Gemini API data on the paid plan is NOT used to train models. Briefly cached for performance.

We monitor changes to these terms. If any provider changes its policy on API data handling, we will update this section and, where materially relevant, notify you by email.

Your conversations are private, only you can see them (and your study group members, if you share a conversation there). We do not read your messages ourselves. Only automated systems that fulfil your request have access.

4.2. International data transfers

OpenAI, Anthropic, and Google AI are based in the United States. When your content is forwarded to them, the transfer is protected by the EU-US Data Privacy Framework and/or the Standard Contractual Clauses (SCCs) issued by the European Commission, in accordance with Articles 45 and 46 of the GDPR. This means your data enjoys the same level of protection it would inside the EU.

5. Your Rights Under the GDPR

In accordance with the General Data Protection Regulation (GDPR) and the Law on the Protection of Personal Data of the Republic of Serbia, you have the following rights:

Right of access: you can request a copy of your personal data
Right to rectification: you can request correction of inaccurate or incomplete data
Right to erasure ("right to be forgotten"), you can request the deletion of your data
Right to data portability: you can receive your data in a structured, machine-readable format
Right to withdraw consent: any consent you have given may be withdrawn at any time
Right to object: you can object to the processing of your data
Right to lodge a complaint: you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia. Users in the EU also have the right to lodge a complaint with the data protection supervisory authority in their country of residence (Art. 77 GDPR).

To exercise any of these rights, please send an email to info@studdybuddy.rs. We will respond to your request within 30 days at the latest. For data portability (export in machine-readable format), we do not currently have a self-service export tool. We will prepare and send the export in JSON format on request, within the same time frame.

6. Data Retention and Account Deletion

While your account is active: we keep the data and content you've entered for as long as you keep using the service. You can delete individual conversations, notes, or files from the app at any time.

Account deletion: you can delete your account from within the app via Profile → Settings → Delete account. Within 30 days, the following are permanently removed:

your personal data (email, name, university, year, gender, phone),
uploaded files and conversation content,
generated materials (summaries, quizzes, flashcards),
plan and usage data.

Backups: database backups are rotated and overwritten within 90 days, so your data also disappears from old backups automatically.

Legal retention: records of Plus subscription payments are kept for 10 years, as required by Article 17 of Serbia's Accounting Law. These are purely financial records (date, amount, plan), not the content of your conversations or materials.

7. Cookies

StudyBuddy uses strictly necessary cookies only for the operation of the service, primarily authentication cookies that keep you signed in. We do not use tracking or advertising cookies, nor are cookies shared with third parties for marketing purposes.

8. Users Under the Age of 16

StudyBuddy is intended for users who are 16 years of age or older. We do not knowingly collect personal data of minors under the age of 16. If we become aware that we have collected such data, we will delete it without delay. If you are a parent or guardian and believe that your child has provided their data without your consent, please contact us at info@studdybuddy.rs.

9. Data Security

We apply reasonable technical and organisational measures to protect your data:

Encryption in transit: all traffic between your device and our servers goes over HTTPS/TLS.
Encryption at rest: the database is encrypted (AES-256) at the disk level.
Row Level Security: database-level policies ensure each user can only read their own records. Unauthorised access to other users' data is blocked at the database layer, not just in app code.
Passwords: we never store passwords in plain text. Supabase hashes them with an industry-standard algorithm (bcrypt).
Bot protection: sign-up is protected by Cloudflare Turnstile.
Conversation privacy: your conversations and files are visible only to you. Group chats are visible only to group members. We do not read your messages ourselves.
Sentry (error monitoring): configured to NOT capture the content of messages or your email address.

If we ever discover a security incident that affects your data, we will notify you and, where applicable, the competent supervisory authority within 72 hours, as required by Article 33 of the GDPR.

Disclaimer: no system is absolutely secure. We try to be reasonably careful, but we cannot guarantee 100% security.

10. Changes to the Privacy Policy

We may update this policy from time to time to reflect changes in the law or in the way the service operates. We will notify you of material changes by email or by an in-app notice. The date of the last update is always shown at the top of this document.

11. Contact

For any questions regarding this Privacy Policy and the processing of your personal data, please feel free to contact us:

Email: info@studdybuddy.rs
Contact page: studdybuddy.rs/contact

arrow_back Back to home