Privacy notice

Who is the controller

The controller is V Code, Smederevo, Republic of Serbia. For data requests write to office@berza.app. We have not appointed a data-protection officer because this service does not require one.

What we store

Account: email address, optional name, password hash when a password is set, whether the email is confirmed, bio, LinkedIn and Twitter address, profile photo, and the time of the last successful sign-in.

Google sign-in: the Google account identifier, email and name that Google returns, and optionally the Google photo.

Session: a hash of the refresh token, expiry, browser user agent and the IP address that opened the session.

Waitlist: an email address you leave on the landing page (with a Cloudflare Turnstile check).

Watchlists: list names and the tickers you save.

Chat: the message text, the time, and the name you used then. Botko may send the text of a message to Google (Gemini) to draft a reply.

Portfolio and IBKR: encrypted tokens we use to read your account (read-only), positions, cash, trades and a Flex statement when you ask for one. A JMBG is never stored — it is typed once to build the ePorezi XML and then forgotten.

Mail: we send messages to confirm an address, invite you, and to change a password. The recipient address and message body go through Resend.

Legal basis and purpose

Contract for the service: opening and keeping the account, watchlists, chat, the IBKR link, and a tax XML you ask us to build.

Consent: Google Analytics 4 and Microsoft Clarity (visit measurement, heatmaps and session replay). Those scripts do not load until you accept. You may withdraw consent at any time on this page or on your account, as easily as you gave it.

Legitimate interest: slowing abuse (a cap on attempts, Turnstile), recording the last sign-in, and error reports through Sentry without default personal data.

Market figures on company pages are not personal data and are not tied to your account to rank a security.

Who can see it

Cloudflare (pages, the edge Worker, Turnstile), Hetzner (API, database, Redis, backups), Google (sign-in, Gemini for Botko, and Analytics with consent), Microsoft (Clarity with consent), Resend (outbound mail), Sentry (errors) and Interactive Brokers (only when you connect an account). Personal data is not offered to others for payment.

Some of these providers are in the United States. The transfer uses the safeguards they offer (standard contractual clauses, or the Data Privacy Framework where it applies).

How long we keep it

The account, watchlists, portfolio and tax entries stay until you delete the account or disconnect the broker. An unconfirmed account is removed after 24 hours. A refresh token lasts up to 30 days. One-time email links expire after 24 hours. A waitlist row stays until you register or ask for deletion.

Chat messages stay so other people's threads keep their context. After you delete the account the link to you is removed and the signature becomes a dash.

Sentry keeps an error report for up to 90 days. Edge logs (Cloudflare) are short-lived, under their own rules.

Cookies and local storage

Necessary: berza_refresh (httpOnly session, up to 30 days), berza_oauth (short-lived Google sign-in state), Cloudflare Turnstile and edge protection cookies. Theme (light/dark) stays in the browser’s local storage.

With consent: Google Analytics (_ga and similar) and Microsoft Clarity (_clck, _clsk and similar). We store the preference in local storage (berza_analytics_consent). Without acceptance those scripts do not load. Withdrawing consent clears those cookies.

Your rights

You may ask for access, a copy, correction, restriction or deletion, and to receive data you gave us in a portable form. In the app: on the account page you download a JSON copy and delete the account (email confirmation, plus the password when one is set). You may send the same request to office@berza.app. We answer without undue delay, within 30 days at the latest.

You withdraw analytics consent on this page or on your account. The service is not meant for anyone under 16.

Complaint: Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs.