Privacy notice

1. What data we collect

1. What data we collect

What we process depends on how you use berza.app.

Account data

When you create an account we may process:

• your email address;
• your name, if you enter one;
• a hash of your password, if you sign in with a password;
• email confirmation status;
• a bio and LinkedIn or Twitter/X links, if you add them;
• a profile photo;
• details of the last successful sign-in.

Google sign-in

If you sign in with Google, we receive the data Google sends for sign-in, including:

• the Google account identifier;
• email address;
• name;
• profile photo, when available.

Session data

To keep you signed in and protect the account we process technical data such as:

• a hash of the session renewal token;
• session expiry time;
• browser user agent;
• the IP address that opened the session.

Waitlist

If you leave an email on the landing page, we store it so we can notify you about access, with a Cloudflare Turnstile check.

Watchlists

If you use watchlists, we store the list names and the tickers you add.

Chats with Botko

When you use chat, we process the message content, the time it was sent and the name you used then.

So Botko can draft a reply, message content may be sent to Google Gemini.

Portfolio and Interactive Brokers

If you connect Interactive Brokers, we use encrypted tokens to read the data needed to show your portfolio. Access is read-only.

Depending on the feature, that may include:

• positions;
• cash balances;
• executed trades;
• Flex reports you request.

We never store a JMBG. If you enter one to generate an ePorezi XML file, it is used only for that purpose and is not kept after the file is built.

Email

We use Resend to send mail such as address confirmations, invites and password-change messages. Resend receives the recipient address and the message body needed to send it.

2. Why we process your data

2. Why we process your data

We use your data only when there is a lawful basis and the processing is needed to run berza.app.

In particular we process data to:

• create and maintain your account;
• provide watchlists;
• provide chat;
• connect an Interactive Brokers account;
• generate tax documents you request;
• protect the service from abuse and automated attacks;
• detect and fix technical errors.

Analytics

With your consent we use Google Analytics 4 and Microsoft Clarity to understand how berza.app is used and to improve the product.

Those tools do not load until you consent. You can change that choice at any time.

Market figures on company pages are not personal data and are not linked to your account to rate a security.

Ads on the news portal

The public news portal (berza.app/vesti) shows ads through Google AdSense. Google may use cookies and device identifiers to serve and measure ads, and asks visitors from the EU, EEA, UK and Switzerland for consent through its own consent form.

No ads are shown in the app on go.berza.app. How Google uses this data: policies.google.com/technologies/ads.

3. Who we share data with

3. Who we share data with

To run berza.app we use trusted providers:

• Cloudflare - protection and application infrastructure, including Turnstile;
• Hetzner - servers, database, Redis and backups;
• Google - Google sign-in, Gemini for Botko, Google Analytics with your consent, and Google AdSense for ads on the news portal;
• Microsoft - Clarity, with your consent;
• Resend - outbound email;
• Sentry - error reporting;
• Interactive Brokers - only when you connect your broker account.

We do not offer your personal data for sale, and we do not hand it to third parties for their marketing.

Some providers operate in the United States. When data leaves Serbia or the EEA we apply appropriate safeguards, including standard contractual clauses or the Data Privacy Framework where applicable.

4. How long we keep data

4. How long we keep data

We keep data only as long as needed for the purpose it was collected, or as needed for legal and technical duties.

Typical periods include:

• account, watchlist and portfolio data - until you delete the account or disconnect the broker;
• unconfirmed accounts - removed after 24 hours;
• session renewal tokens - up to 30 days;
• one-time email links - up to 24 hours;
• waitlist rows - until you register or ask for deletion;
• Sentry error reports - up to 90 days;
• Cloudflare logs - under Cloudflare's own rules.

Chat messages may remain after account deletion so other participants keep conversation context. After deletion, data that links messages to your account is removed.

5. Cookies and local storage

5. Cookies and local storage

We use necessary cookies and browser local storage so the app can work.

That includes, among other things:

• a session cookie;
• short-lived data for Google sign-in;
• Cloudflare protection cookies;
• light or dark theme preference.

With your consent we may use cookies and similar technology for analytics, including Google Analytics and Microsoft Clarity.

Analytics cookies are not set before you consent, and you may withdraw consent at any time.

6. Your rights

6. Your rights

Under applicable data-protection rules you may have the right to:

• ask for access to your data;
• receive a copy of the data we process;
• ask for correction of inaccurate or incomplete data;
• ask for deletion;
• ask for restriction of processing;
• ask for portability of data you gave us;
• withdraw consent when processing is based on consent.

You can also download your data as a JSON file from the account page, and delete the account in account settings.

You may send a request to podrska@berza.app.

We will answer without undue delay and within the period set by applicable law.

7. Withdrawing analytics consent

7. Withdrawing analytics consent

You can change analytics consent at any time in the privacy controls on this page or in your account.

Withdrawing consent is as easy as giving it.

8. Security

8. Security

We take appropriate technical and organisational measures to protect data from unauthorised access, change, loss or destruction.

Access is limited to what a given feature or service needs.

9. Users under 16

9. Users under 16

berza.app is not intended for anyone under 16, and we do not knowingly collect their data.

10. Complaints

10. Complaints

If you believe processing of your data breaches data-protection rules, you may lodge a complaint with the competent authority:

Commissioner for Information of Public Importance and Personal Data Protection

Bulevar kralja Aleksandra 15

11000 Belgrade

Serbia

www.poverenik.rs

11. Changes to this notice

11. Changes to this notice

We may update this notice from time to time to reflect changes in the service, processing or applicable rules.

When we make material changes we will notify you in an appropriate way.

Last updated: 7 September 2026.