Privacy policy

Stalana is provided by PAVLE RALIĆ PR AVEDOC, Palmira Toljatija 46/24, 11070 Belgrade, Serbia, registration number 66397220, tax ID (PIB) 112852591 (“Stalana”, “we”). For any privacy question write to office@stalana.com.

This policy covers stalana.com, the agency app (app.stalana.com), agency websites running on Stalana, property search on Stalana and the Stalana mobile app for iOS and Android.

We are the controller for: visitors to this website and messages sent through the contact form; agency staff accounts (sign-in, roles, billing); buyer accounts on Stalana (favourites, saved searches, notifications); security records.

The agency is the controller and we are a processor for everything the agency keeps in Stalana: contacts, owners, buyers, enquiries, viewings, viewing confirmations, messages, agreements and deals. When you send an enquiry, book a viewing or message an agency, that data belongs to the agency you contacted, and we process it under the data processing agreement that is part of our terms of service. For such questions, contact the agency first; we’ll help it respond.

Account: name, email, phone number if you add it, how you sign in (email code, password, Apple or Google), language and notification settings.

Buyers: favourites, saved searches and alerts, enquiries, booked viewings, messages to agencies (text, photos, documents, voice messages) and signatures on viewing confirmations.

Agency staff: profile, role, assigned listings and tasks, activity in the app (audit log) and, for owners, billing details.

Data the agency enters: contacts and property owners, buyer requirements, brokerage agreements, commissions, notes.

Mobile app: the device push token, device model and app version. We use location only while the app is open and only if you allow it: to show listings around you on the map and, for agents, as the place a viewing confirmation was signed. We use the camera, photo library and microphone only when you start them (listing photos, video walkthroughs, room scanning, voice messages). Face ID stays on your device; we never see it.

This website: name, email, agency, phone and message from the contact form. We don’t use tracking or advertising cookies.

Technical data: IP address, time and type of request in server logs, for security and troubleshooting.

• Providing the service (account, listings, enquiries, viewings, messages, notifications): performance of a contract.
• The service to agencies (everything an agency keeps in Stalana): on the agency’s instructions, as a processor.
• Security, abuse prevention and troubleshooting: legitimate interest.
• Location, push notifications, camera and microphone: your consent, which you can withdraw in your phone’s settings.
• Replying to website messages: legitimate interest, or steps before entering a contract.
• Invoices and accounting: legal obligation.

We don’t sell personal data. We share it only as needed:

• The agency you send an enquiry to, book a viewing with or message receives that data.
• Our processors, under data processing agreements:
  • Supabase — database, sign-in and file storage (EU, Frankfurt);
  • Railway — application server (EU);
  • Vercel — website hosting;
  • Apple (APNs, Sign in with Apple) and Google (Firebase Cloud Messaging, Google sign-in) — push notifications and sign-in;
  • Resend — sending email;
  • Infobip — SMS and Viber messages, when the agency uses them;
  • Microsoft (Azure AI Translator, Germany region) — machine translation of listing titles and descriptions (we send only the listing text);
  • Anthropic — writing listing descriptions and, when an agency asks for it, suggesting a reply to a chat message (the latest messages of that conversation are sent); fallback listing translation;
  • YouTube (Google) — video walkthroughs, on the channel of the agency that connects one;
  • MapTiler — maps;
  • Web3Forms and Cal.com — the contact form and demo booking on this website.
• Public authorities, only when the law requires it.

We store data in the EU (Frankfurt). Some processors (e.g. Apple, Google, Vercel, Anthropic) may also process data in the US; in that case we rely on adequacy decisions or standard contractual clauses, in line with the Serbian Personal Data Protection Act (ZZPL) and the GDPR.

• Buyer account: until you delete it. Deleting it removes favourites, searches and alerts, and removes your name, phone and email from enquiries, viewings and messages held by agencies.
• Agency data: for the duration of the contract and up to 90 days after it ends, so the agency can export it; then it’s deleted.
• Signed viewing confirmations: kept by the agency for as long as brokerage law requires.
• Website messages: up to 24 months.
• Server logs: up to 90 days; backups up to 30 days.
• Invoices: as long as accounting law requires.

Each agency can see only its own data (isolation at database level), and inside an agency access depends on the role. Connections are always encrypted (HTTPS), data is encrypted at rest, staff sign-in supports two-factor authentication, and changes are recorded in an audit log. No system is perfectly secure; if a breach happens, we’ll notify agencies, you and the supervisory authority as the law requires.

You have the right to access, correct, delete, restrict, port and object to processing, and to withdraw consent. You can download a copy of your data and delete your account yourself in the app (Account → Your data) or on the agency website. Instructions are on the account deletion page.

For anything else write to office@stalana.com; we reply within 30 days. You can also complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or the supervisory authority in your country.

We use only necessary cookies and local storage: for sign-in, your chosen language and agency. We don’t use third-party analytics or advertising cookies, so there’s no consent banner either.

Stalana isn’t intended for anyone under 16 and we don’t knowingly collect their data.

If we change this policy materially, we’ll tell agencies by email and highlight the change on this page and in the app. The date of the last change is at the top.