Privacy Policy

1. Who we are

We are the controller of the data described below. We have not appointed a data protection officer — write to us at the address above about anything concerning your data.

2. What the Platform is

The Platform is our internal tool. Our team uses it to deliver website, SEO and marketing services to our clients, and to find and contact businesses that may need those services. Accounts are created by invitation for our team only — there is no public sign-up.

3. Whose data we process, and what

• Our team (Platform users) — name, email address, password (stored only as a one-way hash), two-factor settings (the secret encrypted, recovery codes hashed), sign-in sessions with IP address and browser/device, a log of actions taken in the Platform with the IP address, and settings such as notification preferences.
• Our clients and their contact people — company and contact details, website addresses, access to their websites (WordPress connector tokens or application passwords, stored encrypted), the work we produce for them (articles, SEO changes, social-media plans, reports) and, where the client grants our Google account access, Search Console, Google Analytics and Google Ads data for their properties (see section 8).
• Potential clients (prospects) — businesses we may offer our services to, and the people listed as their contacts: business name, category, address, phone number, website, ratings and publicly listed business email addresses. We collect them from Google Places, Foursquare Places, public business directories (only pages their robots.txt allows) and the business's own website. When we email a prospect we keep the message and record whether it was opened or a link in it clicked (through a small tracking image and tracked links), replies, unsubscribe requests and bounces.
• Visitors of these pages and the sign-in page — our server keeps technical logs (IP address, time, page requested) for security.

4. Why we process it, and the legal basis

• Running and securing the Platform for our team — our legitimate interest in operating and protecting our business tool, and for team members the performance of our working arrangement with them.
• Delivering services to clients — performance of our contract with the client.
• Offering our services to prospects — our legitimate interest in business-to-business marketing. You can object at any time: every email we send contains an unsubscribe link, and we stop as soon as you use it.
• Keeping records the law requires — legal obligation.

We do not sell personal data, and we do not use it to build advertising profiles.

5. Automated processing

The Platform ranks prospects by how well they fit our services — for example, whether their website has problems we can fix — and can draft emails with the help of AI. A person on our team decides whom to contact. No decision with legal or similarly significant effect on you is made solely by automated means.

6. Who receives the data

We use these service providers (processors), each only for its own service:

• TrueFalse Hosting (Serbia) — hosts the Platform, its database and our mailbox.
• Anthropic, OpenAI and Google (Gemini) (USA) — AI providers. They receive the text a task needs (for example an article brief, or public information about a prospect's business) and return generated text, under their API terms.
• Black Forest Labs (Germany) — generates images from text prompts.
• Google — Search Console, Analytics, Ads, Places, PageSpeed Insights and Sheets APIs (section 8).
• Foursquare (USA) — business listings search; receives the search (a category and an area).
• SerpApi (USA) — search-ranking checks; receives keywords and domain names.
• Automation services we connect, such as Zapier, Make or Slack — receive only what an automation we set up sends them, for example the text of a scheduled social-media post.

We disclose data to public authorities only where the law requires it.

7. Transfers outside Serbia

Some of the providers above are in the USA. Where a destination is not on the list of countries with an adequate level of protection, the transfer relies on the standard contractual clauses or other safeguards the provider offers, as the ZZPL allows.

8. Data from Google

We reach Google data through one Google account that belongs to us. A client gives that account access to their Search Console property, Google Analytics property or Google Ads account, and can take it away at any time — in Search Console under Settings → Users and permissions, in Google Analytics under Admin → Access management, and in Google Ads under Admin → Access and security.

We ask Google for these permissions:

• Search Console, read-only (https://www.googleapis.com/auth/webmasters.readonly) — search performance and indexing of client sites.
• Google Analytics, read-only (https://www.googleapis.com/auth/analytics.readonly) — traffic reports for client sites.
• Google Ads (https://www.googleapis.com/auth/adwords) — used only to read campaign reports; we make no changes in Ads accounts.
• Google Sheets (https://www.googleapis.com/auth/spreadsheets) — to create a spreadsheet when we export a report.

Data received from Google is used only to show reports, rankings and recommendations inside the Platform for the client it belongs to. It is not sold, not used for advertising, not used to train AI models, and not shared except with the providers in section 6 as needed for those features. Sajtpress's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. How long we keep it

• Team accounts — while the person works with us; removed when the account is deleted.
• Sign-in sessions — end after 3 days without activity, and after 30 days at most.
• Activity log, platform events and notifications — 90 days.
• Client data — for as long as we work together, then deleted on request; we keep only what the law requires.
• Prospect data — until it is no longer needed for our marketing, or until you object. After an objection we keep only the email address on a do-not-contact list, so that it is never emailed again.
• Backups made by our hosting provider are overwritten on its regular rotation.

10. Security

The Platform is served only over HTTPS. Passwords are hashed with scrypt; website access, API keys and Google tokens are encrypted with AES-256-GCM. Sign-in supports two-factor authentication, repeated failed attempts are rate-limited, and privileged actions are logged. No system is perfectly secure, but we take these and other reasonable measures to protect your data.

11. Cookies

We use only the cookies the Platform needs to work:

• sp_session — keeps you signed in (at most 30 days).
• sp_2fa — holds the two-factor step of signing in (5 minutes).
• g_oauth_state, g_return — used for 10 minutes while connecting Google.

Your light/dark theme choice is stored in your browser. We use no analytics, advertising or third-party tracking cookies, so we do not ask for cookie consent.

12. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest — including, at any time and without giving a reason, to direct marketing. Write to aisolutions@sajtpress.rs (see also Data Deletion). We reply within 30 days; in complex cases this can be extended by up to 60 days, and we will tell you if it is.

13. Changes

We will publish any change to this policy on this page and update the date at the top.