Privacy Policy

1. Who is responsible

The controller is FamIT Solutions and Technologies LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.

Representative for Serbia and the EU (where required): FamIT Solutions and Technologies LLC, info@famitsnt.com.

Contact for any privacy question or request: info@moj-racun.rs.

Data protection contact: FamIT Solutions and Technologies LLC (no separate data protection officer is appointed), info@famitsnt.com.

2. Where the data comes from

• From you: account details, receipts, photos and settings you enter.
• From your device: platform, device name, push token and technical data your app sends.
• From public sources and partners: receipt details from the Tax Administration (PURS) and subscription status from Apple, Google, RevenueCat or Stripe.

3. Is providing data required

In local mode you provide nothing to us. To create an online account you must provide an email address and password; without them we cannot offer the account. Other data (name, receipts, photos, goals) is optional and entirely your choice.

4. Local mode and online mode

Local mode: you can use the mobile apps without an account. Receipts then stay on your device and we do not receive them.

Online mode: when you create an account, your receipts and settings are stored on our servers so you can use the web app and several devices.

5. Data we process

• Account data: email address, password (stored only as a one-way hash), optional name, language, time zone, notification settings and spending targets.
• Receipt data: receipt number, date, amount, raw receipt data, merchant (name, tax ID, address), items, prices, categories, warranties and optional receipt photos you upload.
• Device data: platform, device name, push notification token and sign-in session information.
• Subscription data: whether Premium is active, its source (web, Google Play, App Store) and expiry. We do not receive your card number.
• Technical and security data: server logs (such as IP address and request time), error and crash reports, and records of administrative actions.
• Advertising data: if ads are shown and you consent, our advertising partners process identifiers and usage data as described in “Who we share data with” and the Cookie Policy.

6. Why we process data and on what basis

• To provide the service you asked for – accounts, receipt storage, statistics, warranty reminders (performance of a contract).
• To send service emails and push notifications such as email verification, password reset and warranty reminders you enabled (contract / legitimate interest).
• To keep the service secure, prevent abuse and fix errors (legitimate interest).
• To manage Premium subscriptions and prevent payment fraud (contract / legal obligation).
• To show advertising that keeps the service free and, where required, to measure usage (your consent, which you can withdraw at any time).
• To meet legal obligations and handle legal claims (legal obligation / legitimate interest).

7. Receipt lookups

When you scan a fiscal receipt, our servers query the public verification service of the Serbian Tax Administration (PURS) with the data in the QR code to retrieve the receipt details. The receipt data is public in the sense that anyone holding the receipt can look it up.

8. Who we share data with

We use service providers (processors) who process data on our instructions, and independent partners where stated:

• Hosting and infrastructure for our servers and database.
• Google Firebase – push notifications (Cloud Messaging), analytics, crash reporting and remote configuration in the mobile apps.
• Google AdMob and AdSense – advertising in the apps and web (independent controller for ad personalisation; shown only where consent rules allow).
• RevenueCat and Stripe – subscription and payment processing. Store purchases are handled by Apple and Google.
• Email delivery provider – to send verification, reset and reminder emails.
• Tax Administration (PURS) – receipt verification, as described above.
• Authorities, advisers or courts where required by law.

9. International transfers

Our company is based in the United States and our servers, providers and staff may process data there or elsewhere outside Serbia and the European Economic Area. Where required, we transfer data only with safeguards such as standard contractual clauses, an adequacy decision (for example the EU–US Data Privacy Framework for certified recipients) or your explicit consent. You can request a copy of the safeguards at info@moj-racun.rs.

10. How long we keep data

• Account and receipt data: until you delete the account.
• After you delete your account: personal data is removed from our systems promptly; limited backups and legally required records may remain for a short period.
• Server logs and security records: kept for a limited period needed for security and troubleshooting.
• Consent choice: 12 months, then we ask again.

11. Automated decisions and profiling

We do not make decisions based solely on automated processing that produce legal effects for you, and we do not profile you ourselves. Our advertising partners may personalise ads if you consent; you can decline in the cookie settings or your device settings.

12. Your rights

Under GDPR and ZZPL you have the right to: access your data, correct it, delete it, restrict or object to processing, receive your data in a portable format, and withdraw consent at any time without affecting earlier processing.

You can export your data and delete your account in the app settings. For anything else write to info@moj-racun.rs; we answer within one month.

Contact details of the Serbian authority: Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, poverenik.rs.

You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection of Serbia, or to the supervisory authority in your EU country of residence.

13. Personal data breaches

If a breach is likely to put your rights at risk, we will notify the competent authority within 72 hours of becoming aware of it and, where the risk is high, inform you without undue delay.

14. Children

Moj Račun is not intended for children under 16. If you believe a child has created an account, contact us and we will delete it.

15. Security

We use measures such as encrypted connections, hashed passwords, access controls and monitoring. No system is perfectly secure, so please use a strong, unique password.

16. Cookies and similar technologies

See our Cookie Policy for details and to change your choices at any time using “Cookie settings” in the footer.

17. Changes

We may update this policy. We will change the “last updated” date and, for material changes, inform you in the app or by email.