Privacy Policy

Who is responsible

The data controller is Svetozar Markovic PR TOZA AI, Knežička br.8, Niš, PIB 115855332, reg. no. 68693187.

You can reach us at: +381 62 1264048 or through the inquiry form on the site

What we collect

• Account data from Google Sign-In: your name, email address, profile picture and Google account identifier. We never see or receive your Google password.
• Billing data you type in yourself: name or company name, address, city, country, tax number (PIB) and registration number, phone. We need these to issue a legally valid invoice.
• Order and invoice records: what you bought, when, how much, and whether it was paid.
• Inquiries: the description of your business, your idea, budget range and number of clips you send through the brief form.
• Education bookings: the sessions you reserve, their times, the meeting link and any recording link we attach afterwards.
• Files you upload as project material.
• Aggregate traffic statistics through Vercel Web Analytics. These are counts of page views — they do not identify you and do not use advertising cookies.

Why we collect it

• To perform the contract: deliver the videos or the training hours you paid for, and let you see your orders and invoices in your account.
• To meet legal accounting obligations: an issued invoice must be kept for as long as tax law requires, regardless of any later deletion request.
• To communicate about your order: confirmations, payment reminders and session details.
• To keep the service working and secure: session cookies, and aggregate statistics that tell us which pages people actually use.

Google account data and Google Calendar

Signing in uses only your name, email address and profile picture. We request no other access to your Google account, and nothing is read from your Gmail, Drive or your own calendar.

Separately, the studio owner may connect the studio's own Google Calendar to the admin panel. That connection uses the calendar.events permission and applies to the studio's calendar, not to yours. It is used for one thing: creating, updating and cancelling the calendar event for a booked session, and generating its Google Meet link. When a session is booked you receive a calendar invitation and the meeting link by email.

We do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties except the service providers listed below. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else processes your data

We use a small number of providers, each only for the purpose named:

• Vercel — hosting, and aggregate traffic analytics.
• Neon — the database where accounts, orders and invoices are stored.
• Vercel Blob — storage for uploaded project files.
• Google — sign-in, and calendar events and Meet links for booked sessions.
• The bank named on your invoice, for payments made by bank transfer.

Cookies

We use only what the site needs to function. There are no advertising or profiling cookies.

• A sign-in cookie that keeps you logged in to your account, and a separate one for the studio's admin panel. Both expire after 30 days.
• A short-lived cookie that protects the sign-in round trip against request forgery.

How long we keep it

• Invoices and the order data on them: for the period required by Serbian accounting and tax law.
• Account data: until you ask us to delete the account.
• Inquiries that never became an order: no longer than two years.
• Uploaded project files: for the duration of the project and a reasonable period afterwards, so the work can be re-delivered.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or send it to you in a portable form. You can also withdraw consent and object to processing.

One limit is worth stating plainly: we cannot delete an issued invoice, because tax law requires us to keep it. Everything not tied to that obligation can be deleted.

Write to +381 62 1264048 or through the inquiry form on the site and we will respond within 30 days. If you are not satisfied, you may complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

Children

The service is not intended for children under 15, and we do not knowingly collect their data.

Changes

If this policy changes materially, we will update the date at the top and, where the change affects you directly, tell you by email.