Politika privatnosti

Ova politika se odnosi na platformu StartUp AI Agents na adresi startupsolutions.rs/agenti, na kojoj firme koriste AI agente (prodaja, podrška, rezervacije, CRM, mejl, društvene mreže).

Rukovalac podacima je StartUp Solutions, PIB 112942605, MB 66457885, Nede Spasojević 19b/1, Novi Beograd, Srbija. Kontakt: info@startupsolutions.rs.

Podatke koje firma unese o svojim kupcima i saradnicima (upiti, kontakti, rezervacije, razgovori) obrađujemo po nalogu te firme i samo radi rada njenih agenata.

• Nalog: ime, adresa e-pošte, korisničko ime, lozinka (čuva se samo njen heš), firma i uloga u firmi.
• Podaci firme: baza znanja koju firma otpremi, upiti, kontakti i beleške (CRM), rezervacije, razgovori sa agentima u panelu, preko veb widgeta i preko Telegrama ako ga firma poveže, mejlovi ako firma poveže svoje sanduče.
• Društvene mreže: objave koje firma pripremi (tekst, hashtagovi, slike) i podaci povezanog Instagram naloga opisani u sledećem odeljku.
• Tehnički podaci: kolačić sesije neophodan za prijavu i zapisi o pristupu (IP adresa, vreme, akcija) radi bezbednosti.

Firma može da poveže svoj Instagram profesionalni nalog preko Instagram prijave (Instagram API with Instagram Login), uz dozvole instagram_business_basic i instagram_business_content_publish.

• Šta čitamo: ID naloga, korisničko ime i tip naloga (da firma vidi koji je nalog povezan); dnevni limit objavljivanja; ID i link objava koje je firma objavila kroz platformu. Kada ishod objave nije siguran (npr. prekinuta veza), čitamo poslednje objave tog naloga samo da bismo proverili da li je ta objava izašla.
• Šta objavljujemo: samo objavu čiji je tačan sadržaj (tekst i sliku) odobrio član firme sa pravom odobravanja. Svaka izmena posle odobrenja poništava odobrenje. Slika se Instagramu daje preko potpisanog linka koji važi jedan sat.
• Šta ne radimo: ne čitamo pratioce, poruke, komentare ni podatke drugih korisnika; ne objavljujemo bez odobrenja; podatke ne prodajemo i ne koristimo za oglašavanje.
• Čuvanje: pristupni token se čuva šifrovan, važi 60 dana i obnavlja se dok je nalog povezan. ID i link objave čuvaju se uz zapis objave dok ga firma ne obriše ili dok se ne zatraži brisanje.
• Prekid veze i brisanje: „Prekini vezu” u panelu odmah briše token. Ako aplikaciju uklonite u podešavanjima Instagrama, Meta nas o tome obaveštava i token se automatski briše. Brisanje podataka možete zatražiti i preko Mete ili mejlom — vidi Brisanje podataka.

Ista Meta aplikacija služi i za odgovaranje na poruke na Facebook i Instagram nalozima naših klijenata. Za te podatke važe izradawebstranica.rs/politika-privatnosti i izradawebstranica.rs/brisanje-podataka.

• pružanje usluge platforme prema ugovoru sa firmom (rad agenata, objave, obaveštenja);
• bezbednost i sprečavanje zloupotrebe (legitimni interes);
• zakonske obaveze, na primer čuvanje računa.

• Hetzner Online GmbH — serveri u Nemačkoj, na kojima su platforma i baza.
• OpenAI (SAD) — modeli koji pokreću agente; šalje se samo sadržaj potreban za odgovor ili pripremu objave.
• Google — slanje mejlova platforme (Google Workspace).
• Meta (Instagram) i Telegram — samo ako ih firma poveže, i samo za radnje opisane gore.

Podatke naloga i firme čuvamo dok je nalog aktivan. Na zahtev brišemo nalog i podatke firme najkasnije u roku od 30 dana, osim podataka koje smo po zakonu dužni da čuvamo (npr. računi).

Dnevne rezervne kopije baze čuvaju se 14 dana, a kopije napravljene pre ažuriranja platforme dok ih ne zamene novije (čuva se poslednjih 10). Obrisani podaci nestaju iz rezervnih kopija tom rotacijom.

Imate pravo na pristup podacima, ispravku, brisanje, ograničenje obrade, prenosivost i prigovor. Zahtev pošaljite na info@startupsolutions.rs. Pritužbu možete podneti Povereniku za informacije od javnog značaja i zaštitu podataka o ličnosti.

Veza je šifrovana (HTTPS), lozinke se čuvaju samo kao heš, pristupni tokeni su šifrovani, a podaci svake firme su odvojeni i dostupni samo njenim članovima, prema ulozi.

O izmenama ove politike obaveštavamo na ovoj strani. Važi od 13.10.2026.

This policy covers the StartUp AI Agents platform at startupsolutions.rs/agenti, where businesses use AI agents (sales, support, bookings, CRM, email, social media).

The data controller is StartUp Solutions, tax ID 112942605, reg. no. 66457885, Nede Spasojević 19b/1, Novi Beograd, Serbia. Contact: info@startupsolutions.rs.

Data that a business enters about its own customers and partners (inquiries, contacts, bookings, conversations) is processed on behalf of that business and only to run its agents.

• Account: name, email address, username, password (only its hash is stored), business and role.
• Business data: knowledge base uploaded by the business, inquiries, contacts and notes (CRM), bookings, conversations with agents in the dashboard, through the website widget and through Telegram if the business connects it, emails if the business connects its mailbox.
• Social media: posts prepared by the business (text, hashtags, images) and the data of the connected Instagram account described in the next section.
• Technical data: a session cookie required for login and access records (IP address, time, action) for security.

A business can connect its Instagram professional account through Instagram Login (Instagram API with Instagram Login), with the permissions instagram_business_basic and instagram_business_content_publish.

• What we read: account ID, username and account type (so the business sees which account is connected); the daily publishing limit; the ID and link of posts the business published through the platform. When the outcome of a publish is uncertain (e.g. a dropped connection), we read the account's latest posts only to check whether that post went out.
• What we publish: only a post whose exact content (text and image) was approved by a member of the business with approval rights. Any edit after approval cancels the approval. The image is given to Instagram through a signed link that is valid for one hour.
• What we do not do: we do not read followers, messages, comments or other users' data; we do not publish without approval; we do not sell the data or use it for advertising.
• Storage: the access token is stored encrypted, is valid for 60 days and is refreshed while the account stays connected. The post ID and link are kept with the post record until the business deletes it or deletion is requested.
• Disconnecting and deletion: "Disconnect" (Prekini vezu) in the dashboard deletes the token immediately. If you remove the app in your Instagram settings, Meta notifies us and the token is deleted automatically. You can also request data deletion through Meta or by email — see Data deletion.

The same Meta app is also used to answer messages on our clients' Facebook and Instagram accounts. That data is covered by izradawebstranica.rs/politika-privatnosti and izradawebstranica.rs/brisanje-podataka.

• providing the platform service under the contract with the business (agents, posts, notifications);
• security and abuse prevention (legitimate interest);
• legal obligations, for example keeping invoices.

• Hetzner Online GmbH — servers in Germany hosting the platform and the database.
• OpenAI (USA) — models that run the agents; only the content needed for a reply or a post draft is sent.
• Google — sending platform emails (Google Workspace).
• Meta (Instagram) and Telegram — only if the business connects them, and only for the actions described above.

Account and business data are kept while the account is active. On request we delete the account and business data within 30 days at the latest, except data we must keep by law (e.g. invoices).

Daily database backups are kept for 14 days, and backups made before platform updates until newer ones replace them (the last 10 are kept). Deleted data disappears from backups through this rotation.

You have the right to access, rectification, erasure, restriction of processing, portability and objection. Send your request to info@startupsolutions.rs. You can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

Connections are encrypted (HTTPS), passwords are stored only as hashes, access tokens are encrypted, and each business's data is separated and available only to its members, according to their role.

Changes to this policy are announced on this page. Effective from 13 October 2026.