Privacy policy
1. Who is responsible for your data
The controller of your personal data is XTech Montenegro d.o.o., Kralja Nikole br. 12, Podgorica, Crna Gora, tax / registration number 03420272. For any question about data protection write to info@zalba.me.
2. What data we collect
• Account: email address, display name, password (stored only as a one-way hash), language, and your phone number once you verify it. If you sign in with Google, we receive your name, email address and profile picture from Google. • Content: the complaints, replies, comments and ratings you write, the files you attach and an order number if you give one. • Brand representatives: the company email address, the company document sent with a request to claim a profile, and invoice details when a plan is ordered. • Technical data: IP address and browser data in server logs and for limiting abuse; a session cookie while you are signed in. We do not ask for special categories of data (health, religion, political opinions and the like). Please do not write them in a complaint.
3. Why we use your data and on what legal basis
• Running your account and publishing your content: performance of the contract (the Terms of Use). • Phone verification, preventing abuse, moderating content, keeping the record of moderation decisions and defending legal claims: our legitimate interest in a safe and lawful platform. • Notifications about your complaints: performance of the contract. • Acting on requests from courts and competent authorities and other duties under the law: legal obligation. • Where we rely on your consent, you can withdraw it at any time. We do not sell your data and do not use it for advertising or profiling.
4. What is visible to the public
Public: the title and text of a published complaint, attachments you yourself marked as public, your display name (unless you post anonymously), public replies, comments, the rating and the outcome. Published complaints can be found through search engines. Never public: your email address, phone number, order number, private attachments and private messages. The order number, private attachments and private messages are seen only by the verified team of the brand the complaint is about and by moderators. Phone numbers, email addresses, account and card numbers and similar data in the text are hidden automatically before publication.
5. Who receives your data
Service providers process data on our behalf and on our instructions: hosting and database (Vercel, Neon), email delivery, file storage and protection against automated abuse (Cloudflare), request limiting (Upstash), SMS delivery and an artificial-intelligence service (Anthropic, see the next section). The brand a complaint is about receives what the previous section describes. We give data to authorities only when the law requires it. Some of these providers are located outside Montenegro, including in the European Union and the United States. Data is transferred with the safeguards the law requires, such as standard contractual clauses.
6. Processing of complaint text by an external AI service
Before publication, the text of complaints, replies and comments is checked by an automated artificial-intelligence service (Anthropic, USA). It decides only whether a text can be published at once or should be looked at by a moderator. The service never refuses content by itself: every refusal is made by a person, and you are always given the reason. If you use the complaint-writing assistant or the “Translate” button, the text is sent to the same service. Phone numbers, email addresses and similar data are hidden before sending. The company document sent with a request to claim a brand profile is checked in the same way.
7. Where your data is stored
Data is kept on the servers of our hosting and file-storage providers. Passwords are stored only as a one-way hash, and the connection to the site is encrypted (HTTPS).
8. How long we keep your data
We keep account data for as long as the account exists. When you delete your account, your email address, phone number, name, sign-in data, notifications and supports are erased. Your complaints stay published without your name, unless you choose to have them removed when deleting; private attachments and order numbers of the remaining complaints are deleted. The record of moderation decisions is kept after an account is deleted, without your contact details, for the defence of legal claims. Codes sent by SMS are valid for 10 minutes and confirmation links for a limited time.
9. Your rights: access, download, correction, erasure and objection
You have the right to: • learn which of your data we process and receive a copy of it; • have inaccurate data corrected; • have your data erased; • have processing restricted, or object to processing; • receive your data in a form suitable for transfer; • withdraw consent where processing is based on it. No decision that would significantly affect you is made by automated means alone.
10. How to exercise your rights
You can exercise most rights yourself in your account settings: download a copy of your data, edit your profile and delete your account. For anything else write to info@zalba.me. We answer within the time the law sets, and within 30 days at the latest. To protect your data we may ask you to confirm that the account is yours.
11. How we protect your data
Only people who need the data for their work (moderators and administrators) have access to it, and every moderation decision is recorded. Private files are delivered only to those who are entitled to see them. If a data breach occurs that may put your rights at risk, we will notify the supervisory authority and you, as the law requires.
13. Changes to this policy
If this policy changes in a material way, we will tell you on the site or by email before the change takes effect. The date of the last change is at the top of the page.
14. Contact
XTech Montenegro d.o.o., Kralja Nikole br. 12, Podgorica, Crna Gora. Email: info@zalba.me.