Privacy Policy

1. Who we are

Deestr is a B2B ordering app: restaurants, cafés, bars and other hospitality businesses ("Buyers") send orders to their suppliers ("Suppliers") through the Deestr mobile apps, the web store at store.deestr.com and the supplier admin at supplier.deestr.com (together, the "Service"). The website deestr.com describes the Service.

The Service is operated by Devvela, Inc., 1341 W Fullerton Ave, suite 176, Chicago, IL 60614, USA ("Deestr", "we", "us"), which is the controller of the personal data described in this policy. For any privacy question or request, write to hello@deestr.com.

The Service is intended for businesses only. It is not intended for consumers or for persons under 18.

2. What data we process

• Account data: name, e-mail address, phone number (Supplier users), language, password (stored only as a hash) and the codes we send to confirm your e-mail address.
• Business data: company name, tax number (PIB/VAT), registration number, delivery and billing addresses, venue name, contact person and phone numbers.
• Orders: products, quantities, prices, delivery dates, comments and order statuses, together with the name and e-mail address of the person who placed the order.
• Device and usage data: app version and platform, the push notification token of your device, the time you last used the app, IP addresses and technical logs, and error reports when something goes wrong.
• Messages to us: what you send through the feedback and contact forms, including attached images, and whether we may contact you about it.
• Website visits: pages visited, referrer, device and approximate location, collected with Google Analytics on deestr.com.

Most of this data is provided by you or by your company. A Supplier may also add its existing customers (business data and the e-mail address of a contact person) to invite them to the Service.

3. Why we use it and on what basis

• To provide the Service: create and manage accounts, connect Buyers with their Suppliers, deliver orders, send order and account e-mails and push notifications. Basis: performance of our contract with you or your company.
• To keep the Service secure and working: prevent misuse, fix errors and monitor performance. Basis: our legitimate interest.
• To improve the Service and understand how it is used, including app and website analytics. Basis: our legitimate interest, or your consent where the law requires it.
• To answer your messages and send information about the Service you use. Basis: our legitimate interest. You can opt out of non-essential e-mails at any time.
• To meet legal obligations, such as accounting and tax records for Supplier subscriptions. Basis: legal obligation.

We do not sell personal data and do not use it for advertising.

4. Who sees your data

Buyers and Suppliers. When a Buyer connects to a Supplier or places an order, that Supplier sees the Buyer's business data, the order and the name and e-mail address of the person who placed it. Buyers see the Supplier's catalog, prices and delivery terms. Each Supplier is responsible for how it uses the data of its customers outside the Service.

Service providers that process data on our behalf:

• Hetzner Online (Germany): servers and database, located in Finland;
• Cloudflare (USA): hosting of the website and network services;
• Brevo (France): sending e-mails;
• Google (USA): Firebase Cloud Messaging for push notifications, Firebase Analytics in the apps and Google Analytics on the website;
• Sentry (USA): error reports;
• Apple and Google: app distribution through the App Store and Google Play.

We may also disclose data when the law requires it or to protect our rights.

5. International transfers

Our servers are in the European Union. Some of the providers above, and Devvela, Inc. itself, are in the USA. Where data is transferred outside Serbia, the EU or the EEA, we rely on the safeguards the law provides, such as standard contractual clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

6. How long we keep it

We keep account and business data while the account is active. Orders are kept while the accounts of the Buyer or Supplier involved are active, so both can see their order history. When an account is closed, we delete or anonymise its data within 90 days, except data we must keep longer by law (for example, accounting records). Technical logs and error reports are kept for a limited period, usually no longer than 90 days.

7. Your rights

Under the Serbian Law on Personal Data Protection (ZZPL) and, where it applies, the EU General Data Protection Regulation (GDPR), you can ask us to: access your data; correct it; delete it; restrict or object to its processing; receive it in a portable format; and withdraw consent you have given. Write to hello@deestr.com; we answer within 30 days.

You can also lodge a complaint with a supervisory authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), or the data protection authority of your EU country.

You can turn off push notifications in your phone settings, and block website analytics with your browser settings or the Google Analytics opt-out add-on.

8. Security

Data is sent over encrypted connections (HTTPS), passwords are stored only as hashes, and access to servers and databases is limited to the people who need it. No system is completely secure; if a breach affects your data, we will inform you and the authorities as the law requires.

9. Changes to this policy

We may update this policy. The date at the top shows the latest version. If the changes are significant, we will tell you by e-mail or in the app.