Privacy Policy

Last updated: 30.09.2026.

This Policy explains what personal data we collect through the AdVerto Portal, for what purposes, on what legal basis, with whom we share it, and what rights you have. Processing complies with the Personal Data Protection Act of the Republic of Serbia and, where applicable, the GDPR.

1. Data controller

MARKO VASIĆ PR PROIZVODNJA KINEMATOGRAFSKIH DELA ADVERTO NOVI SAD, Bulevar despota Stefana 4, Novi Sad, 21000, Srbija, company reg. no. (MB) 68146186, tax ID (PIB) 115161199. Privacy contact: adverto.srb@gmail.com.

2. What data we collect

• Account: name, email, password (hashed), role.
• Brand/company data: name, contact, package, billing details (tax ID, address), goals.
• Content and materials: briefs, scripts, video/graphics, files you share or that are created during work (stored on Google Drive).
• Performance data: metrics from Instagram/TikTok/Meta Ads accounts you connect or provide.
• Application data (lead form): brand name, website, name, email, phone and business answers you enter in the application form - including a partially completed application (from the moment you enter your email), so we can let you resume and send at most one reminder.
• Technical data: cookies necessary for login and session security; on public pages also Meta Pixel marketing cookies (_fbp, _fbc) and related identifiers which, together with hashed contact data and IP address, we share with Meta for advertising measurement and optimization (Pixel and Conversions API).

3. Purposes and legal basis

For each purpose we also state the legal basis - the right that allows us to process the data:

• Providing the service (content production, reporting, portal) - performance of the contract (we process data to deliver what we agreed).
• Invoicing and legal obligations - legal obligation (the law requires us to issue and keep invoices).
• Security and abuse prevention - legitimate interest (protecting accounts and systems from misuse).
• Service communication (transactional email, e.g. password reset) - performance of contract / legitimate interest.
• Processing applications and business communication with prospective clients (responding to your application, scheduling calls, follow-up emails with an unsubscribe link in every email) - legitimate interest / pre-contractual steps.
• Advertising measurement and optimization (Meta Pixel and Conversions API) - consent or legitimate interest, as required by applicable law.

Part of application processing is automated: based on your business answers in the form (e.g. business stage, budget), the system automatically assesses whether we are currently the right partner for you and notifies you by email. This assessment has no legal effect on you - it only determines whether we offer a call. You can always request human review of your application by replying to that email or writing to adverto.srb@gmail.com.

4. Sub-processors (who we share with)

We use vetted service providers who process data on our behalf:

• Supabase: database, authentication.
• Vercel: application hosting.
• Google (Drive): storage of materials.
• Google Calendar and Meet: scheduling and hosting calls.
• Meta / Instagram / TikTok: source of performance data (when you connect accounts) and recipient of marketing signals (Pixel / Conversions API).
• Resend: email delivery (transactional and follow-up).
• Anthropic: AI analysis of your website and growth plan generation.
• Upstash: abuse protection (rate limiting by IP address).
• Manychat: Instagram messages.
• Payoneer: payment collection.
• Sentry: application error monitoring.

We do not sell personal data to third parties. Some providers process data outside Serbia/EU (e.g. the USA); the legal basis for such transfers are appropriate safeguards under applicable law - standard contractual clauses concluded by those processors, available in their data processing terms. You can request a copy of information about these safeguards at adverto.srb@gmail.com.

5. Data retention

We retain different data for different periods:

• Invoices and accounting records - as required by law (under Serbian regulations accounting records are kept for about 10 years), including after the collaboration ends.
• Account data and materials - for the duration of the collaboration; afterwards we delete or anonymize them at your request, except what we must keep by law or to protect legal claims.
• Application data (lead form) - for the duration of our business communication, and no longer than 2 years after the last contact; earlier if you unsubscribe or object. Incomplete applications with no response are deleted no later than 12 months after entry.
• Anonymized or aggregated data that does not identify you may be retained (e.g. internal statistics).

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, portability and objection. Send your request to adverto.srb@gmail.com; we respond within the statutory deadline. You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

7. Security

We apply technical and organizational measures: per-client data isolation (RLS), encryption in transit, access control. In the event of a data incident we act in accordance with statutory notification obligations.

8. Changes

We may update this Policy; material changes are communicated through the portal. The date of the last update is shown at the top.