Legal

    GDPR Compliance

    The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for individuals within the European Union and the European Economic Area. At Ovdix, we are committed to protecting and properly handling all personal data in accordance with the requirements of GDPR.
    Last updated:October 8, 2026
    Home

    Introduction to GDPR compliance

    The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for individuals within the European Union and the European Economic Area. At Ovdix, we are committed to protecting and properly handling all personal data in accordance with the requirements of GDPR.

    This policy explains how we collect and process your personal data, the legal grounds for such processing, and your rights regarding your personal information.

    Data we collect

    We collect various types of personal data to provide and improve our services:

    Registration data

    When you register to create an Ovdix account, we collect your first name (required) and email address. Your last name is optional and is collected only if you provide it.

    Listing data

    When you create listings, we collect information such as category, title, description, photos, and price details to show your listings to potential buyers.

    Geolocation data

    With your consent, we collect coordinates and address information using Google Maps geocoder to help display relevant listings in your area. We do not collect sensitive location data such as floor or apartment information. Without asking for geolocation, we determine your approximate location (country and city) from your IP address using a local MaxMind GeoLite database on our servers, based on our legitimate interest (Art. 6(1)(f) GDPR) in showing listings from your country. The IP address is not stored for this purpose and is not shared with third parties.

    Translation data

    We log requests made to OpenAI models for instant translations of listings and chat messages to provide our core translation functionality.

    AI assistant data

    Messages you send to the AI assistant, your interface language and, if you share it, your approximate location. For users without an account, also the device identifier and IP address, used for the daily limit and to prevent abuse.

    Payment information

    For one-time boosts and subscriptions, payment data is processed through Google Play and App Store payment systems. We store subscription status and history but not your actual payment data.

    Technical data

    We collect technical data such as IP addresses, cookies, and device information to ensure the proper functioning of our service and for security purposes. We also use analytics services like AppsFlyer to collect technical data and analyze app usage to improve our service and marketing campaigns.

    Usage statistics

    Our website and mobile application send a random device identifier with each request to our servers (on the website it is generated in your browser and kept in its local storage; in the application it is the identifier the operating system assigns to the app). We use it to count unique devices per day together with their platform and interface language, to see how many visitors later create an account, and to count each listing view once. On the website, and only with your consent, we additionally use Yandex Metrica, Meta Pixel and the Google Ads tag.

    Purposes and legal bases for processing

    We process your personal data based on the following legal grounds:

    • Contract performance: To provide our services in accordance with our Terms of Use.
    • Legitimate interests: To improve the quality of translations and enhance the overall level of our service.
    • Legitimate interests: To promote publicly posted listings on Ovdix's official channels on social networks and messaging platforms (e.g., Telegram, Instagram). You may object to this at any time.
    • Consent and legitimate interests: To show relevant ads through Google AdMob for users of our free tier.
    • Legitimate interests: To measure the use of our service by counting unique devices per day using a device identifier, and to count listing views once. Consent: For the web analytics and advertising tools on our website (Yandex Metrica, Meta Pixel, Google Ads), which are activated only after you accept cookies in the consent banner.
    • Consent: Sharing your messages to the AI assistant with OpenAI to generate answers (Art. 6(1)(a) GDPR). You can withdraw your consent at any time.
    • Legal obligations: To comply with applicable laws and regulations.

    Disclosure to third parties

    We may share your information with the following third-party service providers:

    Server hosting (IONOS SE, Germany)

    Our backend and database run on our own servers located in the European Union (Germany), operated by the hosting provider IONOS SE. Keeping data in the EU ensures a high level of protection in accordance with GDPR.

    Google OAuth v2

    Used for authentication purposes, allowing you to log in with your Google account.

    Google Maps Services

    Used for geocoding, displaying maps, and providing place information (Places API). We apply these Google services to convert coordinates into addresses, display maps in the interface, and assist the user in selecting a location related to their listing. Google may collect and process this data in accordance with its Privacy Policy.

    Google AdMob

    Used to display ads to users of our free tier. AdMob may collect and process data about your use of the app for ad targeting.

    Google Play and App Store

    Used for processing payments and subscriptions. These platforms process all payment data in accordance with their own privacy policies.

    OpenAI

    Used for automatic translation and language detection of listings and chat messages, drafting listings from photos, and the AI assistant. Content is processed on OpenAI servers in the US under appropriate safeguards (Standard Contractual Clauses); under our API agreement this data is not used to train OpenAI models.

    Google Firebase

    Used in the mobile application for push notifications (Cloud Messaging), crash reporting (Crashlytics), and aggregated usage analytics (Firebase Analytics).

    Yandex AppMetrica

    Used to analyze mobile app usage and diagnose crashes. The data is processed in aggregated and pseudonymized form and may be processed outside the EEA. Details are available in the Yandex Privacy Policy.

    AppsFlyer

    We use AppsFlyer to analyze how users interact with our mobile application. AppsFlyer collects data such as device identifiers, usage data, and interactions to help us improve our services and marketing campaigns. This data may be transferred outside the European Economic Area (EEA). You can find more detailed information in the AppsFlyer Privacy Policy at https://www.appsflyer.com/legal/services-privacy-policy/.

    Meta Pixel

    Used on our website, with your consent, to measure the effectiveness of our advertising on Facebook and Instagram (Meta Platforms Ireland Ltd.). Activated only after you accept cookies in the consent banner. Details are available in the Meta Privacy Policy.

    Google Ads

    Used on our website, with your consent, to measure the effectiveness of our advertising in Google Search (Google Ireland Limited): it links a click on an ad to actions on the website. Activated only after you accept cookies in the consent banner; the data may be processed outside the EEA. Details are available in the Google Privacy Policy; you can manage ad personalization in Google Ads Settings.

    Yandex Metrica

    Used on our website, with your consent, to analyze site traffic and improve the interface, including anonymized session recordings (private areas such as chats are excluded). Activated only after you accept cookies; the data may be processed outside the EEA. Details are available in the Yandex Privacy Policy; you can opt out on the Yandex Metrica opt-out page.

    Amplitude

    Used on our website (with your consent) and in the mobile application for product analytics: which features are used and where users abandon a flow, including anonymized session recordings on the website (private areas such as chats and input fields are masked). Events carry a random device identifier and, once you are signed in, your account identifier. The data is stored in the United States by Amplitude, Inc. under Standard Contractual Clauses; details are available in the Amplitude Privacy Notice.

    YouTube

    Used to embed the product video on the About page. The player is loaded only after you click Play and runs on the cookieless youtube-nocookie.com domain; from that point on, Google processes your IP address and playback data as a separate controller.

    MaxMind GeoLite

    Local database used to determine the approximate country and city from an IP address for the home page feed. It runs on our servers; no personal data is transferred to MaxMind, Inc. (USA). This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

    Your rights under GDPR

    Under GDPR, you have several rights regarding your personal data:

    • Right of access: You may request a copy of your personal data that we hold.
    • Right to rectification: You may request correction of inaccurate personal data.
    • Right to erasure: You may request deletion of your personal data under certain circumstances.
    • Right to restriction of processing: You may request restriction of processing your personal data.
    • Right to object: You may object to processing based on legitimate interests.
    • Right to withdraw consent: You may withdraw your consent at any time when we rely on consent to process your personal data.
    • Right to data portability: You may request to receive your data in a structured, machine-readable format.
    • Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority — in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU/EEA, the authority of your country.

    To exercise any of these rights, please contact us at egorozh.dev@gmail.com. We will respond to your request within one month.

    Data retention and security

    We store various categories of data for different periods. Your personal data is processed and stored on our own servers located in the European Union (Germany), in accordance with GDPR requirements.

    • Account data: Retained as long as you have an active account and for 30 days after account deletion.
    • Listing data: Retained as long as the listing is active, plus 90 days after deletion for legal and analytical purposes.
    • Message data: Retained as long as both users have active accounts, and for 30 days after account deletion.
    • Payment records: Retained for the legally required period (usually 7 years for tax purposes).
    • Technical data: Retained for up to 90 days for security and performance analysis.
    • Device usage statistics: Daily records are retained for up to 25 months; the link to your account is removed when the account is deleted.
    • AI assistant conversations: 90 days after the last message, then deleted automatically; daily usage counters up to 31 days. When you delete your account, conversations are deleted immediately.

    Security measures

    We implement appropriate technical and organizational security measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

    These measures include encryption of personal data, regular security assessments, access controls, and staff training on data protection and security.

    Contact details of the data controller

    Organization: EGOR ZHELUDKOV PR NOVI SAD
    Address: 21102, Novi Sad, Miše Dimitrijevića 38, Floor 3, Apartment 10
    Email: egorozh.dev@gmail.com