Politika privatnosti i bezbednost podataka

The Data Controller responsible for the platform and direct user accounts is Bridgiva LLC, a limited liability company organized under the laws of the State of Delaware, United States, while napravi.site is a regional brand and service operated by Bridgiva LLC:

• Legal Entity (Data Controller): Bridgiva LLC (Delaware, USA)
• Registered Office Address: 131 Continental Dr Ste 305, Newark, DE 19713-4324, USA
• Chief Executive Officer (CEO): Mihajlo Jezdić
• Covered Domains & Brands: https://bridgiva.com and https://napravi.site
• Official Showcase Mobile Application: Bridgiva Demo (Package Name: com.napravi.site.demo)
• Store Submissions & Policy Compliance: [email protected]
• Data Protection & Privacy Contacts: [email protected] and [email protected] (or [email protected])

The mobile application Bridgiva Demo (com.napravi.site.demo) operates as an interactive showcase and live companion previewer for e-commerce stores. In full alignment with Google Play User Data Policy and Apple App Store guidelines, we provide complete transparency regarding mobile data handling:

• Personal User Information: Name, email address, and optional phone number entered by the user during account registration or checkout simulation.
• Device Identifiers & Telemetry: Device hardware model, operating system version (Android/iOS), screen dimensions, and diagnostic crash logs used strictly to maintain stability and troubleshoot technical bugs.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) registration tokens, used strictly to deliver transactional order updates and opted-in notifications requested by the user.

To ensure compliance with the Google Play User Data Policy and international data security standards, Bridgiva LLC enforces strict technical, cryptographic, and organizational safeguards:

• Encryption in Transit (Data Transmission Security): All network communications between the mobile application (com.napravi.site.demo), web browsers, and Bridgiva servers are encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3 / HTTPS). Unencrypted plaintext HTTP traffic is blocked at the Android operating system level via Network Security Configuration (cleartextTrafficPermitted="false").
• Encryption at Rest (Storage Security): On mobile devices, authentication tokens are stored in hardware-backed operating system storage (Android Keystore / iOS Keychain via SecureStore). On the backend, sensitive integration secrets and OAuth/API tokens are encrypted with AES-256-GCM prior to storage in PostgreSQL databases hosted in ISO 27001 certified European data centers (Hetzner Online GmbH, Germany/Finland).
• Architectural Isolation (Multi-Tenancy): Every merchant’s production data is logically isolated by tenant_id, while our B2B store discovery and demo preview environment operates on a physically separate server and database in Germany.
• Access Control & Least Privilege: Production servers and databases are restricted to authorized engineering personnel using SSH keys, Multi-Factor Authentication (2FA/TOTP), and immutable security audit logs.

The Bridgiva Demo mobile application and client applications use a minimal set of device permissions:

• Camera & Photo Library: Accessed solely upon explicit user initiation—for example, when scanning a QR code to launch a live store preview on a phone, or when uploading an avatar or product image. The application never records background audio or video.
• Local Device Storage (AsyncStorage / SecureStore): Used to cache Server-Driven UI layouts, language/theme preferences, and encrypted authentication tokens until sign-out.

To introduce our store-to-app service to owners of existing online stores, our automated system hosted on an isolated server in the European Union (Germany — Contabo GmbH) processes strictly publicly available corporate/business information published on e-commerce websites:

• Scope of Public Business Data: Store name, public domain name, publicly listed business contact email address and business phone number, store logo, theme color palette, and a limited sample of publicly listed catalog items (up to 5 public products and 1 public article/blog post) used to generate a temporary, non-commercial mobile app preview accessible via a 6-digit PIN code.
• Legal Basis: Processing is conducted under our legitimate interest in B2B direct marketing of relevant software services to commercial businesses (Article 6(1)(f) GDPR and Article 12 of the Serbian Personal Data Protection Act), in compliance with applicable electronic communications laws (including CAN-SPAM and ePrivacy B2B rules). Demo page visit analytics record only a truncated SHA-256 hash of the visitor IP address (32-character ip_hash, without storing raw IP addresses in demo analytics).
• One-Click Unsubscribe & Permanent Suppression List: Every B2B outreach email includes a prominent one-click unsubscribe link (/unsubscribe), RFC 8058 List-Unsubscribe headers, and reply opt-out support. When a recipient unsubscribes or objects to processing (Art. 21 GDPR), their email address or domain is immediately added to our permanent suppression list (outreach_suppressions table) so they are never contacted again for marketing.
• Retention of B2B Contacts: Unresponsive B2B store leads and demo previews that do not register an account are deleted no later than 12 months after the last contact, while suppression list entries (only the email address or domain in outreach_suppressions) are retained indefinitely solely to honor opt-out requests.

When a merchant (our registered business client / Tenant) connects their online store (Shopify, WooCommerce, Magento 2, PrestaShop, Shopware 6, Wix, Joomla/VirtueMart, MerchantPro, OpenCart, or custom storefront) to Bridgiva / napravi.site:

• The Merchant is the Data Controller: The merchant determines the purposes and means of processing its customers’ personal data and is responsible for its own store privacy notice.
• Bridgiva LLC is the Data Processor: Acting strictly on the merchant’s documented instructions pursuant to Article 28 GDPR (and the Data Processing Addendum incorporated into our Terms of Service), we process customer data solely to operate the merchant’s mobile application, synchronize orders/catalogs, and deliver order or cart notifications: customer name, email address, phone number, shipping/billing address, cart contents (including abandoned carts), order history, and push notification device tokens.
• No Independent Use: Bridgiva LLC never uses a merchant’s customer data for its own marketing, never shares it across merchants, and deletes or anonymizes it upon the merchant’s instruction, GDPR webhook trigger, or termination of the merchant’s account.

We engage the following vetted third-party service providers (Sub-Processors) to host infrastructure, process payments, deliver communications, compile mobile applications, and support merchant integrations:

On bridgiva.com and napravi.site, we use strictly necessary cookies for authentication and security, while analytics and advertising cookies for visitors in the EEA/UK/CH are disabled by default via Google Consent Mode v2 until you grant explicit consent:

We retain personal and business data only for as long as necessary to fulfill the purposes outlined in this policy, enforced through automated retention schedules in our codebase:

• Free Trial (14 Days) & Post-Expiration Grace Period (15 Days): Every merchant account starts with a 14-day free trial (TRIAL_DAYS = 14). If a trial or paid subscription expires without renewal, the account enters a 15-day grace period (GRACE_DAYS = 15), after which our automated purge routine (purgeAccountData) permanently deletes all customer records, orders, carts, push tokens, CMS access tokens, and catalog items from the production database.
• Accounting & Tax Records: Issued invoices and statutory payment transaction records are retained for 10 years in compliance with mandatory tax and accounting laws.
• Shopify GDPR Webhooks: Upon receiving a Shopify shop/redact webhook (48 hours after app uninstallation), all store data is purged. Upon customers/redact, customer PII is deleted or anonymized in order records, while encrypted customers/data_request exports expire automatically after 30 days.
• Short-Lived (Ephemeral) Technical Records: Authenticated web sessions (mslf_session) expire after 24 hours; pre-install deferred deep link records (preview_deferred_deep_links) expire automatically after 2 hours; temporary 3-hour Live Demo Sandbox accounts are purged after session expiration.
• B2B Store Contacts: Unresponsive B2B store leads are deleted no later than 12 months after the last contact, while opt-out suppression entries (outreach_suppressions) are kept indefinitely solely to prevent future contact.

In full adherence to Google Play and Apple App Store account deletion requirements and the GDPR Right to Erasure (Art. 17 GDPR), Bridgiva LLC provides a straightforward process to permanently delete your account and associated personal data:

The Data Controller, Bridgiva LLC, is incorporated in the United States (131 Continental Dr Ste 305, Newark, DE 19713-4324, USA). Our primary production database cluster (Hetzner Online GmbH) and our isolated B2B demo server (Contabo GmbH) are physically hosted in the European Union (Germany and Finland).

When personal data is transferred to the United States or other countries outside the European Economic Area (EEA), the United Kingdom, or the Republic of Serbia—whether accessed by the Data Controller or processed by the Sub-Processors listed in Section 9 (such as Cloudflare, Stripe, Google, Apple, OpenAI, MXroute, Resend, Expo, Meta, LinkedIn, GitLab, or GoDaddy)—such transfers are protected by:

• EU-U.S. Data Privacy Framework (DPF): Where the U.S. recipient is certified under the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework;
• Standard Contractual Clauses (SCCs): Adopted by the European Commission pursuant to Article 46(2)(c) GDPR (and corresponding provisions of the Serbian ZZPL), supplemented by technical encryption safeguards (TLS 1.3 in transit and AES-256 at rest);
• Adequacy Decisions: Such as transfers to Shopify Inc. in Canada under the European Commission’s PIPEDA adequacy finding.

We do not sell, rent, trade, or monetize personal or sensitive user data to data brokers, ad networks, or third parties for monetary or other consideration.

Children’s Privacy (COPPA & GDPR): The Bridgiva platform and Bridgiva Demo application are intended for commercial businesses and general audiences aged 16 and older (or 13+ under US COPPA guidelines). We do not knowingly collect personal information from children; if we become aware of such collection without verifiable parental consent, we will delete it promptly.

Depending on your jurisdiction, including under the EU General Data Protection Regulation (GDPR), the Serbian Personal Data Protection Act (ZZPL), and the California Consumer Privacy Act (CCPA/CPRA), you have the following rights:

• Right of Access & Data Portability (Arts. 15 & 20 GDPR): Request confirmation of processing and receive a structured, machine-readable copy (JSON) of your personal data.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): Request permanent deletion of your personal data.
• Right to Restriction of Processing (Art. 18 GDPR).
• Right to Object & Withdraw Consent (Arts. 7 & 21 GDPR): Object at any time to processing based on legitimate interests (including B2B direct marketing via the one-click unsubscribe link) or withdraw cookie consent.
• California Residents (CCPA/CPRA): Right to know, right to delete, right to correct, and right to non-discrimination (we do not sell or share personal information for cross-context behavioral advertising without consent).
• Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR / Art. 82 ZZPL): If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority:
  • In the Republic of Serbia: Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia (www.poverenik.rs, email: [email protected]).
  • In the European Union / EEA: Your national Data Protection Authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement (directory available via the European Data Protection Board: edpb.europa.eu).

To exercise any of these rights, contact us at [email protected] or [email protected]. We will respond without undue delay, and no later than 30 days from receipt of your request.

This Privacy Policy was last updated on November 9, 2026. Any material modifications will be published on this page with an updated revision date.