Privacy Policy

The data controller is SET-UP, a business being registered in Croatia. For any privacy questions, reach us via the Questions page (/help) or the contact listed in the site footer.

Your email address and password at signup (the password is stored encrypted only, never in readable form). The display name you choose (a nickname). Optional: phone number, profile photo.

Your lifestyle quiz answers and chosen chips (curiosity/wish chips) — used for matching, never as a hard filter.

Full legal name and OIB (Croatian national ID number) — only once and if you reach the Sporazum step; these fields stay empty until then.

The content of messages exchanged with the other side of a match.

Reviews written after move-out.

Listing details if you publish a place for rent (address, photos, description, price, house rules).

Data is collected to actually deliver the service you're using — creating an account, matching, enabling conversation, drafting the Suživot Sporazum, and processing Suživot's own service fee. We collect full legal name and OIB for two separate purposes, each with its own legal basis. First, to identify the parties named in the Suživot Sporazum you draft with the other party — here the basis is performance of a contract with you (GDPR Article 6(1)(b)), i.e. providing the Sporazum-drafting service you requested. Second, if you pay Suživot's service fee, OIB is stated on the invoice we issue for that payment — here the basis is our legal obligation to issue a valid invoice under Croatian accounting rules (point (c)). These two uses of OIB are separate from each other: if you never reach the payment step, OIB is never used for accounting purposes. We don't sell or rent your data to third parties for marketing purposes.

The legal basis for the rest of the data is, for most of it, performance of a contract with you (point (b)) — providing the service you signed up for. For security measures and preventing misuse of the platform we rely on our legitimate interest (point (f)), and for data we're legally required to retain (e.g. for accounting rules) on a legal obligation (point (c)).

The other side of a match sees your display name, profile photo (if set), matching chips, and any messages you send. They won't see your email address.

Your full legal name and OIB are seen only by the person you're concluding the Suživot Sporazum with, in the Sporazum and its PDF. This is necessary for the Sporazum to identify the contracting parties.

To send email notifications (new message, chosen, payment confirmation) we use Resend (resend.com) — it receives the recipient's email and the notification content.

To draft the house-rules addendum in the Sporazum and to answer questions on the help page (/help), we use the Anthropic Claude API — it receives the relevant entered data (e.g. house-rules answers, the question asked) to generate text. This provider processes data outside the European Union; we rely on their standard contractual clauses for international data transfer.

If you pay Suživot's service fee, payment is handled by a specialized third-party payment processor (at the time of writing, payment is simulated and no real transaction is processed).

We keep your data while your account is active. If you request account deletion, we delete or anonymize personal data within a reasonable period, except where we're legally required to keep it longer (e.g. accounting requirements once real payment exists).

Under the GDPR, you have the right to: access your data, correct inaccurate data, request deletion, restrict processing, receive your data in a portable format, and lodge a complaint with Croatia's data protection authority (AZOP) if you believe your rights have been violated. Most of these you can exercise directly from your profile (editing your name, removing your photo); for anything else, reach us via /help.

Passwords are stored encrypted only (bcrypt), never in readable form. Session access is protected by a signed cookie. The application's source code isn't publicly accessible. That said, no system is perfectly secure — if you notice a security issue, let us know right away via /help.

We use only strictly necessary cookies: one for your logged-in session, one to remember your chosen language (Croatian/English). We don't use tracking or third-party advertising cookies.

This policy may be updated from time to time. The date of the last change is shown at the top of the page. Significant changes will be announced more prominently, e.g. by email or an in-app notice.