Privacy Policy

This Privacy Policy explains how SLOBODAN ANTIC PR SPECIJALIZOVANE DIZAJNERSKE DELATNOSTI ANTIC DESIGN KRAGUJEVAC ("Oqtalium", "we", "us") handles personal data in connection with the Service. Data controller: SLOBODAN ANTIC PR SPECIJALIZOVANE DIZAJNERSKE DELATNOSTI ANTIC DESIGN KRAGUJEVAC, KRALJA ALEKSANDRA I KARAĐORĐEVIĆA 66A/11, 34000 KRAGUJEVAC, SRBIJA, support@oqtalium.com. We process personal data in accordance with the Serbian Law on Personal Data Protection and, where it applies, the EU/UK General Data Protection Regulation (GDPR).

1. Data we process

• Account data you provide — such as your name, email and login credentials.
• Studio and business data you enter — your studio's metrics, notes, and content including any member feedback or quotes you add.
• Usage and technical data — basic information about how you use the app, generated automatically to operate and secure the Service.

We do not intentionally collect special categories of personal data — such as health, medical, biometric or similar sensitive information. Because Oqtalium is used by fitness and wellness businesses, take particular care not to enter such data about your members or staff (for example, injuries, medical conditions, pregnancy or health goals) unless you have the specific lawful basis that special-category data requires. Where you do, you act as the controller for that data and are responsible for meeting those heightened requirements.

2. Data you enter about other people

You may enter data relating to your members, staff or other individuals. For that data you are the controller: you must have a lawful basis and provide any required notices or obtain any required consents. In respect of such data, we act as your processor and process it only to provide the Service to you.

3. How and why we use data

We use data to provide, operate, maintain, secure and improve the Service; to generate AI outputs at your request; to provide support; and to comply with legal obligations. Where GDPR applies, our legal bases are performance of a contract, our legitimate interests in operating and improving the Service, your consent where required, and compliance with legal obligations.

4. AI processing

To generate outputs, the content you and Oqtalium put into the Service is sent to our third-party AI provider (Anthropic) for processing and returned to you. This processing is solely to produce responses within the Service. We do not use your data to train our own AI models.

5. Service providers (sub-processors)

We rely on trusted providers to run the Service, each processing data only as needed for their function: Anthropic (AI processing), Supabase (database and authentication), Vercel (hosting), and Paddle (payments, as merchant of record). Payment and card details are handled by Paddle; we do not store your card information.

6. International transfers

Some providers may process data outside Serbia and the EEA (for example, in the United States). Where required, appropriate safeguards are applied to such transfers.

7. Retention

We retain personal data while your account is active and as needed to provide the Service, and thereafter as required for legal, accounting or legitimate operational purposes. We delete or anonymise data when it is no longer needed, or on valid request.

8. Your rights

Subject to applicable law, you may request access to, correction, deletion, restriction or portability of your personal data, and object to certain processing. To exercise these rights, contact us at support@oqtalium.com. You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection, or your local supervisory authority.

9. Security and data breaches

We use reasonable technical and organisational measures to protect personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for activity under your account.

If a personal data breach affecting your data occurs, we will act promptly to contain and address it and, where and as required by applicable law, notify the competent supervisory authority and any affected individuals without undue delay. Where we process member or staff data on your behalf as your processor, we will notify you without undue delay after becoming aware of a breach affecting that data, so you can meet your own notification obligations.

10. Cookies and local storage

The Service relies mainly on strictly necessary browser storage, together with a small number of essential cookies set by our sign-in and payment providers when those features are used. We do not use advertising or tracking cookies. See our Cookie & Storage Notice for detail.

11. Children

The Service is not directed to, or intended for, anyone under 18.

12. Changes and contact

We may update this Policy and will revise the "last updated" date. For any privacy question, contact support@oqtalium.com.