Privacy Policy for MojPas

Version 2.0 — Last Updated: June 21, 2026

Controller: MultiOne d.o.o., OIB [xxxxxx], Republic of Croatia · privacy@mojpas.net

1. Introduction

MojPas (the "Application") is committed to protecting your privacy in compliance with Regulation (EU) 2016/679 (GDPR) and the Croatian Personal Data Protection Act. This Privacy Policy explains in plain language what personal data we collect, on what legal basis, how long we keep it, who we share it with, and how you can exercise your rights.

2. Data We Collect & Legal Basis

Data Purpose Legal basis (Art. 6) Retention
Email, nameAccount creation, loginContract (b)Until account deletion + 30 days
Pet profile (name, age, traits)Service functionalityContract (b)Until account deletion
Walk GPS track (LineString)Walk tracking, distance, mapContract (b)24 months, then pseudonymised to 1 km grid
Background locationContinuous walk trackingConsent (a)Until revoked + 30 days
Community pin photos / GPSMap sharingConsent (a)Until withdrawn
Chat messagesIn-app messagingContract (b)12 months, then hard-deleted
AI chat prompts & historyDog-care assistantConsent (a) — opt-inUntil revoked
Aggregated, anonymised usageProduct analyticsLegitimate interest (f)Indefinite

3. Background Location (Crucial Disclosure)

MojPas collects location data even when the app is closed (background).

  • Why: Continuous walk-route tracking during calls, screen-off, or app-switching.
  • What: Latitude, longitude, timestamp, speed.
  • Consent: Prominent disclosure screen before first activation; revocable anytime in OS settings.

4. Third Parties & International Transfers

We do not sell your data. We share only what is necessary to deliver the service:

Processor Purpose Data shared Location Safeguard
Google GeminiAI chat assistantLast 10 messages + new promptUSAEU-US DPF
Google Places APILocation autocompleteSearch query + coordinatesUSAEU-US DPF
PostmarkTransactional emailEmail, nameUSAEU-US DPF + DPA
Cloudflare R2Photo / video storageUser-uploaded mediaEUDPA + SCC

Important: Photos you upload to community pins are currently stored in a bucket with publicly accessible URLs. Do not post photos containing faces, documents, license plates, or other identifying details unless you intend them to be public.

5. Your Rights (GDPR Art. 15–22)

  • Access (Art. 15) — Export all your data as a ZIP from Settings → Privacy.
  • Rectification (Art. 16) — Edit profile and pet data in-app.
  • Erasure (Art. 17) — Delete your account from Settings → Privacy. Hard-deleted within 30 days.
  • Restriction (Art. 18) — Email privacy@mojpas.net.
  • Portability (Art. 20) — JSON + GeoJSON in the export ZIP.
  • Object (Art. 21) — Opt out of analytics or AI processing at any time.
  • Withdraw consent (Art. 7(3)) — Toggle AI chat or background location off; effect immediate.
  • Complain to AZOP (Croatian Personal Data Protection Agency).

6. Security Measures (Art. 32)

  • Passwords hashed with Django's PBKDF2 / Argon2.
  • HTTPS-only in production; HSTS enabled.
  • Auth tokens for API; tokens are not logged.
  • All personal-data access recorded in a separate audit log with 12-month rotation.
  • Database backups encrypted at rest.

7. Automated Decision-Making (Art. 22)

The AI chat assistant (Gemini) provides information only. No automated decisions with legal or similarly significant effects are made about you.

8. Contact

MultiOne d.o.o. (controller)

Privacy requests: privacy@mojpas.net

General: multione@multione.hr

Supervisory authority: AZOP — azop.hr

This document is the legally binding Privacy Policy for the MojPas mobile application, version 2.0, effective 21 June 2026.