Privacy policy
Draft for owner/legal review — not final legal terms or legal advice. Version: 4 November 2026.
Who we are and how to contact us
OLRENTY is a direct-booking platform operated by Dejan Janjatović, a private individual, at Bulevar Arsenija Čarnojevića 104, 11000 Belgrade, Serbia ("OLRENTY", "we"). We are the controller of personal data collected through this site. We have not appointed a dedicated Data Protection Officer; current Serbian law does not require one given the scope of our processing. For privacy and data-protection questions, write to office.nexumad@gmail.com.
Data we process
Booking requests collect your full name, email, optional phone number, apartment, dates, guest count and price breakdown. Name, email and stay dates are required to process your request — without them we cannot forward it to the host; phone number is optional. AI search processes your latest message and previously validated search criteria. Do not send identity documents, card details or access codes in AI messages. Technical data includes request times and a hash of your IP address to prevent abuse.
Purposes and legal basis
We use data to process your request, check availability, communicate and prepare and deliver your stay. Request processing is based on steps before entering a contract and contract performance; service protection on the legitimate interest in preventing abuse; mandatory records on legal obligations. We do not use your data for marketing or profiling without your separate, prior consent.
Who receives your data and where it is stored
The host receives data needed for the booking and stay. Hospitable processes reservations (USA). Lovable Cloud (Supabase, hosted on AWS, region us-east-1 in the United States) provides hosting, the database, data storage and email delivery; the Lovable AI gateway and configured OpenAI model process AI search, also in the USA. Your data is therefore processed and stored in the United States, not in Serbia or the EU. The legal basis for this transfer is the Standard Contractual Clauses applied under our providers' data processing agreements, consistent with Article 65 of Serbia's Personal Data Protection Act. A copy of the relevant safeguards is available on request at office.nexumad@gmail.com. Neither Lovable nor Supabase access your data for their own purposes — they act as processors on our instructions, not as independent controllers.
Retention — proposal for review
The proposed, configurable retention period for unsuccessful requests is 12 months after closure. Completed booking data is kept as needed for the stay and legal obligations; exact statutory periods are confirmed by the owner/accountant. Automatic timed deletion of requests is not yet implemented. AI conversation is held in the open page's memory, with no persistent chat history in the app. AI rate-limit hash records older than one day are deleted during subsequent limit processing.
Your rights and contact
You may request access, correction or deletion of your data (except where a legal obligation requires retention), restriction of processing, object to processing based on legitimate interest, request data portability where applicable, and withdraw consent at any time where processing relies on it — withdrawal does not affect the lawfulness of earlier processing. You may lodge a complaint with Serbia's Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs), independent of any other remedy. AI search does not make automated decisions with legal or similarly significant effect on you — it does not confirm bookings, approve discounts or determine final price or availability; the host always makes the final decision. If already in contact with your host, use that same channel and identify your request as privacy-related; do not send documents through AI. For privacy questions, write to office.nexumad@gmail.com.
Cookies and local storage
The application code does not use third-party tracking cookies or advertising analytics. Necessary browser storage supports request-status access and team sign-in; the team interface may store its sidebar preference in a cookie. Hosting and providers may record technical logs. Fonts load from Google Fonts and photos from a content-delivery network, exposing ordinary network information such as your IP address to those services. Their terms should be reviewed.