Privacy Policy

AI Instalater (AI Installer) is a brand operated by SERBIA ART DOO, Milutina Milankovića 7Đ, 11070 Belgrade, Serbia; PIB / Tax ID: 106663149; MB / registration no.: 20655356. Privacy and rights contact: djordje@ainstalater.com.

This policy covers website visitors, people contacting us, portal users and people communicating with business WhatsApp accounts connected to our platform. Processing depends on the features enabled; describing a feature does not mean it is available to every client.

SERBIA ART DOO is the controller for its own inquiries, contracts, user accounts, security and billing. When processing conversations and knowledge sources for a business client, the client generally determines the purposes as controller and we act as processor under documented instructions and an agreement. SERBIA ART DOO is the controller for conversations with AI Instalater itself.

Inquiries and contracts: name, business email, company, website, role, interests, process descriptions, messages and other information you supply. Technical information may include IP address, requested page, request time, browser information and security logs.

Portal and Meta connection: sign-in identity, business contact, organization and permissions, Meta Business Portfolio ID, WhatsApp Business Account (WABA) ID, Phone Number ID, business phone number, display name, granted permissions and access tokens. Meta handles its own login and permission approval; we do not request your Facebook or Meta password.

Conversations and automation: participant phone numbers or identifiers, profile names, message content, delivery times and statuses, voice messages and transcripts, images and descriptions, voluntarily shared locations, contact details, conversation history, human handoff and automation records. Knowledge sources include documents, text and sources approved by the client. Billing information may include plan, usage quantities and service costs.

Do not send passwords, API keys, full payment-card details, health information or other highly sensitive information through an ordinary contact form or chat. Such processing requires a separately established lawful basis, agreement and appropriate safeguards.

We use information to answer inquiries, prepare offers and perform contracts, provide the portal and WhatsApp connection, support users, answer business questions with AI, transcribe audio, retrieve knowledge and run enabled workflows. We also process information for security, troubleshooting, billing and legal obligations.

Depending on the relationship and purpose, the basis is steps you request before a contract or performance of a contract, a legal obligation, a legitimate interest in business communication and service protection balanced against your rights, or consent where required. You may withdraw consent without affecting earlier lawful processing. Business clients are responsible for the legal bases, notices and permissions for their customer conversations.

We do not sell conversation data or use it for our own independent advertising. Sending an inquiry is not consent to marketing messages.

When AI is enabled, relevant messages, limited conversation history and selected knowledge excerpts may be sent to the OpenAI API to prepare a response. Audio may be sent for transcription, images for analysis and text for voice generation. The client may enable or disable individual features.

Knowledge retrieval for a response is not the same as training a model. We do not use client conversations to train our own general-purpose AI model. AI-provider processing and retention also depend on its contractual terms and API-account configuration.

AI can make mistakes. You may request a human; the business client determines operator availability. This service is not intended for solely automated decisions producing legal or similarly significant effects, emergency assistance, or a substitute for professional medical, legal or financial advice.

Authorized staff of the operator and relevant business client may access information as needed to provide the service. Meta/WhatsApp processes information for account connections, messaging and delivery. Cloudflare hosts the WhatsApp platform and database. OpenAI provides enabled AI functions; ChatGPT/Sites portal sign-in also involves that authentication provider.

The website uses hosting infrastructure and may load Spline 3D content, whose external host receives standard request information. When configured, the contact form delivers information through Resend or a business webhook. Booking may lead to an external provider. CRM, calendar and other integrations receive information only when connected for the relevant workflow.

Information may be disclosed to authorities where legally required. This policy does not replace the policies of Meta, OpenAI, other providers or the business you are communicating with.

Infrastructure, communications and AI providers may process information in Serbia, the European Economic Area, the United States and other countries where they operate. We do not represent that all processing stays in Serbia or the EU.

Restricted transfers require appropriate legal mechanisms, such as an adequacy decision or contractual safeguards, depending on the service and applicable law. You may request information about recipients and safeguards relevant to your service from our privacy contact.

We retain inquiries as needed for responses, business relationships and requests. Account information, knowledge sources and conversations are retained as needed for the contracted service, client instructions and applicable obligations. When no longer needed or following a valid request, data is deleted or anonymized, except where retention is required for legal obligations or claims.

Retention depends on the record: accounting documents follow statutory requirements; security records their protection and investigation purposes; backups their retention cycles. Retained exceptions are restricted to the relevant purpose, and we explain the grounds on request. We do not promise immediate deletion of every copy held by every provider.

Platform access tokens are encrypted at rest; authorization and logical client separation restrict access to business data. In the current workflow, audio and images are processed temporarily, while transcripts, messages and processing results may remain in conversation history. No system guarantees absolute security.

The current marketing website has no first-party advertising or analytics scripts. Language preferences, security, portal login and Meta connections may use necessary cookies or similar mechanisms. External services have their own policies. Disabling necessary mechanisms may prevent login or connection.

Contact-form protection temporarily processes IP addresses in application memory to limit requests. Hosting and other providers may maintain separate technical logs.

Subject to applicable law, you may request access, correction, deletion, restriction and portability, object to processing, and withdraw consent. Send questions or requests to djordje@ainstalater.com. The /data-deletion page explains deletion without requiring portal sign-in.

We respond without undue delay within applicable legal deadlines; for requests under Serbian data protection law, information about action taken is provided within 30 days. If a lawful extension applies, we explain it within the required deadline. Proportionate identity or authority verification may be needed to protect information.

If our business client is the controller, contact that client or contact us for assistance and forwarding. You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or another competent authority where applicable.

Our portal and platform are intended for business users, not children. Contact us if you believe we received a child's information without an appropriate basis so that we can investigate and act.

We update this policy when services or processing change. The version date appears above. Material changes affecting existing clients are communicated through an appropriate channel; new consent is requested where required.