Vlerso Privacy Policy
DRAFT. Not yet reviewed by a lawyer. Do not publish until a Kosovo lawyer has reviewed it.
Last updated: [date]
Përmbledhje në shqip
Nëse keni lënë një vlerësim: biznesi që keni vizituar përdor Vlerso për t'ju pyetur si ishte vizita. Ne ruajmë yjet që jepni, mesazhin nëse shkruani një, dhe emrin e numrin e telefonit vetëm nëse i jepni vetë ose nëse stafi ju dërgon kërkesë në WhatsApp me pëlqimin tuaj. Biznesi vendos për këto të dhëna, ne i përpunojmë në emër të tij. Nëse shtypni butonin e Google, kaloni te Google dhe ne nuk e shohim çfarë shkruani atje.
Nëse keni llogari biznesi: ruajmë të dhënat e llogarisë, faturat dhe mënyrën si e përdorni shërbimin, për t'jua ofruar shërbimin dhe për detyrimet tatimore.
Ne nuk i shesim të dhënat tuaja dhe nuk i përdorim për reklama. Keni të drejtë t'i shihni, t'i korrigjoni ose t'i fshini të dhënat tuaja, dhe të ankoheni te Agjencia për Informim dhe Privatësi (AIP). Na shkruani në [privacy@vlerso.com].
Ky është vetëm një përmbledhje. Politika e plotë në anglisht më poshtë është ajo që vlen.
1. Who we are
Vlerso is operated by [legal name], [Biznes Individual / SH.P.K.], fiscal number [NUI], [address], Prishtinë, Kosovo. Contact for privacy questions: [privacy@vlerso.com].
This policy follows Kosovo Law No. 06/L-082 on Protection of Personal Data.
This policy covers two groups of people:
- Customers who rate a business or send it a private message through a Vlerso page (section 2).
- Business users: owners and staff who use a Vlerso account (section 3).
2. Customers who leave a rating or message
2.1 Who is responsible
The business you visited decided to ask for your feedback, so the business is responsible for your data (the controller). Vlerso processes it on the business's behalf (the processor), under a contract with the business. You can contact the business directly, or contact us and we will pass your request on.
2.2 What we collect
| Data | When |
|---|---|
| Your star rating (1 to 5) | Always, when you rate |
| Date and time of your rating and of each step (opened, rated, tapped a button) | Always |
| Which staff link or QR code you used | Always, so the business can see which staff member asked |
| The language you chose | Always |
| Your private message | Only if you write one |
| Your name and phone number | Only if you choose to give them with a private message, so the business can reply |
| Your first name and phone number | Only if a staff member sends you a review request by WhatsApp or Viber after asking you. The staff member types them in, and they are used to open the message on the staff member's phone |
What we do not do:
- We do not ask you to create an account.
- We do not use your IP address to work out your location or identity, and we do not build profiles. Our hosting provider sees your IP address to deliver the page and keeps it in security logs for up to 30 days.
- We do not access your contacts, your location or your WhatsApp or Viber messages.
- We do not use advertising or tracking cookies on the rating page.
2.3 Why we use it
- To show the business how customers rated their visit, and statistics such as how many people rated or tapped the Google button.
- To deliver your private message to the business, so they can fix a problem and, if you left your number, contact you.
- To keep the service secure and working.
The business's legal basis is usually its legitimate interest in hearing from its customers, or your agreement when you give your phone number or accept a WhatsApp request. You can always choose not to rate, not to write, and not to give your name or number.
2.4 The Google button
Every customer sees the same two options after rating: write a Google review, or send a private message to the business. If you tap the Google button, you leave Vlerso and go to Google. Anything you write on Google is handled by Google under Google's Privacy Policy. We only record that the button was tapped, not what you write.
Please do not include medical details or other sensitive information in a private message.
2.5 How long we keep it
| Data | How long |
|---|---|
| Private message, and the name and phone number given with it | 12 months after the business marks it resolved, then deleted |
| Name and phone number used for a WhatsApp or Viber review request | 90 days, then deleted |
| Star rating, timestamps, staff link, language | Kept for the business's statistics. After 12 months they are no longer linked to any name or phone number |
| Everything about you, if the business closes its Vlerso account | Deleted within 30 days |
3. Business users
3.1 Who is responsible
For your account data, Vlerso is the controller.
3.2 What we collect
- Account details: your name, business name, email, phone or WhatsApp number, password (stored in encrypted form), language.
- Business details: legal name, fiscal number, address, logo, colours, Google place, competitors you choose to track, staff first names.
- Billing: invoices, payment status, bank transfer references.
- Usage: logins, settings changes, requests sent by your staff, and support messages you send us.
- Sales contact: if we contacted you before you signed up, the public business information we used (for example your Google rating and review count) and the contact details on your public business profile.
3.3 Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing your account and the service | Contract with you |
| Invoices and accounting | Legal obligation (tax law) |
| Service emails (alerts, weekly summaries, monthly report) | Contract with you. You can turn off summaries in settings |
| Security, fraud prevention, fixing problems | Legitimate interest |
| Contacting businesses about Vlerso before they sign up | Legitimate interest. You can ask us to stop at any time |
| Improving the product with anonymised statistics | Legitimate interest |
3.4 How long we keep it
- Account data: while your account is active, plus 30 days.
- Invoices and payment records: as long as Kosovo tax law requires.
- Security logs: up to 30 days.
- Sales contact notes: up to 12 months after our last contact, or until you ask us to stop.
4. We do not sell data
We do not sell, rent or trade personal data. We do not use it for advertising, and we do not share it with other businesses. A business can only see data from its own Vlerso pages.
5. Who helps us (processors)
We use a small number of service providers to run Vlerso. They may only use the data to provide their service to us.
| Provider | What they do | Data they handle |
|---|---|---|
| Hosting provider ([Vercel]) | Runs the website and app | All data passing through the app, IP addresses in logs |
| Database provider ([Neon]) | Stores the data | All stored data |
| Email provider ([Resend]) | Sends emails to business users | Business users' email addresses and email content |
| Google (Places API) | Provides public information about businesses (rating, review count) | Google place IDs of businesses only. No customer data is sent to Google by Vlerso |
We choose data centres in the European Union where the provider offers them. If data is transferred outside Kosovo, we do so only to countries or under safeguards allowed by Kosovo law.
We may also disclose data if a court or public authority in Kosovo lawfully requires it.
6. Security
We use encrypted connections, encryption of stored data, access limited to people who need it, two-factor login on our provider accounts, and regular backups. No system is perfectly secure. If a breach affects your data, we will inform the business and, where the law requires, the Information and Privacy Agency and you.
7. Your rights
Under Kosovo Law No. 06/L-082 you can ask to:
- see the data held about you,
- correct it,
- delete it,
- limit or object to how it is used,
- receive it in a common format.
Customers: you can ask the business you visited, or write to us at [privacy@vlerso.com] and we will pass it to the business and help them answer, usually within 10 working days.
Business users: write to us at [privacy@vlerso.com]. We answer within 30 days at the latest.
You can also complain to the Information and Privacy Agency (Agjencia për Informim dhe Privatësi), aip.rks-gov.net.
8. Children
Vlerso is meant for adults. If you are under 16, please ask a parent before giving your name or phone number in a message.
9. Changes
If we change this policy in an important way, we will update the date at the top and tell business users by email at least 30 days before.
10. Contact
[privacy@vlerso.com], [address], Prishtinë, Kosovo.