Privacy Policy
This is a translation; the Slovenian version is authoritative. Preberi v slovenščini
1. Controller
The controller of personal data is Vabita.si, Lokarje 41a, 1217 Vodice, Slovenia. The app name Vabita is not the name of the controller. Contact for privacy questions, which is also the contact for appealing a moderation measure and for exercising the right of access: podpora@vabita.si.
A data protection officer has been appointed: Eva Tisaj Žnidaršič, podpora@vabita.si.
2. What data we process
Identity from your sign-in provider: the e-mail address and name from your Google or Facebook account and a technical account identifier.
Profile: display name, an avatar chosen from a closed set of sixteen illustrations, postal code, and the statistical region derived from it.
Children: the date of birth, an optional sex and a chosen illustration for each child, up to six entries. The date of birth and the sex stay private; from the date we derive the age stage (0–6 months, 6–12 months, 1–2 years, 3–5 years, 6–9 years, 10+ years), which is shown together with the illustration to the participants of your gatherings. We do not collect a child's name, photograph or health data.
Pregnancy: the fact that you are pregnant and your expected due date. This is data about your state of health, that is, a special category of personal data; we process it only with your separate explicit consent. The week of pregnancy is calculated when displayed and is not stored.
Interests: the topics close to you, chosen from a closed set. Interests are private and other users do not see them. We no longer collect activities (what you like doing with your child); the ones stored earlier have been deleted.
Notifications about new gatherings: your choice of which types of new gatherings you want a push notification about — all types, single types or none. The choice is private, other users do not see it, and it affects only these notifications.
Gatherings: the gatherings you create and your sign-ups with the time of signing up. A sign-up stores a snapshot of your display name, avatar, area and your children's age stages.
Polls: your vote for one of the proposed dates of the next gathering, tied to your account.
Usage: sign-in times and daily activity rows, the device type (Android or iOS) on which you last used the app, account status, and any moderation records.
Consents: the accepted versions of the Terms of Use, of this policy and of the Community Rules with the time of acceptance, the declaration of adulthood, and the separate consent to the processing of pregnancy data with the version of its text.
Messages: the text of private conversations, of messages in the chats of the gatherings you are signed up for, and of your conversation with Vabita, and the images you send into a conversation (up to 10 per message, with their dimensions).
Role: the mark that you are a verified organiser. The role is indirectly public, because every gathering of yours carries your name and avatar and its chat labels you as the organiser.
Application to become an organiser: if you tell us in the app that you would like to organise gatherings, we keep your optional message (at most 500 characters), your answers to whether you would organise gatherings as a mother from the community or connected with an activity, a brand or a sponsor, and whether you would also organise paid gatherings, the state of the application (new, approved, archived), the dates of the application and of its handling, and who handled it. The person handling the application may add an internal note, which you do not see in the app.
Attendance: the organiser's mark of whether you came to a gathering. She enters it, not you; the app does not check your arrival.
Device push tokens: the technical identifier of the device we deliver notifications to.
Blocks: the list of users you have blocked. The list is yours and a blocked user never sees it.
Reports of inappropriate content: your report of a profile, a gathering or a message, with a reason and an optional note. A reported message carries a copy of the reported text, so the administrator sees only that message and not the whole conversation. Your report, with your name, is seen by the administrator and by persons with the role Podpora skupnosti (Community support), so that they can handle it and write to you about it in your conversation with Vabita; a person with that role does not see reports that concern her. The reported user never learns who reported her.
A copy on your device: the app stores on your device what it shows you first at start-up — whether your profile is complete, the state of your account and your name for the greeting, the list of your gatherings and up to 30 conversations with a preview of the last message. This copy stays on the device, is kept out of the Android system backup, and is deleted when you sign out, when the account is deleted, and at the end of every session.
Security counters: how many limited actions you have taken recently — sign-ups and withdrawals, reports of inappropriate content, first messages to new acquaintances, the application to become an organiser and the messages of the current minute — and, if any, the moment until which sending messages is stopped. We keep the counters so that a flood of messages or notifications is not possible and so that the meeting points of gatherings cannot be harvested by signing up and withdrawing. They are kept for 24 hours and are deleted with the account. Beside them we keep a technical key that links your report of inappropriate content to you, so that the same report is not filed twice. The key serves that purpose alone and the admin portal does not read it — the portal shows who sent a report from the report itself, as described under reports of inappropriate content — and it is kept for as long as the report.
What we do not collect: your exact location (only the postal code is processed, and only a coarse area label is shown), your date of birth (the app never asks for it; you confirm adulthood with a declaration), and children's names, photographs and health data. There is nowhere in the app to upload a photograph.
3. Purposes and legal bases
Performance of a contract (Article 6(1)(b) GDPR): operating your account, gatherings with their sign-ups, the chats of gatherings, polls about the next date, a participant's public profile, and private messages.
Consent (Article 6(1)(a) GDPR): entering children and interests (topics). You enter data about a child as the holder of parental responsibility. You can withdraw consent at any time by deleting the entry.
Explicit consent for special categories of personal data (Article 9(2)(a) GDPR): the pregnancy entry and the expected due date. This consent is separate from this policy, you give it when making the entry and withdraw it by removing the entry. Without it the pregnancy data cannot be stored.
Legitimate interest (Article 6(1)(f) GDPR): community safety, moderation, and anonymized usage metrics.
Usage statistics (legitimate interest, Article 6(1)(f) GDPR, as for activity times): we use the device type (Android or iOS) to count active users by device type on the dashboard, so that we can prioritise development. Staff see the device type only as a total without names, and we keep it until account deletion.
Contract (Terms of Use): the organiser role as an agreement between you and the operator, and the application for that role, which you make at your own request, with the internal note of the person handling it.
Consent (the system permission and the switch in the app): delivery of push notifications, among them the notification about a new gathering of a type you chose; you can withdraw the permission at any time and change the choice of types in the app (Profil › Aktivnosti).
Legitimate interest in safety: blocks, the handling of reports of inappropriate content, including showing the reporter to the staff and contacting her in the conversation with Vabita, and the security counters that prevent abuse.
Data about children, about pregnancy, interests and gathering data are not used for advertising or profiling and do not enter the anonymized aggregates as a separate dimension.
4. What other users see
This version of the app has no directory of users. Your public profile — avatar, display name, an approximate-area label, and the age stage and illustration of each of your children — is seen by the organiser and the participants of a gathering you are signed up for. Because every child is shown separately, the number of your children is visible within that circle too.
If you organise a gathering, the same public profile — avatar, display name, approximate-area label, and your children's age stages and illustrations — is seen by those signed up for your gathering. The profile is read from your current profile when they open it; it cannot be reached by other users.
If you are an organiser, other users see next to your name on a gathering, among the participants and in the gathering chat whether you are a Povezovalka skupnosti (community connector: gatherings without promoting an activity, a brand or a sponsor) or an Organizatorka (organiser). The team decides this when it approves your application, following your answer, and may change it later; it is removed when the role is taken away.
The pregnancy entry, the expected due date, a child's date of birth and a child's sex are visible to nobody but you: not in the public profile, not in the sign-up snapshot, not in chats and not in the administrative view.
Your interests are not visible to other users anywhere — not on the public profile and not at a gathering.
Your postal code, e-mail address, exact location and activity times are not visible to other users.
If you are interested in organising gatherings or organise them, the Vabita team sees your postal code and its place. When you are interested in organising gatherings, the Vabita team also sees the list of the past gatherings you were signed up for, with the attendance mark. If you are an organiser, the Vabita team sees the number of gatherings you have organised and the share of those present at them.
Your private messages are visible only to the other participant of the conversation. Your conversation with Vabita is read by the persons with the role Podpora skupnosti (Community support) and by the administrator (section 9); other users cannot reach it.
You can edit your message within 15 minutes and delete it at any time; the previous text of an edited message is not kept. When you delete it, its text, images and reactions disappear from the app for everyone, and the label Message deleted remains in its place. Notifications already shown to the other members, images they have already saved and content someone reported before remain; backups are deleted within eight weeks at the latest.
When you send a message with a web link, the Vabita server prepares a link preview: it visits the page once and stores its title, a short description and a reduced image with the message, which the members of the conversation see. The page sees only the address of our server, not you and not the other members. The preview is deleted with the message and with the conversation; when you delete your account, it stays with the message, like its text.
You can react to a message with an emoji. We store who reacted, to which message and with which emoji, without a time. The reaction and your short name are seen by all members of the conversation, including those who join it later, and in the conversation with Vabita also by the support team. A reaction disappears when you withdraw it, when the message or the conversation is deleted, and at once in every conversation when you delete your account.
Images in conversations are your content. Before uploading, the app reduces them on your device and removes their metadata (location, device, time); the original is never uploaded. An image is seen only by the members of the conversation — in a gathering's conversation also by those who sign up later — and in the conversation with Vabita by the support team; they reach it only through the app, there are no download links. Every member can save an image to her gallery; copies saved that way are not reached by deleting the message or the account. To pick images the app needs no permission to read your gallery; to save one it asks only for permission to add to the gallery. When you delete your account, your images are deleted at once and the messages remain with the label Images removed. If someone reports a message with images, a copy of the images is kept for the team handling the report until the handling is finished, at the latest until the report expires.
If a directory of users is ever reintroduced, it will require a new, separate consent. Public profile projections created in earlier versions of the app are not used and cannot be reached from the interface.
5. Gatherings and what participants see about you
The place, the municipality and the meeting point are data about the gathering, not about you; we never derive them from your address and never store them in your profile. The place carries the municipality the organiser chooses; the place with its municipality is seen by every user who sees the gathering. We do not read your device location and do not check your arrival.
When you sign up for a gathering, the organiser and everyone signed up — including those who sign up later — see your display name, avatar, area label and your children's age stages and illustrations. Participants of the same gathering can open your public profile and start a private conversation with you. We tell you this before your first sign-up and record your acknowledgement.
The exact meeting point and the list of participants are visible only to the organiser and to those signed up. Before signing up, other users see only the number of people signed up and up to five of their avatars, without names or any other data. Messages in the chat of a gathering are visible to all its members, including the history from before you joined.
The organiser may remove you from a gathering. On removal you are notified, you lose access to the meeting point and to the chat of the gathering, and your messages remain in that chat.
If you withdraw from a gathering after its sign-up deadline, the organiser of that gathering sees your name in its shortened form, your avatar and the time you withdrew. The record is deleted with the gathering or with your account.
The label "Pregnant women welcome" describes a gathering and not its participants. Your sign-up for such a gathering is visible to the organiser and to those signed up, exactly like any other sign-up; before signing up, other users see only the number of people signed up and up to five avatars.
After the gathering the organiser marks which of the people signed up came. The organiser and the administrator see the mark; the interface does not show it to participants, but because the list of sign-ups is read by everyone signed up, the mark is technically reachable for them. It is used only for the organiser's overview and for attendance statistics without identifiers.
The chat of a gathering is deleted together with the gathering, even if people are still using it. That is a deliberate limit, so that a gathering does not become a lasting record.
6. Sharing a gathering outside the app
You can share a gathering as an image and a link. Only the public data of the gathering leave the app — its type, title, date, time, general location with its municipality and any label for pregnant women — together with the random identifier of the gathering in the link. The meeting point, the participant list, the number of sign-ups and the organiser's name never leave the app.
Your name is not on the image. Whatever the social network you post it on shows about you is that network's own processing under its own terms.
The web page the link leads to shows nothing about the gathering, uses no cookies and measures no visits. We do not log sharing: we do not store who shared what.
7. The calendar on your device
On a gathering you are signed up to or organise, the app offers Dodaj v koledar (Add to calendar). Tapping it opens the calendar on your device with a draft entry: the title of the gathering, its start and end, the exact meeting point, the place and the municipality, the description of the gathering, the map link and the link to the gathering. The app sets no reminder.
You save, edit or discard the draft yourself in your calendar. The app reads nothing from your calendar, writes nothing to it and neither changes nor deletes entries — not when the gathering changes or is cancelled, not when you sign off and not when you delete your account.
On an iPhone with the Google Calendar app installed you can choose where the draft opens: in the calendar on your iPhone or in Google Calendar. If you choose Google Calendar, the app opens Google’s page for a new event and hands it the draft in the link — the title, the start and end, the place with the exact meeting point, the description, the map link and the link to the gathering. Google receives the draft when the link opens, before you save it, and processes it under its own terms. We keep your choice only on your phone; you change it in the Settings. Nothing reaches our servers in this.
The Android app needs no calendar permission for this. An iPhone with an older version of the system may ask for the permission to open the draft; you can withdraw it in your phone settings at any time.
Nothing from your calendar reaches our servers. An entry you save may sync with the account of your calendar (Google, for example) under that provider’s terms. You edit and delete the entries yourself, including those the app wrote in earlier versions.
8. Polls about the next date
After a gathering has ended, its organiser may open a poll about the next date. Your vote says when you are available, so it is personal data; we process it on the basis of performing the Terms of Use at your request, and voting is voluntary.
An individual vote is seen by the organiser and by you; the other participants see only the number of votes for each option. The poll and the votes are deleted together with the gathering; the new gathering created from the poll carries only the date and no votes.
9. Processors and data transfers
Data is processed on our behalf by Google (Firebase services: sign-in, database, file storage for images in conversations (Cloud Storage in the europe-west1 region), server functions, hosting, and the delivery of push notifications through Firebase Cloud Messaging on Android devices) under a data processing agreement (Firebase Data Processing and Security Terms). Push notifications to iOS devices are delivered by Apple through the Apple Push Notification service (APNs); for this Apple receives your device's token and the content of the notification and processes them under the terms of the Apple Developer Program. Server functions run in the europe-west1 (EU) region. The Firestore database of the production project is in the europe-west1 region (European Union); the database of the development project, which serves the test builds of the app before its first public release, is in the nam5 multi-region (United States).
The content of a push notification — the sender's name or the gathering title and a preview of up to 120 characters, or the text "Več novih sporočil" (several new messages) when more than one message waits for you in the same conversation; for a notification about a new gathering its type, title, day, time, place and municipality, never the meeting point — travels through Firebase Cloud Messaging on Android devices and through the Apple Push Notification service on iOS devices. Server logs never record the text of a notification.
Within the controller, the personal data shown by the admin portal (the list and details of users, reports of inappropriate content, gatherings, applications to become an organiser, conversations with Vabita and audit entries) is accessed by the administrator and by named persons with the role Podpora skupnosti (Community support). They are users of the app who work for the controller in the portal and in the app; the controller keeps the list of persons with the role, and access ends when the role is withdrawn.
The conversation with Vabita starts when the team first writes to you: with the decision on your application to become an organiser, before that decision, or about a report of inappropriate content you sent. About a report, the team may ask you for more information or tell you that the report has been reviewed, but never which measure was taken. Everything the team writes to you afterwards reaches you in the same conversation. It is read and answered by all persons with the role Podpora skupnosti (Community support) and read by the administrator. You see the sender as Vabita; the controller records which person wrote each message. Your other conversations stay closed to them; the only exception is a message you report, as described in section 2. You can mute and leave the conversation; if Vabita writes to you again, it returns. You cannot start a conversation with Vabita yourself; for questions write to the contact in section 1.
Backups: Google copies the database of the production project automatically every day and every week. A daily copy is kept for 7 days, a weekly one for 8 weeks; the copies are made and stay in the same region as the database (europe-west1, European Union) and are accessible to the controller alone. We use them for nothing but recovery after an error or a loss of data. Because no copy is older than eight weeks, data you delete disappears from the backups at the latest eight weeks after the deletion.
There are no other recipients. We do not sell your data and do not use it for advertising.
10. Retention periods
Private profile, including children, the pregnancy entry, interests and the choice of notifications about new gatherings: until account deletion.
The pregnancy entry and the expected due date: until they are turned into a record of a born child, until the entry is removed, or until account deletion; on that change the expected due date is deleted and not archived.
Public profile from earlier versions of the app: until the profile is hidden or the account is deleted.
Administrative profile projection: until account deletion.
Device type (Android or iOS): until account deletion.
Gatherings with their meeting point, sign-ups and chat: 6 months after the date of the gathering. The period is deliberately short so that gatherings do not become a lasting record of where you have been.
Polls and votes: together with the chat of the gathering, that is, with the gathering; the votes of a user who deletes her account are removed immediately.
Device push tokens: until you sign out, switch notifications off, or 90 days without opening the app.
Blocks: until account deletion.
Application to become an organiser with its internal note: until account deletion.
Reports of inappropriate content: 12 months from the report. A report about a user who deletes her account is kept pseudonymised for a further 12 months from the deletion: her identifier is replaced by a label that cannot be traced back to her, while the report remains as the record of content that was reported and handled. The report contains neither her name nor her avatar.
Images in conversations: with the conversation; at once when the message is deleted, when the team removes them or when you delete your account. The copy of reported images: until the report has been handled, at the latest until the report expires.
Conversations and messages: until both participants delete their accounts; when one participant deletes theirs, their name and avatar are removed from the conversation while the texts remain with the other participant.
The conversation with Vabita with the record of which person wrote each message: until you delete your account, also if you have left the conversation; the person's name stays only in the audit entry, which does not contain the text.
Consent records: until account deletion, then a further 24 months as proof of consent, without name or e-mail address and without any data about a child, about a pregnancy or any interest.
Daily activity rows: 90 days.
Moderation audit entries and request records: 24 months.
Anonymized daily aggregates without identifiers: no time limit.
The Firebase Authentication account: until account deletion.
Security counters: 24 hours. The key that links a reporter to her report of inappropriate content: for as long as the report, that is 12 months.
The copy on your device: until you sign out, until the account is deleted, or until the end of the session, whichever comes first.
Backups of the production database: the daily copy 7 days, the weekly copy 8 weeks (section 9).
11. Your rights
Access: you can request a copy of your data at any time at the controller's contact address in section 1. We send the copy within 30 days, and it covers your profile with its consents, your children and the pregnancy entry, your interests, your choice of notifications about new gatherings, your gatherings, your sign-ups with the attendance mark, your withdrawals after a sign-up deadline, your votes in polls, your blocks, your application to become an organiser, your activity rows and the messages you sent, also in the conversation with Vabita. Device tokens are not part of the copy, because they are a technical device identifier, and neither are administrative audit entries, which carry an administrator's identity, the record of which person wrote a message of Vabita, nor the internal note on an application to become an organiser. There is no self-service export in the app.
Deletion: you can permanently delete your account in the app. Children, the pregnancy entry, interests and the choice of notifications are deleted together with the profile without exception, your sign-ups are deleted and the places on gatherings are freed, your votes in open polls are withdrawn and the counts corrected; device tokens, blocks, the application to become an organiser with its internal note and the conversation with Vabita are deleted, your memberships in the chats of gatherings are removed, reports you filed lose your identity, while reports about you lose your identifier and are kept pseudonymised for a further 12 months; the copy on your device is deleted; the remaining exceptions are listed in the retention section.
Withdrawal of consent: you withdraw the consent to the processing of pregnancy data by removing the entry, and the consent to entering children and interests by deleting the entry. Withdrawal does not affect the lawfulness of processing before it.
Rectification: you can change your display name, avatar, postal code, child entries, the pregnancy entry and interests in the app; for other corrections contact the controller.
Objection: you can object to processing based on legitimate interest via the controller's contact; use the same address to appeal a moderation measure.
12. Complaint to the supervisory authority
If you believe the processing of your data violates the law, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.
13. Changes to this policy
Each version of this policy carries a date and is published at a public address. When a change requires your renewed consent, the app asks for it at your next sign-in; otherwise the new version applies from the date it carries.