Solita Privacy Policy
Last updated: 29 October 2026
This Privacy Policy explains how personal data is processed in connection with Solita, the website solita.app and related services (the "Service").
We process personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia (Zakon o zaštiti podataka o ličnosti, "Službeni glasnik RS", no. 87/2018, the "ZZPL"). Where the EU General Data Protection Regulation (GDPR) applies, we also apply it.
1. Who we are
The Service is operated by:
SERGEI PRONIN PR RAČUNARSKO PROGRAMIRANJE AI BEOGRAD
Sole proprietor (preduzetnik) registered with the Serbian Business Registers Agency (APR)
Registration number (matični broj): 68694779
Tax ID (PIB): 115857359
Registered address: Jurija Gagarina 231, lokal 329, 11073 Beograd (Novi Beograd), Serbia
Brand: Solita
Privacy contact: privacy@solita.app
Support: support@solita.app
Phone: +381 61 2695 226
In this policy, "Solita", "we" and "us" mean the operator above.
We have not appointed a Data Protection Officer. For any data protection question, contact privacy@solita.app.
2. What Solita does and our two roles
Solita is an AI sales assistant for travel and tour businesses (tour operators, excursion agencies and similar). Our customers are businesses (the "Client" or "Clients"). On behalf of a Client, Solita answers the Client's own customers (for example, tourists) in messaging channels, qualifies leads, sends follow-up messages, and hands conversations over to the Client's human staff. Clients use dashboards and CRM tools to manage these conversations.
We act in two different roles:
Role A — Solita as controller. We decide how and why we process personal data about:
- people who visit solita.app;
- Clients' representatives and users of Client accounts (owners, managers, staff);
- prospects who contact us or request a demo;
- people who contact our support.
This Privacy Policy fully applies to Role A.
Role B — Solita as processor. When a Client uses Solita to communicate with its own customers ("End Users"), the Client is the controller of the End Users' data. We process that data only on the Client's documented instructions, under our Terms of Service and Data Processing Addendum (DPA). The Client decides what data is collected, which End Users are contacted and for what purpose.
If you are an End User (for example, a tourist who wrote to a travel company), please read that company's privacy notice and send requests about your data to that company first. We will assist the company in answering you. See section 10 and our Data Deletion page.
3. Data we process (Role A — controller)
| Category | Examples | Source |
|---|---|---|
| Account and contact data | name, business email, phone, job title, company name, login credentials (hashed) | you or your employer |
| Business and billing data | company details, tax ID, billing address, invoices, payment status, subscription plan | you; our payment service provider |
| Communication data | support requests, emails, messages to us, call or meeting notes | you |
| Usage and technical data | IP address, device and browser type, log-in times, actions in the dashboard, error logs | automatically, from the Service |
| Website data | pages visited, referrer, cookies (see section 12) | automatically, from solita.app |
| Marketing data | whether you subscribed to updates, responses to our messages | you |
We do not ask for special categories of personal data (for example, health, religion, biometric data) in Role A.
4. Data we process on behalf of Clients (Role B — processor)
To provide the Service, we process on the Client's behalf:
- End User identifiers in the channel (phone number, messaging username or ID, display name, profile picture where the channel provides it);
- message content exchanged with the Client (text, voice notes, images, files), including AI-generated replies;
- details the End User shares in the conversation (travel dates, number of travellers, destination, budget, preferences, contact details);
- lead status, notes, tags and history created by the Client or by the AI assistant;
- technical metadata (message timestamps, delivery and read status, channel identifiers).
Clients must not use Solita to collect special categories of personal data or identity document numbers unless strictly necessary and lawful. The AI Assistant does not ask End Users for passport or other identity documents. If an End User sends such a document in a conversation, it is stored as part of that conversation, is accessible only to the Client, and is deleted together with the conversation. Clients should ask End Users to share identity documents through their own secure booking process, not in chat.
5. Purposes and legal bases (Role A)
| Purpose | Legal basis (ZZPL / GDPR) |
|---|---|
| Creating and managing Client accounts; providing the Service | performance of a contract, or steps before entering into a contract |
| Billing, invoicing, accounting and tax records | compliance with a legal obligation |
| Customer support and service communications | performance of a contract; legitimate interest |
| Security, fraud and abuse prevention, enforcing our Terms (including messaging policy enforcement) | legitimate interest; legal obligation where applicable |
| Improving the Service using aggregated usage statistics (not message content) | legitimate interest |
| Answering enquiries and demo requests | steps before entering into a contract; legitimate interest |
| Sending marketing emails | consent, or legitimate interest for existing business contacts where allowed by law; you may opt out at any time |
| Non-essential cookies and analytics | consent |
| Establishing, exercising or defending legal claims | legitimate interest |
Where we rely on legitimate interest, we have balanced our interests against your rights. You can ask us for details and you can object (section 10).
In Role B, the legal basis for processing End User data is determined by the Client as controller.
6. AI processing
- Solita uses large language models (LLMs) from third-party providers to generate replies, summaries and lead qualifications. Current providers: Anthropic and OpenAI.
- AI output may be inaccurate or incomplete. Clients configure the assistant and are responsible for reviewing it. A human manager can take over any conversation.
- We do not use Client data, End User data or conversation content to train our own or third-party general-purpose AI models. We use LLM providers under terms that prohibit training on the data we send.
- We do not use data received through the WhatsApp Business Platform to train, develop or improve AI models, in line with Meta's WhatsApp Business terms.
- The Service does not make decisions that produce legal effects on individuals based solely on automated processing. Lead qualification and scoring are advisory and are reviewed by the Client.
7. Who receives data
We share personal data only as needed to provide the Service:
- Sub-processors and service providers acting on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (WhatsApp Business Platform / Cloud API) | message delivery | EU / USA |
| Telegram | message delivery | UAE / global |
| Anthropic PBC; OpenAI, L.L.C. | AI reply generation | USA |
| Contabo GmbH | hosting, storage, backups | Germany (EU) |
| Stripe, via a third-party payment service provider | payments and billing | EU / USA |
| Meta Platforms (Meta Pixel); Google LLC (Google Tag Manager, Google Analytics) | website analytics and advertising measurement, only with consent | EU / USA |
| Zoho Corporation | business email | USA |
Channels currently supported: WhatsApp Business Platform and Telegram. We will update this list before adding new channels. This table is our current list of sub-processors.
- Messaging platforms. When a Client connects a channel, messages pass through that platform. Each platform processes data under its own terms and privacy policy.
- The Client. End User data is available to the Client that controls it.
- Professional advisers (accountants, lawyers) under confidentiality duties.
- Public authorities, when required by law.
- A successor business, if the Service is transferred, with notice to you.
We do not sell personal data.
8. International transfers
Our servers and some providers are located outside the Republic of Serbia: our servers are hosted by Contabo GmbH in Germany (European Union); our LLM providers (Anthropic, OpenAI) and some messaging and payment providers process data in the USA. We transfer personal data abroad only where permitted by ZZPL, namely:
- to countries the Republic of Serbia recognises as providing an adequate level of protection; or
- under appropriate safeguards, such as standard contractual clauses adopted by the Commissioner or, for transfers to the USA, standard contractual clauses agreed with the relevant provider; or
- under another legal ground provided by ZZPL.
You can request information about the safeguards used by contacting privacy@solita.app.
9. How long we keep data
| Data | Retention |
|---|---|
| Client account data | for the duration of the contract, then deleted within 30 days after the export period ends |
| End User data (Role B) | as instructed by the Client; after contract end, available for export for 30 days, then deleted from production systems within 7 days and from backups within 60 days |
| Invoices and accounting records | for the period required by Serbian accounting and tax law (up to 10 years) |
| Support correspondence | 24 months after the last contact |
| Security and access logs | 12 months |
| Marketing data | until you unsubscribe or withdraw consent |
| Website analytics | up to 14 months |
We may keep data longer when needed to establish or defend legal claims, or when required by law.
10. Your rights
Under ZZPL (and GDPR where it applies) you have the right to:
- access your personal data and receive a copy;
- rectification of inaccurate data;
- erasure ("right to be forgotten");
- restriction of processing;
- data portability — receive data you provided in a structured, machine-readable format;
- object to processing based on legitimate interest, and at any time to direct marketing;
- withdraw consent at any time, without affecting processing before withdrawal;
- not be subject to a decision based solely on automated processing that significantly affects you.
How to exercise them. Email privacy@solita.app. We may ask you to confirm your identity. We answer within 30 days. This period may be extended by up to 60 days for complex requests; we will tell you if it is.
End Users of our Clients. Send your request to the business you communicated with. It is the controller. If you contact us, we will forward your request to that business or help it respond, as required by our agreement with it.
11. Complaints
You may lodge a complaint with the Serbian supervisory authority:
Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti) Bulevar kralja Aleksandra 15, 11000 Beograd, Serbia www.poverenik.rs
If you are in the EU/EEA, you may also complain to your local data protection authority. We ask that you contact us first so we can try to resolve the issue.
12. Cookies
solita.app uses strictly necessary cookies to run the website and the dashboard (for example, session and security cookies). These do not require consent.
With your consent, solita.app also uses Google Tag Manager and Meta Pixel and Google Analytics to measure visits and the effectiveness of our advertising. These are loaded only after you accept them in the cookie banner, and you can withdraw consent at any time via the "Cookie settings" link in the website footer.
You can manage cookies in your browser settings.
13. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access control based on roles, logging of staff access to conversation content, backups, and two-factor authentication for staff accounts with access to personal data. Solita staff access conversation content only when necessary to provide support or at the Client's request, or for security reasons.
If a personal data breach occurs, we will notify the Commissioner and affected persons where required by ZZPL, and will notify affected Clients without undue delay.
14. Children
The Service is intended for businesses. It is not directed to children under 16. We do not knowingly collect data from children in Role A. If you believe a child has given us personal data, contact privacy@solita.app and we will delete it.
15. Changes
We may update this policy. We will post the new version on this page with a new "Last updated" date. For material changes we will notify Clients by email or in the dashboard at least 14 days in advance.
16. Contact
Questions about this policy: privacy@solita.app
Postal address: Jurija Gagarina 231, lokal 329, 11073 Beograd (Novi Beograd), Serbia