Qvant

Privacy Policy

Last updated: October 10, 2026

Contents
  1. 1. Who we are
  2. 2. What data we collect
  3. 3. Purposes and legal bases
  4. 4. Who can see your data
  5. 5. How long we keep data
  6. 6. Your rights
  7. 7. Cookies
  8. 8. Data security
  9. 9. Minors
  10. 10. Changes to this Policy and contact

1. Who we are

The operator of “Qvant”, PYRAMIDS ECOMMERCE DOO BEOGRAD (STARI GRAD) (company registration number 22316567, tax identification number PIB 115796510, address: Obilićev venac 18, lokal 3.15, 11102 Beograd (Stari Grad), Serbia, email: qvant.bg@gmail.com), is the controller of your personal data (rukovalac, i.e. the party that determines the purposes and means of processing).

We process personal data in accordance with the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti) and collect only the data needed to provide our services. This Policy explains what data we collect, what we use it for, who can see it, how long we keep it, and what rights you have.

2. What data we collect

  • Account: phone number; nickname, profile photo and bio; registration time and last login time; history of changes to your nickname and shop name (the name before and after each change and the time of the change, used to enforce the “once every 30 days” rule and to deal with impersonation); history of phone number changes (the phone number before and after the change, the time of the change, IP address, device type and device identifier; where the change was made with the help of platform support, also the administrator who handled it and the reason).
  • Login: password (we store only an encrypted, irreversible hash; no one, including platform staff, can see your original password); login records (the time, IP address, browser or device type, device identifier and success or failure of every login or login attempt); records of setting, changing and resetting your password (time, IP address and device type and, for resets performed by an administrator, which administrator performed it; the password itself is not recorded); login sessions (we store only a hash of the login token, the browser or device type and the expiry time).
  • Push notifications (when you use the mobile app and allow notifications): the push token assigned by Apple (iPhone) or Google (Android phones) to the app on that device, the push environment, the app identifier and version number, the time of registration and of the last update, and your setting for the “New Message Notifications” switch in the app.
  • Business profile (if you choose the business role): shop name, shop description, public contact phone number, region and logo, as well as company name and tax identification number (PIB); business verification review records (submission time, review outcome and time, reviewing administrator, reason for rejection). Verification documents provided to platform support through the support chat or by phone for business verification (for example, a business registration certificate) are used only to review the business profile.
  • Listings: description, photos, price, region, view count, publication and expiry time; device condition (brand, model, storage capacity, cosmetic condition, dents and scratches, Face ID / Touch ID, repair history, battery health, iCloud / Find My status) and the proof screenshots you upload (battery, iCloud, parts and service history). Photos and screenshots are reprocessed to remove the capture location (GPS) and other embedded metadata.
  • Saved listings and alerts: the listings you save and their price at the time you saved them (used to notify you of price drops); the alert criteria you set (brand, model, storage capacity, minimum battery health, maximum price, city), whether each alert is on or off, the time you last viewed matching results and the time of the last push notification.
  • Chat: text and photo messages, time sent and time read; conversations with platform support (“Qvant Support”) (including information automatically attached when a conversation is started from business verification: the shop name, verification status and submission time), and which administrator sent each support reply.
  • Reviews: star rating, text, time written and time edited, and the content before each edit.
  • Reports and block list: reports you submit (reason and explanation), reports others submit about you, and users you have blocked.
  • Platform moderation records: records of actions taken against accounts, listings and reviews for violations, and the reasons for them; business lock records (phone number, reason, shop name at the time of the lock); phone number ban records (phone number, reason, time).
  • Edit history while under report: while a listing or account has been reported and the report has not yet been resolved, the previous content and photos whenever the listing, profile photo, shop logo, bio, shop description or shop contact phone number is edited.
  • Access logs: our servers record the IP address, time, requested address and browser type of each access.

We do not ask you to provide your real name, identity documents, bank card or payment information (the platform does not take part in transactions or payments). Your nickname, business profile, listings and chat content are entered by you and are stored and displayed exactly as entered, as described in this Policy; please do not include sensitive information such as identity document numbers or bank card numbers in them. We do not access your location or contacts, and we do not use advertising or analytics tracking tools.

When you select a battery screenshot while creating a listing, the app recognizes the battery health figure in the screenshot on your phone and fills it in for you (you can change it); recognition takes place entirely on your phone, and the screenshot is not uploaded for recognition. The screenshot is uploaded only when you publish the listing, and it is then publicly displayed together with the listing.

3. Purposes and legal bases

  • Providing the service (performance of the Terms of Use between you and us): registration and login, publishing and displaying listings, in-app chat, reviews, profile pages and shop pages; push notifications in the mobile app for new messages, support replies, business verification results and alerts (you can turn these off at any time); matching new listings against the criteria you set and notifying you of price drops on saved listings.
  • Security and abuse prevention (our legitimate interests): preventing brute-force password guessing (temporary lockout after repeated incorrect attempts); using login records and phone number change records to detect account takeovers, help users who have forgotten their password or lost their phone recover their account, and identify multiple accounts registered by the same person (on the same device or the same network); limiting how often listings, messages, reviews and reports can be submitted; handling reports and violations (including fake positive reviews); retaining evidence of violations; and troubleshooting. A business's company name and tax identification number are used to review business verification, manage businesses, handle disputes and cooperate with competent authorities as required by law, and are not displayed publicly.
  • Compliance with legal obligations: retaining data as required by law, or providing data to competent authorities as required by law.
  • Consent: if in the future any processing requires your consent (for example, marketing notifications), we will ask for your consent separately, and you may withdraw it at any time.

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing; automated measures such as rate limits are used only to prevent abuse.

Your phone number and password are required to register and log in; without them you cannot use the platform. If you choose the business role, the shop name, company name and tax identification number are required. You may keep the default nickname assigned by the system; your profile photo, bio and other business profile details are optional, and leaving them blank does not affect basic use.

4. Who can see your data

  • Everyone (including visitors who are not logged in and search engines): your nickname, profile photo, bio and date joined; your publicly available listings for sale (including photos, device condition, proof screenshots, price, region and view count); the reviews you receive (reviewer, star rating, text, time) and your positive rating percentage, as well as the reviews you give to others (displayed on their profile); if you have the business role, your shop name, logo, shop description and region and, once approved, the “Verified Business” badge (the company name and tax identification number are not displayed publicly).
  • Logged-in users: the public contact phone number provided by a business (initially set by default to your account phone number; you can change it to a different number or leave it blank).
  • Only the participants in a chat: the content and photos of your chats with other users. Your conversations with “Qvant Support” are viewed and answered by platform administrators (acting as support staff).
  • Listings that have been taken down, sold or have expired: are no longer publicly displayed, and anyone who opens them will find that the page cannot be found; however, people who previously chatted with you about the listing can still see its title, price and cover photo in the chat and in the conversation list (the photo is not shown for listings taken down for violations or whose publisher has deleted their account).
  • Only you and platform administrators: your account phone number (the “Me” page shows only part of the number), your block list, saved listings and alerts (a listing's publisher cannot see who saved it), as well as, for the business role, the company name and tax identification number, and the outcome of the business verification review and the reason for any rejection.
  • Platform administrators: in order to handle reports, disputes, violations and legal requirements, may view account details (including the full phone number, the phone number used before account deletion, phone number change history and previous names), login records and password records (excluding passwords; including other accounts that have logged in on the same device or the same network), a business's company name and tax identification number, listings (including photos of listings taken down for violations and of listings of deleted accounts, and the previous content and photos from edits made while under report), reviews (including hidden ones) and reports and, where necessary, the relevant chat content. Every action taken by an administrator is logged.

We do not sell your personal data. To provide the service, we engage service providers (processors) to process some data on our behalf, and we require them to process it only on our instructions and to keep it confidential: our server hosting provider is Alibaba Cloud, and we use its data center in Frankfurt, Germany. Apart from this, we provide data to courts, the police and other competent authorities only where required by law.

Your data is stored on Alibaba Cloud servers in Frankfurt, Germany (European Union). Germany is a member state of the European Union and a party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), and under the Serbian Law on Personal Data Protection it is a country that provides an adequate level of protection of personal data; transferring data there does not require separate approval.

Push notifications from the mobile app are delivered to your device via Apple's push service (Apple Push Notification service, for iPhone) or Google's Firebase Cloud Messaging (for Android phones): the push token and the notification content (the sender's name and the beginning of the message text, with photos shown only as “[Photo]”; notices of support replies and business verification results; and, for alerts, the listing title, device condition, price and city) pass through Apple's or Google's servers and are processed by them under their respective terms of service and privacy policies. You can turn off push notifications at any time via “New Message Notifications” in the app or in your phone's system settings; whether notification content is shown on the lock screen is up to you, in your phone's system settings.

When you choose to contact us through third-party services such as WhatsApp or Viber (for example, to send a business registration certificate for business verification), the providers of those services process the relevant information under their own privacy policies and are not service providers processing data on our behalf.

5. How long we keep data

  • Account details, business profile (including company name, tax identification number and business verification review records), listings (including photos), chat history (including photos), reviews (including content before edits), reports and block list: kept for as long as your account exists.
  • After account deletion: your account is publicly displayed as “Deleted user”, your listings are taken down, your login sessions are invalidated, and your profile photo, logo and listing photos are moved to non-public isolated storage. In order to handle possible disputes, cooperate with investigations by competent authorities and comply with legal obligations, the data above (including the phone number used before deletion) is not deleted immediately but continues to be retained until it is no longer needed (see the last paragraph of this section); during retention it is not publicly displayed (except your chat history with others: the other party can still see it, and you are shown as “Deleted user”), and only platform administrators view it when handling disputes or where required by law.
  • Evidence of violations (listings and photos taken down for violations, previous content and photos from edits made while under report, reports, moderation records): used to handle violations, disputes and legal requirements, and retained even after the report has been resolved and the account has been deleted, until it is no longer needed (see the last paragraph of this section).
  • Saved listings and alerts: kept until you remove the listing from your saved listings, delete the alert or delete your account (deleted upon account deletion).
  • Nickname and shop name change history: kept for as long as your account exists; after deletion, retained as described under “After account deletion” above.
  • Business lock records (phone number, reason, shop name at the time of the lock): kept until the platform lifts the lock.
  • Phone number ban records (phone number, reason, time): kept until the platform lifts the ban.
  • Login records, records of setting / changing / resetting passwords, and phone number change records: automatically deleted after 12 months.
  • Password (irreversible hash): kept for as long as your account exists; after deletion, handled as described under “After account deletion” above (a deleted account can no longer be logged into).
  • Login sessions: up to 30 days; deleted upon logout, account deletion or expiry.
  • Push tokens and device information: kept for as long as the login session on that device, and deleted when you log out (including being logged out on other devices after a password change), turn off “New Message Notifications” in the app, when the login session expires or when you delete your account; if, after you uninstall the app, Apple or Google informs us that the token is no longer valid, we stop using it and delete it within 30 days.
  • Server access logs: deleted after 30 days.
  • Backups: to prevent data loss, we back up the database and files daily, and each backup is kept for 30 days; data that has already been deleted is removed from backups within 30 days as old backups expire.

“Until it is no longer needed” means: any possible dispute has been resolved or the statutory limitation period has expired, any investigation or proceedings by competent authorities have ended, and any retention obligations required by law have been fulfilled. We regularly review the data we retain and delete data that is no longer needed.

6. Your rights

Under the Serbian Law on Personal Data Protection, you may:

  • access the personal data we process about you and obtain a copy of it;
  • have inaccurate data rectified: you can edit your nickname, profile photo, bio, shop details and company information yourself on the “Me” and “Identity” pages (the nickname and shop name can be changed only once every 30 days; your phone number can be changed under “Me → Change Phone Number”, at most once every 30 days); for other data, please contact us;
  • have data erased: you can delete your account yourself (after deletion, data is retained for a period of time; see “How long we keep data” above), or contact us to delete specific data (except data we are required by law to retain);
  • in the cases provided by law, restrict processing, object to processing based on legitimate interests, and receive your data in a portable format;
  • withdraw your consent (without affecting the lawfulness of processing carried out before withdrawal).

To exercise your rights, email qvant.bg@gmail.com, or log in and contact Qvant Support via “Me → Contact Support”. To protect your data, we may first verify your identity (for example, by asking you to call or message us from your account phone number). We will respond within 30 days of the date we receive your request; where genuinely necessary because a request is complex or there are many requests, this period may be extended by up to a further 60 days, in which case we will inform you of the extension and the reasons for it within 30 days. Exercising these rights is free of charge; where a request is manifestly unfounded or excessive (in particular because the same request is made repeatedly), we may charge a necessary administrative fee, or refuse to act on it and explain why.

You may also lodge a complaint with the Serbian personal data protection authority, the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, www.poverenik.rs).

7. Cookies

We use two cookies that are necessary for login and account security, neither of which can be read by web page scripts: sid keeps you logged in (up to 30 days; deleted when you log out); did is a randomly generated device identifier (set the first time you log in or register and kept for 2 years), used to recognize the same device in login records, helping to detect account takeovers and multiple accounts registered by the same person. The mobile app uses a device identifier generated by the app itself, for the same purpose.

In addition, the website uses a cookie (qvant_lang) to remember the language you choose (only the language code); it is kept for 1 year. We do not use advertising, analytics or third-party tracking cookies.

8. Data security

We take reasonable measures to protect your data: encryption in transit (HTTPS); passwords are stored only as salted one-way hashes (scrypt), and repeated incorrect password attempts trigger a temporary lockout; the database stores only hashes of login tokens; capture location and other embedded metadata are removed from photos; access is controlled by permissions (for example, chat photos can be seen only by the two participants and administrators, photos involved in violations and photos of deleted accounts can be seen only by administrators, and company names and tax identification numbers can be seen only by the account holder and administrators); and administrators' actions are logged.

No security on the internet is absolute. If a data breach occurs that may affect your data, we will notify the competent authority and the affected users as required by law.

9. Minors

The platform is intended only for adults aged 18 or over, and we do not knowingly collect personal data of persons under 18. If an account is found to be used by a person under 18, the platform may ban the account; the minor's parents or other legal guardian may request deletion of the minor's personal data using the contact details below, except data we are required by law to retain.

10. Changes to this Policy and contact

We may update this Policy; updates will be published on this page and the “Last updated” date will be revised. Material changes will be prominently announced on the platform.

If you have any questions, please contact: PYRAMIDS ECOMMERCE DOO BEOGRAD (STARI GRAD), address: Obilićev venac 18, lokal 3.15, 11102 Beograd (Stari Grad), Serbia, email: qvant.bg@gmail.com.