Sarafan Privacy Policy
Effective date: 13 September 2026
Last updated: 13 September 2026
1. Who we are
Sarafan is a project that helps people present their work, discover professionals and businesses, exchange recommendations and referrals, and identify useful paths through trusted networks. This Privacy Policy applies to the Sarafan website, mobile applications, and related services (together, the “Service”).
The operator of Sarafan and controller of personal data is:
Bakhty Khuja
Dr Ivana Ribara Str. 13
21000 Novi Sad, Serbia
Email: info@usesarafan.com
In this Policy, “Sarafan,” “Sarafan Project,” “we,” “us,” and “our” refer to that operator and the Service.
2. Scope
This Policy explains what information we process, why we use it, how it may be disclosed, how long it is kept, and the rights and choices available to you. It applies when you visit Sarafan, create or use an account, publish a profile or content, make or receive a recommendation or referral, use network features, or contact us.
It does not govern the independent practices of professionals, businesses, customers, websites, or services reached through Sarafan.
3. Information we process
The information depends on how you use Sarafan.
Account and identity information
This may include your name, username, email address, phone number, sign-in information, preferred language, age or age-range confirmation, profile image, and account settings. Passwords are stored in protected form or handled by an authentication provider.
Professional and business information
This may include your trade, skills, business name, service descriptions, service area, availability, qualifications, licenses, prices, links, and other details you choose to add to a profile.
Content and communications
We process material you submit, including photos, videos, portfolio items, descriptions, recommendations, referral messages, reports, support requests, and survey responses. Recommendations, referrals, and actions may reveal relationships between people.
Contact-network and relationship information
If you grant contact permission, the app may read contact identifiers on your device to find participating users and calculate useful relationship paths. Sarafan is designed so that readable address-book phone numbers remain on your device and are not stored in Sarafan's relationship graph. Before graph matching, contact identifiers are normalized and converted into cryptographically protected pseudonymous tokens.
Sarafan may process those tokens, token matches, connection signals, and permitted relationship paths in its cloud systems. These are pseudonymous personal data, not anonymous data. Matching may allow Sarafan to infer that people are connected or potentially reachable through a mutual contact. Sarafan does not display a non-user's raw contact details merely because that person appears in another user's address book.
Contact permission is optional. You may refuse it and still use features that do not require contact matching. You may revoke permission in your device settings. Revoking permission stops future access but does not by itself delete information already processed; see Sections 9 and 10.
Device, usage, and security information
We may process IP address, device and browser type, operating system, app version, language, approximate region inferred from IP, operational identifiers, timestamps, features used, diagnostic logs, crash data, and signals needed to prevent fraud, scraping, spam, and account abuse.
Location and service area
We process locations or service areas that you deliberately enter in a profile, search, or request. Sarafan does not collect background device location at launch. If a feature requests device location, the app will explain the purpose and request operating-system permission first.
Information from other people and public sources
Another user may recommend you, refer someone to you, include you in a relationship path, report content, or submit information involving you. We may consult public professional or business information where reasonably necessary to verify authenticity, protect users, or comply with law.
Payments
Sarafan does not currently process payments between customers and professionals. If paid Sarafan features are introduced, this Policy and the applicable purchase terms will be updated before those features launch.
4. Why we process information
We use information to create, authenticate, secure, and maintain accounts; display profiles and content under user-selected visibility; enable discovery, recommendations, referrals, introductions, and network paths; personalize and improve search, ranking, and suggestions; send service and permitted marketing communications; provide support; moderate content; prevent fraud and abuse; measure performance and diagnose errors; comply with law; and establish, exercise, or defend legal claims.
Where European or Serbian data-protection law applies, the legal basis may be performance of our contract with you, your consent, compliance with a legal obligation, or our legitimate interests in operating, improving, and protecting Sarafan. We rely on consent when law requires it, including for device permissions and certain communications. You may withdraw consent at any time without affecting earlier lawful processing.
5. Visibility and disclosure
Public and user-visible information
Information you deliberately publish—such as a professional profile, portfolio, or public recommendation—may be visible to other users or the public and may be indexed by search engines. Relationship paths and referral information are displayed only as permitted by applicable product settings and rules. Review visibility before publishing.
Service providers
We may use providers for hosting, authentication, security, analytics, communications, customer support, error monitoring, and future payment processing. They may process information only to provide defined services and under contractual, confidentiality, security, and data-protection obligations. We remain responsible for accurately disclosing production providers and software development kits in our store disclosures and in this Policy where required.
Legal, safety, and integrity reasons
We may preserve or disclose information when reasonably necessary to comply with law or valid legal process, protect a person's safety, investigate fraud or abuse, enforce our Terms, or protect the rights and security of Sarafan and its users.
Organizational change
If the Service or its assets are reorganized, financed, acquired, or transferred, information may be disclosed under appropriate confidentiality and data-protection safeguards. We will notify users where law requires it.
We do not sell personal information and do not use it for cross-context behavioral advertising.
6. Recommendations and automated ordering
Sarafan may use profile, activity, service area, reputation, and relationship signals to order search results or suggest people, services, or paths. These systems assist discovery; they do not make decisions producing legal or similarly significant effects about you. A Sarafan ranking, recommendation, verification marker, or network connection is not a guarantee of identity, qualifications, quality, legality, safety, availability, or outcome.
7. International processing
Information may be processed in Serbia and in countries where our service providers operate. Where required, we use a lawful transfer mechanism and appropriate safeguards, such as an adequacy decision, approved contractual clauses, or another recognized mechanism. Contact us if you want information about safeguards relevant to your data.
8. Retention
We retain information only as long as reasonably necessary for the purposes described in this Policy, including operating the Service, resolving disputes, maintaining security, and meeting legal obligations.
- Account and profile data is retained while the account is active. Following a verified deletion request, account-linked information is normally deleted or irreversibly de-identified from active systems within 30 days.
- Rotating backup copies are normally overwritten within 90 days and are not returned to ordinary product use.
- Support records may be retained for up to 24 months after a request is closed.
- Security, fraud, moderation, and abuse records may be retained for up to 36 months, or longer while an investigation, dispute, legal duty, or claim remains active.
- Financial or tax records, if any, are retained for the period required by law.
- Public content copied or shared by other people may remain outside Sarafan's control.
Aggregated or irreversibly anonymized information may be retained because it no longer identifies a person.
9. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information; object to certain processing; withdraw consent; opt out of marketing; and complain to a data-protection authority.
You may use available in-app controls or email info@usesarafan.com with the subject “Privacy request.” Describe the request and identify the relevant account. We may request proportionate verification before disclosing or changing information. We will not discriminate against you for exercising a privacy right.
Residents of Serbia may contact the Commissioner for Information of Public Importance and Personal Data Protection. People in the EEA may contact the supervisory authority responsible where they live or work.
10. Account deletion
You may initiate deletion through Settings → Account → Delete account or through https://usesarafan.com/support/delete-account. If you cannot access the app, email info@usesarafan.com from the address connected to your account with the subject “Delete my Sarafan account.” Uninstalling the app does not delete the account.
Deletion permanently removes or irreversibly de-identifies account-linked information, subject to narrow retention needed for security, fraud prevention, legal obligations, dispute resolution, or the rights of other users. Where another user's independent content refers to you, we may remove or de-identify your information rather than delete that user's own record where law permits.
11. Security
We use technical and organizational measures designed to protect information, including access controls, encryption in transit, protected storage, logging, least-privilege practices, and separation of sensitive functions where appropriate. No system is perfectly secure. Report a suspected vulnerability or account-security issue to info@usesarafan.com with the subject “Security.”
12. Children
Sarafan is not intended for anyone under 16, and people under 16 may not create an account. We do not knowingly collect account data from children under 16. If you believe a child has provided such information, email info@usesarafan.com so we can investigate and, where appropriate, delete it. A higher local age or additional authorization requirement applies where required by law.
13. Third-party services
Profiles and messages may link to third-party websites or services. Their privacy practices are governed by their own policies. Sarafan is not responsible for information you provide directly to an independent professional, business, customer, or third-party service.
14. Changes to this Policy
We may update this Policy as the Service or law changes. We will post the revised version with a new effective date and provide additional notice when changes are material or consent is required.
15. Contact
For privacy questions or requests:
Sarafan Project
Operated by Bakhty Khuja
Dr Ivana Ribara Str. 13
21000 Novi Sad, Serbia
info@usesarafan.com