1. Data Controller

Company: OAZA MIRA LLC

Address: 3834 Powerline Road, Fort Lauderdale, FL 33309, USA (principal office) / Mailing address: 261 North University Drive, Suite 500, Plantation, FL 33324, USA

E-mail: contact@oaza-mira.app

2. EU Representative (Art. 27 GDPR)

As OAZA MIRA LLC is established outside the European Union and processes the personal data of EU citizens, we have appointed the following representative in accordance with Article 27 of the General Data Protection Regulation (GDPR):

Organisation: AEON – Vereinigung für Bildung und Organisation der Verbindung zwischen den Generationen Address: Schönbrunner Straße 35/Top 4, 1050 Vienna, Austria ZVR number: 1568721336

Representative's e-mail: contact@oaza-mira.app (attn. AEON)

3. Data We Collect

3.1 Account data

Name, e-mail address, phone number and login data you enter when registering. If you sign in with Google or Apple, we receive your name and e-mail address from them (with Apple possibly a hidden relay address).

3.2 Payment data

Payment information is processed by our partner Stripe. We do not store credit card details on our servers.

3.3 Order data

Information about your orders and care plans, including the grave and its location, the type of service and dates, messages and complaints you send us, and the proof-of-care documentation.

3.4 Usage data

IP address, browser type, device information, pages visited and general interaction data collected by analytics tools, including Google Analytics.

3.5 Communication data

Information you provide when you contact us (by e-mail, WhatsApp or form) or sign up for the newsletter, and data about your consent to tips and offers: whether you gave it, for which channels, when you switched it on or off, and the text you saw at that moment.

3.6 Photos

Photos you upload (e.g. profile photo, photos of the grave and the deceased, photos on a memorial page and in an obituary), the before-and-after photos caretakers upload as proof of service (Proof of Care), and photos of findings at the grave (e.g. damage) reported by caretakers. Photos may show inscriptions, monuments and their surroundings. A grave or memorial page you mark as public can be seen by anyone, even without signing in; a memorial page you share by link can be seen by anyone who opens the link.

3.7 Location data

We record device location only for caretakers: (a) when checking in and completing a visit (GPS coordinates, accuracy and time), as proof that the service was performed at the right place, and (b) when a caretaker standing at the grave records its exact position with the device location. Customers mark the grave's location themselves on the map; we store it as part of the grave data. For caretakers, recording the location at the end of a visit is part of the contract (Art. 5(4) of the cooperation agreement); without it the visit cannot be confirmed. The device permission is a technical setting, not consent within the meaning of the GDPR.

3.8 Phone number

Your phone number is required when you register. We use it to communicate with you about your orders and your account. We do not verify it with a one-time password (OTP). The caretaker sees it in the offer and the order and contacts you directly only if that is necessary to carry out the order; otherwise we communicate with you.

3.9 Grave and deceased person data

Information you enter about the grave site and the deceased person (e.g. name and inscription on the monument, name and location of the cemetery, grave plot reference) that is necessary to perform the ordered service.

3.10 Data of service providers (caretakers)

If you register as a service provider, we also process: your business name, OIB, address and VAT status, details of the person authorised to represent the business, a photo of the registration document and of the liability-insurance policy, details of employees you invite, your service area, customer ratings, your fiscalisation certificate and its password (stored encrypted), business-premises and payment-device codes, invoices issued in your name, data on orders, commissions and payouts, the IBAN for payouts, and location and photos from visits. You enter payout and identity-verification data directly with Stripe. We check your OIB and VAT number in public registers (e.g. VIES, the court register). Legal bases: performance of the cooperation agreement (Art. 6(1)(b) GDPR), legal obligations (point (c)) and our legitimate interest in preventing fraud when checking registers (point (f)).

3.11 Data of other persons and of deceased persons

If you enter data about other people (e.g. family members you invite, mourners in an obituary or employees), you may do so only if you have informed them. We inform invited persons about this Policy at the latest when we first contact them. Data about deceased persons are not personal data within the meaning of the GDPR (recital 27), but we protect them in the same way.

4. Purpose and Legal Basis

Performance of a contract (Art. 6(1)(b) GDPR): processing your orders and care plans, managing your account, processing payments, passing the order to a caretaker and communicating with you about the order; for caretakers: performing the cooperation agreement and payouts.
Legitimate interests (Art. 6(1)(f) GDPR): improving our platform, analytics, fraud prevention, quality assurance (Proof of Care verification), detecting and fixing errors in the app.
Consent (Art. 6(1)(a) GDPR): the newsletter and tips and offers by e-mail and WhatsApp, only if you switched them on yourself (see section 9); marketing cookies on the website, if you accepted them. You can withdraw your consent at any time.
Legal obligation (Art. 6(1)(c) GDPR): tax retention, legal compliance, responding to lawful requests.

We process proof-of-care photos and location data to perform the contract (Art. 6(1)(b) GDPR) and in our legitimate interest in quality assurance and fraud prevention (Art. 6(1)(f) GDPR). We issue and fiscalise invoices in the name and for the account of the caretaker (Art. 78(6) Croatian VAT Act). For this processing the caretaker is the controller, legally obliged to issue, fiscalise and keep invoices (Art. 6(1)(c) GDPR); Oaza Mira acts as its processor.

Automated decision-making: the platform assigns offers to caretakers automatically by service area, type of service, rotation and customer ratings, and approves a caretaker's registration automatically when the register checks match. If a check fails, a member of Oaza Mira's staff decides. You can ask for human review, express your point of view and contest the decision.

Usage data / product analytics

To improve our app and understand which features are helpful, we process a limited amount of usage / interaction data. We store only: a pseudonymous account identifier (Firebase uid), the type of action taken (e.g. registration completed, first grave registered, care proof viewed, recurring engagement), a server-side timestamp, and — where relevant — the identifier of the grave concerned or a short, non-personal action label. These events store no email address, phone number, name, postal address, photos or free text. The purpose is product improvement and measuring activation and retention. This data is not shared with any third party.

The legal basis is our legitimate interest in improving and securing our app under Art. 6(1)(f) GDPR. You may object to this processing at any time (opt-out) via Settings → Privacy in the app; no further usage events are recorded afterwards.

Retention: Event data is retained for at most 14 months and then deleted or anonymised. On request we delete the usage events associated with your uid (right to erasure, Art. 17 GDPR).

5. Recipients and Data Processors

We share personal data with the following categories of recipients to the extent necessary for the operation of our platform:

Stripe, Inc. – payment processing
GoHighLevel (HighLevel Inc., USA) – contact management (name, e-mail, phone number, user type; for caretakers also OIB, status and commission) and communication with users; sends the newsletter, tips and offers only with your consent
Google Analytics – website analytics
Google / Firebase (Google LLC) – app backend, database, authentication, photo storage (Proof of Care) and push notifications
Resend (Plus Five Five, Inc., USA) – Delivery of transactional and system e-mail
WhatsApp (Meta) – WhatsApp messages: order updates and photos, and tips and offers, as described in section 9, and replies when you write to us via WhatsApp
Netlify, Inc. – website hosting and form intake (waiting list)
Google Maps Platform (Google LLC) – Showing maps and cemetery locations; when a map is shown, Google receives your IP address
Service providers (local caretakers) as independent controllers – the caretaker to whom the order is offered (in turn, if the previous one does not accept) already sees, with the offer and before accepting, your name, phone number and e-mail address, the name of the deceased, the grave details and location and the order description. They may not store or use data from an offer they do not accept, and may use data from an accepted order only to carry it out. We remove the offer data from the caretaker's app as soon as the offer is accepted or expires
Croatian Tax Administration – Fiscalisation of invoices issued in the caretaker's name; public registers (VIES, court register) – checking caretakers' details
Functional Software, Inc. (Sentry), USA – error and crash reports (technical data about the device and browser, the type and code location of the error, the app version, a random installation identifier and the country and city derived from the IP address; we do not store the IP address itself, except in reports created up to 29 September 2026, which are deleted when the retention period ends); processor, transfer based on standard contractual clauses

Data is shared only to the extent necessary for the specific purpose. All processors are contractually bound to handle data in accordance with applicable data protection laws.

6. International Data Transfers

Important: Our servers and primary data processing operations are located in the USA. OAZA MIRA LLC is not certified under the EU–US Data Privacy Framework. By using our platform, you acknowledge that your personal data is transferred to and processed in the USA. We apply appropriate safeguards, including Standard Contractual Clauses where applicable, to protect your data during such transfers.

This processing in the USA also covers photos, location data and phone numbers (e.g. via Google/Firebase and Google Maps).

7. Storage Period

We keep your data while your account is active. You can delete your account at any time in the app (Profile › Account & security › Delete account) or request deletion at contact@oaza-mira.app. Before deletion we cancel your active subscriptions; if that fails, we stop the deletion and contact you so that you are not charged again. After your account is deleted we delete your data, except data we must or may keep: we keep invoices, fiscalisation records and data on paid orders on behalf of the caretakers for as long as accounting and tax rules require (as a rule 11 years from the end of the year of issue); we do not change the invoices, and we restrict the processing of your contact details attached to them. We keep evidence of mandates and accepted contracts for as long as needed to establish or defend legal claims, and at most as long as the related invoices are kept. We store these data separately with restricted access and use them only for these purposes (Art. 17(3)(b) and (e) GDPR); we delete them when the period ends. We delete a caretaker's fiscalisation certificate and its password after the caretaker's account is deleted, once all invoices have been fiscalised successfully and 120 days have passed since the last invoice. Data processed on the basis of consent are kept until you withdraw it; we keep the record of your consent to tips and offers as described in section 9. We delete error reports at the latest after 90 days.

8. Your Rights (EU Users)

If you are located within the European Union, you have the following rights under the GDPR:

Right of access (Art. 15 GDPR) – request information about your processed data
Right to rectification (Art. 16 GDPR) – correction of inaccurate data
Right to erasure (Art. 17 GDPR) – delete your account yourself in the app (Profile › Account & security › Delete account) or ask us by e-mail
Right to restriction of processing (Art. 18 GDPR) – restrict the processing of your data
Right to data portability (Art. 20 GDPR) – receive your data in a portable format
Right to object (Art. 21 GDPR) – object to processing based on legitimate interests
Right to withdraw consent (Art. 7(3) GDPR) – withdraw your consent at any time
Right to object to direct marketing (Art. 21(2) GDPR) – at any time, without giving reasons; after an objection we no longer use your data for that purpose

To exercise your rights, write to contact@oaza-mira.app; you can also exercise them through our EU representative (Art. 27 GDPR): AEON, Schönbrunner Straße 35/Top 4, 1050 Vienna, Austria, contact@oaza-mira.app (attn. AEON). We reply without undue delay and within one month of receiving the request; this may be extended by two further months given the complexity or number of requests, in which case we tell you within one month (Art. 12(3) GDPR). You have the right to lodge a complaint with a supervisory authority: in Croatia the Personal Data Protection Agency (AZOP, www.azop.hr); you may also contact the supervisory authority of the EU member state where you live, work or where the alleged infringement took place.

9. WhatsApp messages, newsletter, tips and offers

Updates and photos about your orders are part of the service (Art. 6(1)(b) GDPR) and are not marketing; we send them regardless of consent. We send them via WhatsApp only if you chose this and confirmed your number; otherwise you see them in the app and receive them by e-mail. We send tips and offers via WhatsApp and e-mail only with your consent (at registration or in the settings; off by default), and by e-mail also if you signed up for the newsletter on oaza-mira.app. Before the first WhatsApp message with tips and offers we ask you to confirm your number. We use GoHighLevel for sending and, for WhatsApp messages, WhatsApp (Meta). You can withdraw your consent and object to marketing at any time: in the app settings, by replying STOP, via the unsubscribe link in every e-mail or at contact@oaza-mira.app; withdrawal does not affect the lawfulness of messages sent before. We keep the record of consent, objection and withdrawal as evidence for at most 5 years after withdrawal or deletion of your account.

10. Cookies

Detailed information about our use of cookies can be found in our Cookie Policy.

11. Security

We use industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss or alteration. Payment data is processed exclusively through certified PCI-DSS providers.

12. Children’s Privacy

Our platform is not intended for persons under the age of 18. We do not knowingly collect personal data from minors.

13. Changes to this Privacy Policy

We update this Privacy Policy when our processing or the law changes. We inform you in advance of material changes in the app or by e-mail; the effective date is shown at the top.

14. Contact

For all privacy-related enquiries:

E-mail: contact@oaza-mira.app

EU representative: AEON, Schönbrunner Straße 35/Top 4, 1050 Vienna, Austria