Cookie Policy

1. Your choices

When you first visit, a banner lets you Accept all or Reject all cookies, or open Settings to choose by category. You can change your choice at any time via the “Manage cookies” link in the footer.

Necessary cookies are always active. Optional categories (analytics, marketing, preferences) are off until you enable them. If you do not accept analytics, we still measure aggregate traffic anonymously — with a throwaway identifier that is not linked to you across pages or visits.

2. Categories we use

Strictly necessary — required for core features such as login, security, language, currency, and recognizing a trusted device for in-store login. These cannot be switched off.

Analytics — help us understand how the platform is used so we can improve it, using first-party analytics, PostHog and Google Analytics. With your consent, analytics can recognize a returning visitor and PostHog may record the session (clicks and movement on the page; text typed into fields is masked). Without consent, first-party analytics and PostHog stay anonymous, session recording does not run, and Google Analytics does not load.

Marketing — used to measure and improve campaigns. We do not currently use marketing cookies.

Preferences — remember choices such as display options to personalize your experience.

3. Cookies and similar technologies we use

The main cookies and identifiers used on our platform are:

• ds_universal_id — necessary, first-party — recognizes your device for security and in-store login; not used to identify you for analytics unless you accept. Duration: up to 2 years.
• ds_cookie_consent — necessary, first-party — remembers your cookie choices so we do not ask again. Duration: 1 year.
• dservice_locale, currency, theme — necessary / preferences, first-party — remember your language, currency and appearance. Duration: up to 1 year.
• PostHog (ph_* cookies) — analytics, provider PostHog, hosted in the EU — set only after you accept analytics; used for product analytics and, with that same consent, session recordings (form input text is masked). Without consent PostHog runs in a cookieless, anonymous mode and does not record the session. See posthog.com/privacy. Duration: up to 1 year.
• Google Analytics (_ga, _ga_* cookies) — analytics, provider Google — loaded only after you accept analytics; used to measure traffic and where visitors come from. Data is processed by Google, including in the United States, under Google’s terms and standard contractual clauses. Not used on business custom domains. See policies.google.com/privacy. Duration: up to 2 years.

4. Analytics and anonymity

We use first-party analytics (screen views), PostHog product analytics and Google Analytics. If you accept analytics, we may link activity to a persistent identifier and, when signed in, to your account, to understand returning visits. PostHog may also record the session so we can see where the product is hard to use; form fields (including OTP, phone, email and password) are masked. If you do not accept, Google Analytics does not load, session recording does not run, and we only record anonymous, aggregate data that cannot be traced back to you.

Our first-party analytics and PostHog data, including session recordings, are hosted in the European Union. Recordings are kept for a limited period (currently one month). Google Analytics data is processed by Google and may be transferred outside the EU, including to the United States, under appropriate safeguards.

5. Managing and withdrawing consent

You can withdraw or change your consent at any time using “Manage cookies” in the footer. Withdrawal is as easy as giving consent. You can also block or delete cookies in your browser settings, though necessary cookies are required for the site to function.

We keep a record of your consent choices (the categories, the version of this policy, the time and your language) to demonstrate compliance.

6. Your rights and contact

You have rights under the Serbian Law on Personal Data Protection and the GDPR, including access, correction, deletion and objection. You may also lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or your local supervisory authority.

For any questions about this policy, contact us at [email protected].