Privacy Policy

Last updated: August 1, 2026

Petica is an educational platform for primary-school students (grades 1–8) in Serbia. This privacy policy applies to the Petica website (5ica.org), the Petica mobile app for Android and iOS devices, the Petica desktop app for Windows and macOS computers, and all related services we provide. Because our users include minors, we handle personal data with special care. This policy describes what data we collect, why we process it, how long we keep it, and who we share it with.

Ova stranica je prevod — pročitajte politiku privatnosti na srpskom. The Serbian version is the primary policy for our users.

1. Who is the data controller

The data controller within the meaning of the Personal Data Protection Act of the Republic of Serbia is Rent a POP DOO, Konstantina Kavafija 6, Belgrade, Serbia, tax ID (PIB) 115414746, company registration number 22154575, which provides the service called Petica. For any questions about data processing, write to us at kontakt@5ica.org.

2. Children's protection

Petica is intended for primary-school students, so protecting children is our top priority. The following rules apply:

A child's account is created exclusively by a parent or legal guardian, using an email address the parent controls. We do not ask for or store the child's personal email.
We do not show children personalized ads and do not track them for marketing purposes.
We never sell children's data to third parties.
We use a child's personal data only to provide the educational service and track learning progress.
If you believe a child has provided us with personal data without parental consent, write to us at kontakt@5ica.org and we will delete that data without delay.

3. What data we collect

We aim to collect only what is necessary for learning to work. In practice this means:

Child profile: name or nickname, grade, selected subjects, and script (Latin/Cyrillic).
Learning progress: which lessons the child opened, which exercises they completed, correct and incorrect answers, test grades, and attempt history.
Learning time: when the child entered and left a lesson, and total time spent per subject and per day.
Parent account: the parent's email address and notification settings (days of the week when we send the report).
Technical data: device type, browser, language, and IP address at sign-in (for security and abuse detection).
Free-text answers: text the child enters in open-answer exercises, so we can give feedback.

We do not collect real-time location, we do not read contacts, and we do not access the child's camera or microphone.

A child's account is always created by a parent or guardian, using an email address the parent controls. We do not ask for or store the child's personal email.

Trial mode without an account: Petica can also be tried without creating an account. In trial mode we store no personal data and no progress — only the anonymous visit statistics described in this policy are recorded.

4. Why we process data

To show the child appropriate lessons and exercises and remember their progress.
To send the parent a periodic report on what the child has been doing and how they are doing.
To improve the content (e.g. to see which exercises are too hard or unclear) and fix technical problems.
To fulfil legal obligations (accounting, responding to requests from competent authorities).

5. Legal basis

We base processing on the contractual relationship with the parent (access to the service), on legal obligation (accounting, possible requests from competent authorities) and, where required, on the parent's consent. Because the users are minors, consent for opening an account is always given by a parent or guardian.

We process the IP address on the basis of our legitimate interest — to prevent abuse and protect system security (e.g. limiting sign-in attempts and detecting suspicious activity).

6. Who we share data with

Petica does not sell personal data. To operate the service we rely on vetted data processors, each processing only as much as its function requires:

Clerk — user sign-in and authentication (email, sign-in token, session records). Clerk processes this data under its own privacy policy and a data processing agreement.
A PostgreSQL database hosted in a secure cloud environment — the primary database storing profiles, progress, and grades.
Resend — sending email messages: notifications and reports to the parent, as well as internal aggregate feedback digests to our team (without the child's name).
Anthropic — solely for automatic moderation (a safety check) of text a user voluntarily submits through the feedback and report form (only the message text is sent, without the child's name). There is no other AI processing of a child's data.

Word pronunciation in the app uses pre-recorded (pre-baked) audio that we prepare in advance, so listening sends no child data to external services.

We have, or are putting in place, appropriate data processing agreements with all processors. Data may be transferred outside the Republic of Serbia (e.g. to the EU or the US) with standard contractual clauses and other appropriate safeguards applied.

7. How long we keep data

We never keep personal data indefinitely. Every type of data has a retention period, and a protected background mechanism automatically deletes or anonymizes expired data once a day. "Deletion" means the data disappears; "anonymization" means we remove the link to the child and all personal text, keeping only anonymous statistics that can no longer be linked to anyone.

Child profile and learning history (report book: test grades, manually entered school grades, schedule) are kept while the account is active, because they follow the child through primary school. The parent can request deletion at any time.
Inactive accounts — if nobody signs in to an account for 24 months, we contact the parent and then delete the account and all associated data.
After account closure, data is deleted within 30 days, except data we are legally required to keep (e.g. invoices).
Activity logs (individual learning sessions: when the child entered and left) are kept for 90 days and then deleted. Aggregate daily learning statistics (without individual sessions) are kept for up to 13 months to show progress, then deleted.
In-app notifications (school-test reminders) are deleted 90 days after they pass.
Records of emails sent to the parent are kept for 12 months and then deleted.
Safety (moderation) logs — records of whether some content was safe — are anonymized after 180 days: we remove the link to the child and all entered text, and only anonymous statistics remain.
Anonymous visit statistics — to know how many people visit the site, we record only a random, anonymous visit number per day. That record is not linked to a name, an account, or an IP address, and is deleted after about 13 months.

8. Your rights

The parent, as the child's legal representative, has the right to:

request access to the data relating to the child;
request correction of inaccurate or incomplete data;
request deletion of data (the "right to be forgotten") when there is no longer a basis for processing;
restrict or object to a particular type of processing;
receive a copy of the data in a common, machine-readable format;
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

Requests are submitted to kontakt@5ica.org from the email address registered as the parent's. We respond within 30 days at the latest.

9. Account deletion

A parent can permanently delete the account at any time in two ways:

directly in the app — via Settings → Danger zone → "Delete account" (Podešavanja → Opasna zona → „Obriši nalog"), with confirmation; or
by sending a request to kontakt@5ica.org from the email address registered as the parent's.

Deleting the account permanently removes the parent account and all associated family data (child profiles, grades, test results, and other data), except data we are legally required to keep (e.g. invoices). Deletion is completed within 30 days.

See the dedicated account deletion page for step-by-step instructions.

10. Data security

Traffic between your device and Petica is encrypted (HTTPS). Database access is restricted and controlled, passwords are never stored in plain text, and only team members who need it for their work can access personal data. We continuously work on improving security and monitor known vulnerabilities.

11. Cookies

Petica uses only essential cookies needed for sign-in and the correct functioning of the app (session, script choice, grade choice). We also use one anonymous cookie with a random number, solely to distinguish a new from a returning visitor in aggregate visit statistics — it is not linked to a name, an account, or an IP address. We do not use advertising cookies and we do not track users for marketing purposes.

12. Changes to this policy

We may change this policy to reflect changes in the service or in regulations. The date of the last change is always shown at the top of the page. We will notify parents of significant changes by email before they take effect.

13. Contact

For all questions, requests, and complaints regarding data protection, write to us at kontakt@5ica.org.

Data controller:

Rent a POP DOO
Konstantina Kavafija 6, Belgrade, Serbia
PIB (tax ID): 115414746, company registration number: 22154575