Privacy policy

Last updated: 11 November 2026

This policy explains how personal data is processed in the BarbaVox mobile app (Android and iOS) and on this website.

Who is responsible

The BarbaVox app and website are published by Edukacioni centar "BARBADOS" d.o.o. Sarajevo, Podružnica BarbaSolution (hereinafter: BarbaSolution), Musala 7, 71000 Sarajevo, Bosnia and Herzegovina. Registered office: ul. KSC Jošanička br. 33, Sarajevo, Vogošća; JIB: 4200825260009; MBS: 65-01-0566-10. Email info@barbasolution.com, phone +387 61 447 482.

• Mobile app: BarbaVox is a CRM for real estate agencies. The app is used by agents of agencies that run BarbaVox, and accounts are created by the agency. For client and agent data, the agency is the controller: it decides which data is kept, who can access it and for how long. BarbaSolution is the processor and processes data only on the agency's instructions, under a data processing agreement.
• Website: BarbaSolution is the controller for data sent through the contact form.

We apply this policy in line with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH 12/25) and, for people and companies in the European Union, the General Data Protection Regulation (GDPR).

Mobile app

Data the app processes

• Sign-in and account: email and password (the password is sent only to the server when signing in and is never stored on the phone), account and agency identifiers, an app installation identifier, the device name "BarbaVox mobile" and the app language.
• Client data: data the agent enters or approves: names, phone numbers, email addresses, search requests (property type, locations, budget, conditions), property interests, notes and next steps.
• Voice memos: the audio summary the agent records, with its time and duration. The server converts it to text (a transcript) and extracts details from it, which the agent reviews, corrects and approves.
• Calls (Android only, optional): when the agent turns on "After a call": that a mobile call ended, its time and direction, and, with the Call log permission, the other party's number. Calls are never recorded. Existing call history is not imported.
• Reminders: next steps are scheduled as local notifications on the phone; no push services are used.

What is stored on the phone

Account data (clients, calls, notes and work waiting to be sent) is kept in a database encrypted with a key from the phone's secure storage (Keychain on iOS, Keystore on Android), separately for each account. A voice memo stays on the phone until the server confirms it was received, and afterwards only if the agent turns on keeping uploaded recordings in the settings. Signing out does not delete unsent work: it stays encrypted and is sent the next time the same account signs in. Uninstalling the app removes all data from the phone.

What the app does not collect

The app does not access contacts, photos, the camera or location. The microphone is used only while the agent records a memo. No advertising identifier is used. There are no ads, analytics or third-party tracking tools.

Purpose and legal basis

The data is used to manage the agency's client relationships: records of calls, notes, property requests and agreed next steps. The legal bases are the agency's contract with the client or steps taken at the client's request before a contract, the agency's legitimate interest in keeping business records, and the agent's employment contract. Phone state and the call log are used only with the agent's permission.

Voice memo processing

Transcription and extraction run on the agency's BarbaVox server with a speech recognition and text processing service, [service and provider name], acting as a sub-processor under a data processing agreement. The service uses the data only for this processing and does not use it to train its models. A memo that is not linked to a client is not sent for processing. Extracted details are suggestions: they reach the CRM only after the agent approves them.

How long data is kept

On the server, for as long as the agency decides in line with the law; audio recordings are kept according to the retention rule the agency sets. After the agency's contract ends, data is deleted or returned to the agency under the data processing agreement. On the phone, data is kept until unsent work is uploaded after signing out, or until the app is uninstalled.

Who can access the data

Authorised agency users according to their permissions (an agent sees their own clients, and other agents' clients only if the agency allows it), BarbaSolution as processor only as far as needed for operation and support, and the sub-processors listed above. Data is hosted in a data centre in [server location, e.g. EU]. We do not sell or rent data or give it to advertisers. Authorities receive it only when required by law.

Security

The connection to the server is encrypted (HTTPS) and data on the phone is encrypted. Access on the server is limited by roles and client permissions, and every approved change from a voice memo is logged (who, when and what).

Website

Contact form

When you send an inquiry, we keep the data you entered: your name, company, phone or email, industry, number of salespeople and notes, the plan if you selected one, and the page language. We use it only to answer your inquiry and arrange a presentation; the legal basis is taking steps at your request before a contract. Inquiries are seen only by authorised BarbaSolution staff. We do not sell them or use them for advertising. We keep them while we are in contact about the inquiry and during any cooperation that follows, and you can ask us to delete them at any time.

Cookies

The website uses only cookies that are necessary for it to work: a session cookie and the XSRF-TOKEN cookie, which protects the contact form against forged requests. They are short-lived and expire with the session. They are not used for analytics, advertising or tracking, so we do not ask for consent.

Fonts and technical logs

To display text, the website loads fonts from Google Fonts, so your browser sends your IP address and browser details to Google. Like any web server, the website's server may briefly log technical access data (IP address, time, requested page) for security and troubleshooting. The website has no ads or analytics tools.

Your rights

You have the right to know which data about you is processed and to receive a copy, to request correction, deletion, restriction of processing and portability, and to object.

• App data: send your request to the agency, because it is the controller. You can also write to us and we will forward your request to the agency and help it respond. Agents request deletion of their account on the Account deletion page.
• Website data: write to us at info@barbasolution.com.

You can also lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina.

Children

The app and the website are intended for business users, not children.

Changes

We will publish any changes to this policy on this page. The date of the last update is shown at the top.