Privacy Policy

1. Who we are

Rethink Now DOO Novi Sad (short name: Rethink Now DOO), Gogoljeva 3/3, 21000 Novi Sad, Republic of Serbia — registration number (matični broj): 21626694, tax ID (PIB): 112202658, registered with the Serbian Business Registers Agency (APR) — ("Kinta", "we") is the controller of the personal data processed through the Kinta mobile application (the "App") and the website www.kinta.co (the "Site").

Until 4 August 2026, the Kinta service was operated by Wolet d.o.o., Kralja Petra I 81A/3, 22000 Sremska Mitrovica. As of that date, Rethink Now DOO took over the service, including existing user accounts and their data, as its operator and controller. Nothing about how your data is used changed as a result of the takeover, and this Privacy Policy governs from its effective date.

For anything related to your personal data, contact us at Show email (company e-mail: Show email).

This Privacy Policy is drafted under the Serbian Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti — "ZZPL"), which follows the same principles as the EU's GDPR and gives you materially equivalent rights.

2. Privacy at Kinta — the short version

• We don't know who you are by name. You sign in with Google or Apple; inside Kinta you are identified only by a randomly generated 6-character Kinta ID, not by your name or e-mail address.
• Your data lives in the EU. Our databases run on Google Cloud / Firebase in the europe-west3 (Frankfurt) region.
• We never sell your personal data, and we show you no ads. We earn money by selling anonymised, aggregated statistics — trends across large groups of users that cannot be linked back to any individual (see §6).
• AI never trains on your data. Receipt reading and categorisation use Anthropic's Claude models under commercial terms that prohibit training on our users' content (see §5).
• You are in control. You can delete individual receipts, or your entire account with all its data, directly in the App (Profile → Delete account permanently).

The rest of this Policy is the detail behind that summary.

3. What data we process

3.1 Account and sign-in data

You create an account by signing in with your Google or Apple account. We receive a sign-in token and limited account information from your provider (a technical identifier and, depending on your provider and settings, an e-mail address), which we use solely to create, secure and restore your sign-in. Your account within Kinta is identified by your Kinta ID — a randomly generated 6-character code. We do not use your name to identify you in the App, and your receipts and activity are linked to your Kinta ID, not to your provider identity. This pseudonymisation is a deliberate design choice; note that pseudonymised data still counts as personal data under data-protection law, and we protect it accordingly.

3.2 Receipt data

How receipt data enters Kinta depends on the receipt:

• Fiscal receipts verified with the tax authority (Serbia, Bosnia and Herzegovina, Montenegro). Scanning the QR code retrieves the receipt's contents from the official receipt-verification service of the issuing country's tax authority: merchant details, items purchased, amounts, taxes, date and time, and receipt identifiers. If a QR code is damaged or missing, you can type the receipt's fields manually and Kinta performs the same lookup through the official verification service for you. Where a retrieval does not complete immediately, our systems retry it for a limited period, including from our servers.
• Photographed receipts (OCR) — any country. Where a receipt cannot be retrieved by QR code (for example, North Macedonia), you can photograph it and we extract its contents (see §5). The photo itself is kept and remains available to you in the App (Receipt → More options → Show the original photo) until you delete the receipt or your account.
• Utility and payment slips (Serbia). Scanning the payment QR code on a utility bill reads the payment details it contains — recipient, account number, amount and purpose of payment.
• Imports, manual and recurring entries. You can import receipts from PDF files and images (file import, your photo library, or your device's share menu), add amounts manually (such as tips or cash expenses), and set entries that repeat automatically (such as monthly bills).
• Categories. Each receipt is automatically assigned a spending category (see §5).
• Warranty reminders. If you set a reminder on a receipt, we store the warranty period and reminder date you chose.

Receipts can reveal things about you — for example, purchases in a pharmacy. We do not use receipt contents to draw conclusions about your health or other sensitive characteristics, and we do not create individual profiles of that kind.

3.3 Sharing with another person

You can link your account with one other user by entering their Kinta ID (Settings → Add person). Linked accounts share visibility of the shared budget and receipt data within the App. Only link your account with someone you trust. Please note: receipts that have already been shared with the other person remain visible to them even if you later remove the link — a shared receipt stops being visible to them only when it is deleted. You can remove the link at any time in Settings.

3.4 Technical and security data

When you use the App or the Site, we process technical data necessary to run them: device type and operating system, app version, language/region setting, IP address, timestamps, and technical logs (including crash and error data). We use this to keep the service functional, stable and secure.

3.5 Analytics data (only with your consent)

With your consent, we collect usage analytics — screens visited, features used, session duration — via Google Analytics for Firebase in the App and Google Analytics 4 on the Site. Analytics helps us understand how Kinta is used and what to improve. We do not collect analytics without consent: in the App you are asked at first launch and can change your choice at any time in Settings; on the Site, via the cookie banner (see §12).

3.6 Support chat

If you contact us through the in-app chat (Settings → Chat Support), our support tool Crisp processes your messages and basic session data so we can help you.

3.7 Newsletter (Site)

If you subscribe on the Site, we process your first name, last name and e-mail address to send you news about Kinta. You can unsubscribe at any time via the link in every e-mail, after which we stop sending and delete your subscription data.

3.8 Push notifications

If you enable notifications, we process your device's push token to deliver warranty reminders and service messages. You can disable notifications in your device settings at any time.

4. Why we process your data, and on what legal basis

5. AI in Kinta: receipt reading and categorisation

Kinta uses artificial intelligence for two things only: reading photographed receipts (OCR) and assigning a spending category to each receipt. For this we use Claude models provided by Anthropic as our processor (currently Claude Haiku for fast extraction and Claude Sonnet for detailed line-item extraction). Receipt photos are stored in our EU-region storage (Frankfurt); for extraction, the photo and receipt contents are transmitted to Anthropic and used for nothing else — Anthropic's commercial terms prohibit it from training its models on our users' content.

Extraction results are checked by automated validation rules (for example, whether the line items add up to the total and whether the tax rates are plausible for the country) before a receipt is marked complete. Where those checks flag a low-confidence result, it may be reviewed and corrected manually by authorised Kinta staff so that your receipt is accurate; such access is restricted, pseudonymous and logged (§10). Some steps run entirely on your device and send nothing anywhere — QR/barcode detection and the preliminary total shown while a photo is being processed.

Categorisation is automated, but it does not produce any decision with legal or similarly significant effects on you — it only organises your own spending overview, and you can correct a category at any time in the App. Kinta does not include a chatbot or AI assistant. If we introduce one, we will update this Policy and the App first, and you will always be clearly informed when you are interacting with AI.

6. Aggregated statistics for business customers

Kinta is free for users. We fund it by offering brands and researchers aggregated, anonymised statistics about spending trends — for example, how a product category performs across a region over time — through a separate business portal.

What this means for your data, precisely:

• Business customers see only aggregated statistics about groups of users, never individual data. No receipt, no purchase history, no Kinta ID and no identity of any individual user is ever shared or sold.
• Statistics are only displayed for sufficiently large groups. Where a query would cover too few users to be safely anonymous, the result is suppressed. Exports are subject to the same rules.
• To make group statistics more useful, we may derive rough, estimated characteristics (such as an approximate age range or region) from usage patterns. These are estimates used solely to build aggregate views — they are never shown at individual level, never shared, and never used to make decisions about you.
• We maintain a documented anonymisation methodology and contractually prohibit our business customers from attempting to re-identify anyone.

Because the statistics that leave our platform are anonymised, they are no longer personal data. The processing that produces them (described above) is based on our legitimate interest; you have the right to object at any time (§11).

7. Who receives your data

We use a small number of service providers (processors) who process data only on our documented instructions:

In addition: members of our engineering team (including contractors outside the EU) may access data strictly as needed for development and support, under confidentiality and data-protection agreements, including standard contractual clauses where they are located in other countries. Apple and Google act as independent controllers for their own sign-in services and app-store platforms. We may also disclose data where a law or a binding order of a competent authority requires it.

We do not share personal data with advertisers or data brokers, and we run no advertising in the App.

8. International transfers

Your data is primarily stored in the European Union (§7 — Frankfurt, Germany). Serbian law permits transfers to EU/EEA countries, which are recognised as providing an adequate level of protection, so our EU hosting requires no further conditions. Where a recipient processes data in the United States (Anthropic, Loops, Cloudflare) or accesses it from another country (members of our engineering team, for example in India), we put contractual data-protection safeguards in place with that recipient — standard contractual clauses for the protection of personal data — together with technical measures (encryption in transit, pseudonymisation by Kinta ID). Because we are established in Serbia, our own team's access from Serbia takes place within the controller itself, under documented internal security measures.

9. How long we keep data

When you delete your account in the App (Profile → Delete account permanently), your account and its content are permanently deleted; residual copies leave our backups within the backup cycle. We retain data longer only where a legal obligation requires it or where necessary to establish, exercise or defend legal claims.

10. How we protect your data

We apply technical and organisational measures appropriate to the risk: encryption of data in transit and at rest, EU-region hosting, pseudonymisation of accounts by Kinta ID, strict internal access controls — our internal administration panel is limited to authorised persons, protected by two-factor authentication, shows users only by Kinta ID, and every access is logged — and regular review of our security practices. No system is perfectly secure; if a breach occurs that risks your rights, we will notify the competent authority and, where required, you, in line with the law.

11. Your rights

You have the right to: access the data we hold about you; rectification of inaccurate data; erasure; restriction of processing; data portability (a machine-readable copy of the data you provided); objection to processing based on legitimate interest — including the aggregated-statistics processing in §6; and withdrawal of consent at any time (for analytics or the newsletter), without affecting past processing.

The fastest routes: delete your account or individual receipts directly in the App; manage analytics in Settings; unsubscribe from the newsletter via any e-mail. For everything else, write to Show email from within the App or with your Kinta ID so we can locate your data — because accounts are pseudonymous, we may ask you to verify control of your account rather than your civil identity.

We respond within 30 days (for complex requests this may be extended by up to a further 60 days, in which case we tell you).

You can complain to the supervisory authority: the Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, www.poverenik.rs. If you live outside Serbia, you may also contact the data-protection authority of your country of residence.

12. Cookies and similar technologies

On the Site, we use:

Necessary cookies cannot be switched off; analytics cookies load only after you consent via the banner, where you can also change your choice.

In the App, we do not use cookies, but the analytics service described in §3.5 uses device identifiers. These are activated only after you consent at first launch, and you can switch them off at any time in Settings.

13. Children

Kinta is intended for users aged 16 or older. We do not knowingly process data of anyone younger; if we learn that a younger person has created an account, we will delete it. If you believe a child is using Kinta, contact us at Show email.

14. Automated decision-making

Kinta does not subject you to any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The automated processing we do perform — receipt categorisation and the derivation of estimated group characteristics — is described in §5 and §6.

15. If Kinta changes hands

If Rethink Now DOO is involved in a merger, acquisition, or sale of all or part of its business, your data may be transferred to the successor as part of that transaction. The successor remains bound by this Privacy Policy (or one at least as protective), and we will inform you through the App or the Site before your data becomes subject to a different policy. If the service is discontinued without a successor, your data will be deleted.

16. Changes to this Policy

We may update this Policy as the service or the law changes. For significant changes we will notify you in advance through a prominent notice in the App and on the Site. The "Last updated" date at the top always tells you the current version.

17. Contact

Rethink Now DOO, Gogoljeva 3/3, 21000 Novi Sad, Republic of Serbia — Show email (company e-mail: Show email).

A plain-language summary of our privacy practices is available in the Trust Center at www.kinta.co/trust. If the summary and this Policy ever differ, this Policy prevails. This Policy is published in Serbian and English; in case of any divergence between the two versions, the Serbian version prevails.