This Privacy Policy describes how Cosmic Production d.o.o. ("we", "us") collects, uses, and protects personal data when you use our mobile applications ("Cosmic Production for iOS", "Cosmic Production for Android") and the web app at app.cosmicproduction.hr.
When you sign up: email address, name, optional phone number and company name.
When you book equipment: the items selected, dates, venue name and city, any notes you provide, and a record of the booking request.
When you sign a rental agreement (via the magic-link signing flow): your full name, email, optional company name, your IP address and User-Agent at the time of signing, and a snapshot of the agreement terms. This is required for eIDAS Simple Electronic Signature non-repudiation evidence.
When you check in at a venue (worker/field staff only): your latitude, longitude, and approximate accuracy at the moment of tap, stored alongside the check-in event. We use this to confirm field crew was on-site. Location is captured only at the moment of tapping the check-in button — we do not track continuously.
When you upload a photo (worker/field staff only): the image itself plus the kind tag you selected (setup_proof / damage / reference / breakdown / other).
Automatically: standard server logs (IP address, timestamp, user-agent) for security and abuse prevention. No analytics SDKs, no advertising SDKs, no third-party trackers.
We don't sell or share personal data with advertisers or data brokers. We share it only with:
Personal profile data (name, phone, email) is kept while your account is active and for 90 days after you delete it.
Booking history, signed agreements, and quotes are retained for 11 years as required by the Croatian Accounting Act (Zakon o računovodstvu, Art. 8). Personal identifiers in those records are minimized to what's legally required.
Field worker check-in geolocation: 24 months from the event date, then permanently deleted.
Job photos: until the event is closed + 12 months, then permanently deleted.
You have the right to:
The app is intended for adults (18+) booking AV rental services. We don't knowingly collect data from children under 16. If you believe we have, contact us and we'll delete it.
Data is transmitted over HTTPS. Database access is gated by Row-Level Security policies. Secrets are stored encrypted at rest in Cloudflare Workers and Supabase.
We'll update the "Last updated" date at the top of this page and, for material changes, notify active users via email.
Cosmic Production d.o.o.
Split, Croatia
info@cosmicproduction.hr
cosmicproduction.hr