Privacy Policy
1. Who is responsible
The controller of your personal data is Mist Art, Proizvodni obrt, vl. Aleksandar Perc, ValdebeÄki put 60, 52100 Pula, Croatia, OIB 33452130643 ("we", "us"). For anything about your data, write to redakcija@remedia.social.
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: name, e-mail, profile picture (from Google or Facebook sign-in), languages, roles, plan, bio, notification settings | To run your account | Contract |
| Content you create: articles, comments, statuses, research folders, notes, boards, monitored pages, persons, imported Facebook posts | To provide the tools | Contract |
| Your own AI key (BYOK), stored encrypted | To use your key when you ask | Contract |
| Text you send to AI tools | To produce the summary, draft or translation | Contract |
| Usage: AI calls (feature, model, tokens, cost), daily counters, credits, allocations, subscription status | Usage limits, plans, cost control | Contract; legitimate interest |
| Technical data: IP address, browser, request logs, rate-limit counters | Security and abuse prevention | Legitimate interest |
| Push notifications: device address and keys | To send notifications you turned on | Consent |
| Newsletter: e-mail and sign-up time | To send the newsletter | Consent |
| Messages to us: contact form, objections, correction requests, reports | To answer and handle them | Legal obligation; legitimate interest |
| Payment: Paddle tells us your name, e-mail, country, plan and payment status. We never see card details | To manage your subscription | Contract |
| Statistics cookies (Google Analytics) | To understand how the site is used | Consent |
Your name becomes public with your first post. Until you publish your first comment, status or article, other users cannot see you: you do not appear in search, cannot be followed and have no profile page. With your first public post your name and profile picture become public and your profile page can be found and followed. We never show your e-mail to other users. Follows, dislikes and reports show other people only as counts, never who did it. Members of the same team organisation see each other's name and picture.
Public data about people in public roles. Our research tools show data from official public sources, such as public procurement, the court register and lists of officials. We process it for journalistic purposes and in the public interest, and show each value with its source.
Facebook pages of organisations. If an organisation connects its Facebook page, we process posts and comments on that page (commenter name, profile link, text) so the organisation can follow and moderate them. We do this on the organisation's behalf.
3. The browser extension
- Stored in your browser: settings, counters, excluded and tracked sites, tips and your sign-in token. This stays on your device.
- Sent without an account: the list of tracked news sites is refreshed daily. When you open an article on a tracked news site, the extension sends its address (without the part after "?") to check for Remedia content. It also sends reports you submit. This is not linked to you. We count use per site anonymously, including a Google Analytics event that contains only the site's domain.
- Sent when you are signed in: the tools you use (dislike, reply drafts, context summaries, evidence, comment reports, monitored pages, usage limits) are linked to your account.
- The extension asks for access to all websites so it can show labels on news sites. It sends page content from other sites only when you use a tool on that page.
4. Who receives data
| Recipient | What | Where |
|---|---|---|
| Vercel | Hosting, request data, screenshots of monitored pages | EU |
| Neo4j | Main database | EU |
| Redis | Cache, counters, newsletter list | EU |
| Amazon Web Services (S3) | Database backups, evidence screenshots | EU |
| Neon | History of monitored pages | EU |
| Anthropic | Text sent to AI tools | USA |
| Voyage AI | Titles and article text for similarity search | USA |
| Recraft | Image descriptions, no personal data | USA |
| Mailgun | E-mail address and message content | EU |
| Sign-in; statistics, only with your consent | USA | |
| Meta (Facebook) | Sign-in; posts and comments on connected pages | USA |
| Browser push services | Device address and notification content | Depends on your browser |
| Browserless | Address of a page we need to render, no personal data | EU |
| GitHub | Runs our backups | USA |
| Paddle | Payments. Paddle is our reseller and decides itself how it uses payment data (see its own privacy notice) | UK/EU |
We also share data with authorities when the law requires it, and with our accountant or lawyer when needed.
Transfers outside the EU. Where a provider processes data outside the European Economic Area, we rely on the EUâUS Data Privacy Framework if the provider is certified, or on the European Commission's Standard Contractual Clauses.
5. How long we keep data
| Data | How long |
|---|---|
| Account and content | Until you delete them or your account |
| AI call log | 12 months, then only monthly totals without your account |
| Daily usage counters | 12 months, then only monthly totals without your account |
| Usage limit counters | Up to 40 days |
| Records of where you posted a context summary | 30 days |
| Article version history, unsaved drafts | 30 days, 14 days |
| Monitored pages, their history and screenshots | Until you delete the monitor or your account |
| Comments from a connected Facebook page that our tools flagged for review (text, commenter name, profile link, link to the post) | Until the organisation disconnects the page or is deleted; either deletes them. We do not keep the page's posts, or comments that were not flagged |
| Newsletter | Until you unsubscribe |
| Messages, objections, correction requests | 2 years after they are handled |
| Database backups | Up to 12 months |
| Payment records | Kept by Paddle, and by us as tax law requires |
6. Deleting your account
You can delete your account in your profile, under privacy and data. Deletion removes your account, sign-ins, content, research, monitored pages with their history and screenshots, push devices, notifications, usage records and your newsletter entry. Reports you filed about content stay, but without your name. Backups are kept for up to 12 months; we do not use them except to restore the service, and if we restore one, we delete your account again.
7. Cookies and local storage
- Necessary: sign-in session (30 days), security cookies, your language choices, your cookie choice.
- Interface: small notes in your browser, such as whether you have seen a guide.
- Statistics: Google Analytics cookies, only if you allow statistics. You can change this at any time in the cookie settings.
8. Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Write to redakcija@remedia.social; we answer within one month. You can also complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr).
9. Security
We use encrypted connections, store AI keys encrypted, limit access to the data to the editor-in-chief, and keep backups in a separate storage.
10. Children
Remedia is not meant for children. You must be at least 16 to create an account.
11. Changes
We tell signed-in users about significant changes by e-mail or in the app before they apply.
In case of differences between language versions, the Croatian version prevails.
Last updated: 5 November 2026.