Privacy policy

This policy explains what data Historiku processes, why, who it is shared with and what your rights are under Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo.

1. Who we are

Historiku is a LaserPickle product. The provider and data controller for staff accounts and the marketing site is Naim Reçica B.I. (trade name: POS Kosova), Rr. Enver Gjerqeku nr. 9, Prishtinë, Republic of Kosovo. Business number: [NUI].

For any question, request or support, write to info@historiku.com.

2. Roles: who is the controller

• POS Kosova is the controller for staff account data (name, email, password hash, sessions) and for the marketing site.
• The garage is the controller of the customer and vehicle data it enters into Historiku (names, phones, emails, plates, VINs, service history). POS Kosova processes this data on the garage's behalf as processor, under the data processing agreement.
• Customer history links (/v, /e) show only the data the garage chose to share. Visitors of these pages are not tracked.

3. What data we process and why

• Staff account: name, email, password hash, role, language and sessions — to identify you and give you access to the service.
• Garage data: garage name and settings — to provide the service.
• Customer and vehicle data (on behalf of the garage): customer name and phone, plates, VIN, mileage, services, reminders, estimates and stock — to keep the service history.
• Transactional email: login links, invitations, password resets and account notices.
• Audit log: important actions (for example an ownership change or a deletion) for security and traceability.

We do not use your data for advertising and we do not sell it.

4. Who we share it with (sub-processors)

Provider	Purpose	Location
Hetzner Online GmbH	Server (application and database)	Nuremberg, Germany (EU)
Cloudflare, Inc.	DNS, proxy/TLS, email routing, backup storage (R2)	US company; storage location to be confirmed in the legal review
Brevo (Sendinblue SAS)	Transactional email (login links, invitations, resets)	France (EU)

Data is not shared with anyone else, except where the law requires it.

5. How long we keep it

• Data is kept while the garage's account is active.
• After cancellation or expiry the garage stays in read-only mode and can export its data. Data is kept for a retention period; deletion happens on request or once that period has passed, with 30 days' notice to the owners. After a garage is marked for deletion, its data is permanently removed after 30 days.
• Backups allow recovery within 30 days; after that they are gone.

The exact length of the retention period will be confirmed after the legal review of this draft.

6. Your rights

You have the right to request access, correction and deletion, and to object to the processing of your data. For your own account data, write to info@historiku.com. If you are a customer of a garage, direct your request to that garage; it is the controller and can anonymise the customer in Historiku. You also have the right to complain to the competent personal data protection authority in Kosovo.

7. Cookies

We use only three necessary cookies: the session cookie, the cookie that binds a login-link request to your browser, and the language cookie. We use no analytics, tracking or advertising.

8. Security

Connections are encrypted with TLS; passwords are stored only as hashes; tokens are stored only as hashes; each garage's data is strictly separated from the others; important actions are recorded in the audit log. No system is perfectly secure, but we treat data protection with care.

9. Changes

We may update this policy. We will announce important changes in the app or by email. The latest version is always on this page.

10. Law and language

The laws of the Republic of Kosovo apply. If the language versions differ, the Albanian version prevails.