Privacy Policy

Nellmi is an app for going out with your crew. The data controller is Mosbac, a sole proprietor, Bulevar despota Stefana 2, 21000 Novi Sad, Serbia.

For anything about your data, write to privacy@nellmi.com.

• Account: your email, the name you choose, your username and, if you want, your gender (only used for your avatar color).
• Social: friends, crews, chats, messages, photos you send, invites and your answers to them.
• Nights out: nights, places, drinks and food, rides, costs, rounds and titles.
• Location: used on your phone only while the app is open and only with your permission, to know your city and suggest the place you're at. We don't store your location history.
• Error reports: when the app crashes we receive a technical report without your name, email or IP address.
• Notifications: a device token, so we can send you invites and messages. You can turn notifications off in your phone settings.

• Waitlist: your email, and your city if you give it, so we can tell you when Nellmi launches.
• Partner form: the details you enter, so we can reply to you.
• We don't use analytics cookies or tracking pixels on this website.

• To run the app and your account (performance of a contract).
• Location, notifications and the waitlist (your consent, which you can withdraw at any time).
• To keep Nellmi safe, fix errors and prevent abuse (our legitimate interest).
• To meet legal obligations, for example accounting.

• Only you see your spending and calories.
• Chat messages and photos are visible only to members of that chat.
• Nobody can add you to a night without your confirmation.

We use trusted service providers who process data only on our instructions:

• Supabase: database and file storage for the app and the website forms (servers in the EU)
• Sentry: error reports (servers in the EU)
• Resend: sign-in emails
• Expo: app delivery and push notifications
• Cloudflare: website hosting, security and email forwarding

Some providers may process data outside the EU or Serbia; when they do, they are bound by standard contractual clauses or an equivalent safeguard.

We don't sell your data and we don't use it for advertising.

When you open a link for tickets, rides or places to stay, you leave Nellmi for the partner's site (for example a ticket seller or a booking site), where their own privacy rules apply. For some purchases we earn a commission; your price doesn't change. We don't share your account data with partners.

• App data: while you have an account. When you delete your account, we delete your profile, messages, photos and spending. Shared nights and crews stay for the other members, without your personal data.
• Waitlist: until launch, plus one email, then deleted. Or earlier, if you ask.
• Partner form: as long as we're in conversation, and no longer than 2 years after the last contact.
• Error reports: up to 90 days.
• Backups are overwritten within 30 days.

Under the GDPR, the UK GDPR and the Serbian Law on Personal Data Protection, you can access, correct, export and delete your data, object to or restrict how we use it, and withdraw your consent at any time.

Delete your account yourself in the app (Profile → Delete account) or see the Delete your account page. For anything else, write to privacy@nellmi.com. We reply within 30 days.

You can also complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or the authority in your country.

Nellmi is only for people 18 and older. If we learn that someone under 18 has an account, we delete it.

Your data is encrypted in transit, access is limited to what each part of the system needs, and keys are kept on our servers, never in the app.

If we make important changes, we'll tell you in the app before they apply. The date at the top shows the latest version.