Privacy

CityBest keeps two kinds of data: about visitors and about service providers.

• Visitors: no account is needed to use the site. We count page views and clicks on the phone, WhatsApp and map buttons per page, without storing who clicked. Reviews you submit are stored with the name, rating and text you enter.
• Providers: when you sign in with Google we store the email address, name and user id of that Google account. When you sign in with an email address we store that address and send a one-time code to it. The business details you enter (business name, owner, phone, address, tax id, opening hours, prices, photos, description) are stored and shown publicly on your page. Feedback you send from your account is stored with your email and browser type.
• Price lists: what you enter in CityBest Cjenik (business name, tax id (OIB) and address, services, prices, look) is stored with your account and email and published at the price list's address, in the widget and in the CSV and XML files. Your email is never published. The widget on your website sets no cookies and does not track visitors: it loads the price list from our server, so our hosting keeps only the standard request log.
• Payments: card details go directly to Stripe. We store only the subscription and invoice records (name, email, amount, date).
• Server logs: our hosting provider keeps standard request logs (IP address, browser, time) for security and error diagnosis.

CityBest sets only two strictly necessary cookies, and only once you sign in: cb_session and cb_sso keep you signed in across CityBest's addresses (citybest.hr and cjenik.citybest.hr) for up to 14 days. Signing out ends the session. Your browser also keeps a few settings locally: your cookie choice, a draft of the page or price list you are creating, and the sign-in session.

Google Analytics and Google Ads cookies are set only after you accept them in the cookie banner. Without consent they measure in cookieless mode. Stripe sets its own cookies during checkout, and Google sets cookies when Google sign-in, Google Maps or reCAPTCHA load.

Change cookie settings

We use these providers, each under its own data processing terms:

• Google (Firebase sign-in and database, Analytics, Ads, Maps, reCAPTCHA)
• Stripe (payments and invoices)
• Vercel (hosting and privacy-friendly, cookieless analytics)
• Cloudflare (photo storage and content delivery)
• Resend (transactional email)
• OpenStreetMap Nominatim and CARTO (turning business addresses into map pins and serving map tiles)

Provider accounts and pages are kept until you ask us to delete them. Invoices are kept as long as accounting law requires. Reviews stay with the page they were written for. Price lists and their previous versions are kept until you delete them. A previous version stays public for 30 days after it was replaced. Analytics data follows Google's retention settings.

Under the GDPR you can request access to, correction of, or deletion of your data. Write to info@citybest.hr and we will respond within 30 days.

If you believe your rights have not been respected, you can contact AZOP (Croatian Data Protection Authority).