Privacy Policy

Bankability is a software platform and related advisory service that helps small, medium and corporate companies understand their financial readiness, assess customer and supplier risk, and prepare for conversations with banks, investors and business partners.

Bankability is provided by:

In this Privacy Policy, "Bankability", "we", "us" or "our" refers to Miura DOO Beograd as the provider of the Bankability platform and related services.

This Privacy Policy explains how we collect, use, store and protect personal data when you:

• visit our website;
• request a demo or contact us;
• create an account and use the Bankability platform;
• upload internal financial documents (trial balance, buyer or supplier ledgers, general ledger extracts);
• trigger lookups against public registries such as APR and NBS;
• use AI-assisted parsing of uploaded documents;
• engage the CFO Room advisory service;
• interact with us as a client, partner, supplier, investor or service provider.

Depending on the situation, Miura DOO Beograd acts either as a data controller or as a data processor.

For website visitors, demo requests, account holders, billing contacts, commercial communications, investors, suppliers and CFO Room engagements, Miura DOO Beograd generally acts as the data controller.

For data uploaded into the platform by a client company about its own business — including trial balances, buyer and supplier ledgers, and other internal financial files — Miura DOO Beograd generally acts as a data processor. The client company determines the purpose and legal basis of processing; we process the data on its instructions to provide the platform and produce the requested analysis.

Depending on your interaction with us, we may process the following categories of personal data:

• name and surname;
• email address and phone number;
• job title, role and organization;
• company identifiers such as Matični broj (MB) and PIB;
• login, authentication and account information;
• support requests and correspondence;
• uploaded financial documents and their contents;
• names and identifiers of counterparties (buyers, suppliers, partners) included in uploaded files — typically business entities, occasionally sole traders;
• derived analytics outputs such as Bankability Check, Bankability Plus, Partner Bankability and Bankability Score reports;
• billing, subscription and payment-related information;
• technical information such as IP address, browser type, device information, log data and cookies.

We do not intentionally collect more personal data than is necessary for the relevant purpose.

On request from an authenticated user, Bankability retrieves publicly available company information from external registries, including the Serbian Business Registers Agency (APR) and the National Bank of Serbia (NBS). This may include published financial statements (Balance Sheet, Profit and Loss), company identifiers, registration data and other publicly disclosed information.

By triggering such a lookup, the user confirms it has a legitimate interest in retrieving information about the target company. We retain retrieved documents and parsed data on the client's behalf to support its analysis.

Clients may upload internal financial documents such as trial balance, general ledger extracts, top buyer and supplier reports and similar files in PDF, Excel or CSV format. These files may contain references to natural persons (for example sole-trader counterparties or employees) only to the extent the client decides to include them.

The client is responsible for ensuring it has a lawful basis to share such data with us for processing.

Bankability uses AI models (currently Google Gemini, accessed through the Lovable AI Gateway) to extract structured information from uploaded documents and to support specific analytical steps.

Document contents are transmitted to the AI provider strictly for the purpose of parsing and extraction. We instruct providers not to use client content to train their foundation models. Deterministic guardrails validate the AI output against accounting invariants (for example debit/credit balancing and Top-10 reconciliation); outputs that fail these checks are routed to internal review and are not silently published.

Partner Bankability provides risk insight on the client's customers, suppliers and other business partners. The data assessed is normally information about legal entities, but may include limited personal data of legal representatives, sole traders or contact persons.

Such processing is based on the client's legitimate interest in evaluating its business counterparties and is carried out on the client's instructions.

We may process personal data for the following purposes:

• to provide, operate and maintain the Bankability platform;
• to create and manage user accounts and authentication;
• to retrieve and parse public registry filings on behalf of authenticated users;
• to ingest, store and analyse uploaded internal financial documents;
• to compute Bankability Check, Plus, Partner and Score outputs;
• to support CFO Room advisory engagements;
• to communicate with users, respond to support requests and provide service updates;
• to manage client relationships, contracts, billing and subscriptions;
• to improve platform security and detect or prevent misuse;
• to monitor technical performance and resolve errors;
• to comply with legal, tax and accounting obligations;
• to protect our rights, users, clients and platform.

Depending on the context, we process personal data based on:

• performance of a contract with you or your organization;
• steps taken before entering into a contract;
• compliance with legal obligations;
• legitimate interests, including platform security, service improvement, business communication and counterparty risk assessment;
• consent, where required by applicable law;
• instructions from our client, where we act as a data processor.

We may share personal data with trusted service providers only where necessary to operate and secure the platform. Current categories of sub-processors include:

• cloud hosting, database and storage providers (Lovable Cloud / Supabase);
• AI inference providers accessed through the Lovable AI Gateway (currently Google Gemini);
• headless-browsing infrastructure used to retrieve public APR filings on the user's behalf (Steel.dev);
• email and communication providers;
• analytics and monitoring providers;
• payment and billing providers, where paid services are enabled;
• legal, tax, accounting and professional advisors;
• public authorities where required by law.

We do not sell personal data.

Some providers used to deliver the platform — in particular hosting and AI inference — may process data outside Serbia or outside the European Economic Area.

Where required, we use appropriate contractual, technical and organizational safeguards for such transfers.

We keep personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law, contract, accounting rules, dispute protection, security requirements or client instructions.

Uploaded documents, retrieved registry filings and derived analytical outputs are retained for the duration of the client's subscription and a reasonable archival period thereafter. Where we act as a processor, retention periods may also be defined by the relevant client agreement or Data Processing Agreement.

We apply reasonable technical and organizational measures designed to protect personal data, including:

• user authentication and session management;
• role-based access control and row-level security in the database;
• secure hosting and infrastructure;
• access and audit logging;
• encryption in transit and at rest where appropriate;
• deterministic guardrails over AI parsing output;
• internal access restrictions and operational security controls.

No system is completely secure, but we work to protect personal data against unauthorized access, loss, misuse or alteration.

Subject to applicable law, you may have the right to request:

• access to your personal data;
• correction of inaccurate personal data;
• deletion of personal data;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent, where processing is based on consent.

To exercise these rights, contact us at office@miurabank.com.

Where we process your data on behalf of a client company, we may need to forward your request to that client or act based on its instructions.

You may also contact the Serbian Commissioner for Information of Public Importance and Personal Data Protection if you believe your rights have been violated.

Our website and platform may use cookies and similar technologies for functionality, security, login sessions and basic operation.

If we use analytics or marketing cookies, we will request consent where required by applicable law.

Bankability is a business-to-business service and is not intended for use by children. We do not knowingly process personal data of children.

We may update this Privacy Policy from time to time. The updated version will be published on this page with a new effective date.

For questions about this Privacy Policy or personal data processing, contact: