1. Provider and application of these terms

The “Program” service is provided by Maksim Malbaša (the “Provider”). Contact: [email protected].

These terms govern the use of Program by legal entities, entrepreneurs and other persons in the course of professional activities (the “Customer”), including their authorized team members. Anyone accepting an offer or these terms on the Customer’s behalf confirms that they have the necessary authority. The service is intended for business use; this designation does not exclude mandatory rights that must apply in a particular case.

These terms apply together with the accepted offer or order. A separate written agreement takes precedence for matters it expressly regulates differently, subject to mandatory law. Personal data processing is governed by the Privacy Policy and the relevant processing agreement; accepting these terms is not blanket consent to all data processing.

2. Scope of the service and features

Program provides a workspace for running a real estate agency. Within the published plan and available permissions, it includes:

• Portfolio: entering and editing properties, categories, owners, prices and statuses, advanced search, filters and an archive;
• CRM: records of buyers and tenants, their requirements and budgets, suggestions for matching properties, activities, viewings and follow-ups;
• Sales, rentals and payments: managing contract details, payment obligations, deposits, commissions, payments, outstanding balances, reversals and refunds in supported currencies;
• Reports: portfolio, business and team activity overviews, with CSV, Excel or PDF export in supported views;
• EOP: records of brokerage agreements and completed transactions, change history and individual or annual PDF overviews;
• AML / SPN: dossiers, documents, risk assessments, PEP and sanctions checks, internal alerts, worklists, approvals, decision records and data retention procedures, within the scope of section 6;
• Photos and documents: organizing photos, floor plans and attachments, supported originals and document versions, and technical image processing;
• Team: user roles and individual permissions, messages and notifications, with access to multiple workspaces only when separately granted;
• Branding and connections: domain, logo, SMTP account and a public API for selected listings, plus a Serbian or English interface and light or dark theme;
• Client applications: a Windows x64 application and an optional Android 8+ app for approving sign-ins.

Some features require Customer data, appropriate permissions, configuration or an approved policy and source. An option appearing in the interface does not mean these steps have already been completed. Statutory forms and text entered by the Customer may retain their original language. Demonstration images and data illustrate usage and do not promise a business outcome.

Program supports business recordkeeping; it does not provide brokerage, legal or tax advice, accounting or banking services. Recording a payment, reversal or refund in the finance module does not transfer money or change a transaction at a bank or Paddle. The Customer checks contracts, calculations, currencies, dates and statements before using them for business purposes.

Special integrations, additional website development, migrations and agreed capacities or service levels apply when specified in the accepted offer. Publishing a new feature alone does not introduce an additional charge or restriction on the agreed plan.

3. Subscription, test environment and payments

The website’s current checkout runs in the Paddle sandbox environment. A test transaction does not charge a real payment method and does not itself establish a paid production subscription. Access to test workspace setup does not change this status. Use fictional data in the demonstration environment; it is not intended to hold the only copy of business or statutory records.

The published offer is EUR 50 per month. When live billing is activated, the plan, final price, currency, taxes and billing period displayed before order confirmation will apply. Switching the website to production billing does not convert an earlier test transaction into a paid order.

Paddle is the merchant of record and handles subscription billing, invoices and applicable taxes. A paid subscription renews according to the accepted order until cancelled. The transaction is also subject to Paddle’s Buyer Terms.

You can cancel renewal through the Paddle portal linked in your purchase confirmation or through Paddle Support; Program Support can help with the request. Cancellation normally takes effect at the end of the current paid period. Refund requests and rights arising from non-delivery or technical defects are handled under Paddle’s Refund Policy, the accepted order and mandatory law. Cancelling renewal and refunding a previous payment are separate procedures.

Price changes apply to future periods, with prior notice and an opportunity for the Customer to cancel renewal before the new price takes effect; where consent is required, the price will not change without it. Failed payments may lead to access restrictions under the procedure in section 12.

The domain, internet connection and SMTP service supplied by the Customer are subject to the Customer’s arrangements with those suppliers. Any additional Program services and their prices are agreed in advance.

4. Setup, accounts and devices

The Customer supplies accurate agency details and an access email address, a domain with the ability to change DNS records, a logo and a working SMTP account. Deployment depends on confirmation of the transaction in the appropriate environment, domain verification, complete information and successful application builds. A browser confirmation or starting setup alone does not confirm that the workspace is ready. Status and available downloads appear during setup.

The Customer designates team members, their roles and a specifically authorized AML officer, controls assigned access and revokes it when no longer needed. Access to another agency or demo workspace requires separate authorization and does not arise automatically from a subscription. Accounts are personal and should not be shared.

The Customer protects their devices, passkeys, one-time links and codes, SMTP account and DNS access. Suspected unauthorized access must be reported without delay. An administrator role in the application does not grant the right to administer the Provider’s infrastructure.

The main client is intended for a supported Windows x64 environment. The Android 8+ app approves sign-ins and does not replace the full CRM. The Android APK is installed manually; the current Windows installer is not digitally signed. The Customer downloads applications through the official download process and checks the published requirements and instructions.

Operation requires an internet connection and functioning connected services. The Customer installs supported updates when necessary for security or compatibility; the Provider should clearly explain any changed requirements and necessary steps.

5. Data, confidentiality and processing roles

The Customer retains rights to content they enter: properties, contacts, contracts, financial and EOP records, AML dossiers, documents, photos, messages, logos and other business data. They grant the Provider a limited right to store, transmit and technically process this content to provide, protect, maintain and support the service and comply with legal obligations. This does not transfer ownership or grant the right to sell business data or use it for the Provider’s own advertising.

The Customer ensures an appropriate legal basis, notices and rights for entering, publishing and processing content, including photo rights and special conditions for identification and AML data. They collect only necessary data, verify accuracy and do not enter unnecessary confidential or specially protected data.

For personal data entered into the workspace, the agency is generally the controller and the Provider is the processor. Processing on the agency’s behalf must be governed, before production processing begins, by a processing agreement or another appropriate binding instrument covering instructions, security, subprocessors, assistance with rights and the return or deletion of data. Publishing these terms and the Privacy Policy alone does not confirm that such a contractual arrangement is already in place.

The parties use each other’s confidential information only to the extent necessary for the agreed purpose and restrict access to authorized persons and suppliers with appropriate confidentiality obligations. Legal requests for data are handled according to jurisdiction and the necessary scope; the other party is notified where permitted.

Hosting of the application server and MongoDB database with Hetzner in Finland, other suppliers, international transfers and individuals’ rights are described in more detail in the Privacy Policy. Special requirements concerning data location, processing or protection must be agreed before using the service for such processing.

6. AML / SPN, EOP and agency decisions

AML / SPN features support identification and dossiers, PEP and sanctions checks, risk assessment, event monitoring, cash indicators, questionnaires, worklists, documents, approvals and action records. Their scope depends on available and approved sources, rules, configuration and entered data.

The agency appoints authorized persons, checks the source and date of lists or forms, approves appropriate policies and documents its actions. A possible match does not confirm identity, PEP status or unlawful conduct; the absence of a match does not confirm the absence of risk. Lists may be incomplete, unavailable or outdated, and checks may produce incorrect or missed results.

Program may create a task or restrict the next step until a required check or decision is recorded. An authorized person verifies the facts and follows the prescribed procedure. A software assessment, a “completed” status or a generated document does not itself confirm legal compliance or fulfilment of all the agency’s obligations.

EOP records, AML forms and exports support data preparation and retention. The agency verifies the current official form, obtains signatures, submits reports and questionnaires to the authorities, meets deadlines and retains acknowledgement of receipt through the appropriate official procedure. Program does not submit these reports automatically.

Retention periods, holds and deletion approvals are determined according to the specific case and applicable obligations. The Customer must not use status changes or technical deletion features to remove documentation that must be preserved. The Provider remains responsible for its own contractual and legal obligations in processing and protecting that data.

7. Public listings, API and connected services

By enabling publication of a property, the Customer determines that selected listing details and public photos will be available through the public API. The API excludes designated internal fields such as owner details, contracts, CRM contacts, AML dossiers and internal notes. The Customer must nevertheless check free text, photos and other published information to avoid inadvertently revealing personal or confidential information.

The Customer or their contractor is responsible for connecting the API to their own website, its appearance, their own data processing and updating the displayed content. The public API is not a promise of a ready-made integration with every listing portal. Disabling a listing in Program does not automatically remove copies and cached displays on other websites; their operator must refresh or remove them as appropriate.

API use must respect its documented purpose and technical limits. Bypassing access controls and disrupting the system are prohibited. Internal credentials and tokens must not be published in website code, public repositories or other public locations.

The availability of SMTP, address suggestions, public sources and other connected services also depends on their suppliers. Their terms apply to the relationship with that supplier; they do not remove the Provider’s obligations under the agreed service.

8. Optional AI features

When available and configured, AI features offer listing description editing and suggested photo ordering. A signed-in user initiates them through their own action. Selected text, property facts or photos are sent to the external supplier identified in the Privacy Policy.

The output is a suggestion that may be inaccurate, incomplete or inappropriate. The Customer checks facts, content rights and the final presentation before saving or publishing. An AI suggestion does not confirm a property’s legal or actual condition.

AI requests must not include unnecessary personal data, identification documents, access secrets or confidential AML content. If the intended processing includes personal data, the agency must first establish the legal basis, necessity, supplier relationship and necessary transfer and processing safeguards. Activating the feature does not replace that assessment.

9. Licence and permitted use

For the duration of their right to use the service, the Customer receives a limited, non-exclusive licence to Program and its client applications for their own agreed business use and authorized team. Software and documentation remain the property of the Provider or the relevant rights holders; rights under third-party component licences remain in force.

The Customer will not:

• use Program contrary to law, third-party rights or professional obligations;
• introduce malicious code, disrupt the service, bypass permissions or attempt to access another party’s workspace;
• resell or rent out Program without authorization, copy it or create derivative works, subject to exceptions permitted by mandatory law or the applicable licence;
• publish misleading or unlawful listings, enter content without the necessary rights or use the service for unsolicited messages;
• abuse demo workspaces, automation, downloads or the public API in a way that endangers other users or system operation.

Security issues should be reported to Support with the minimum necessary information. This does not authorize testing other people’s accounts or production data without specific permission. Reasonable and proportionate restrictions for specific misuse are governed by section 12.

10. Security measures and backups

The Provider applies the measures and procedures described in section 8 of the Privacy Policy. That description distinguishes confirmed encryption of new AML evidence, selected audit content and dedicated backup archives from other data and infrastructure. These terms do not extend that scope to every AML field, all disks, every copy or every administrator access.

Mandatory MFA at all levels, automatic key rotation, backup schedules, storage on separate infrastructure and guaranteed recovery are not considered agreed or confirmed merely because some related features exist. Specific requirements and verification methods must be documented in an accepted agreement. This does not reduce mandatory safeguards or the Provider’s legal responsibility.

The Customer retains necessary originals and downloads supported exports for their business obligations, with appropriate protection of those copies. A view export may not include all attachments, audit history or data needed for full system restoration. The backup plan, its scope, retention periods and recovery checks are determined for each installation; the existence of a tool alone does not confirm that a plan is active.

Incident reporting, risk assessment, notification of the agency and competent authorities, and verified recovery are performed according to the Provider’s role, the law and the Privacy Policy procedure. Users are not required to publish confidential evidence or credentials to receive support.

11. Availability, updates and support

The Provider aims to deliver a reliable service but does not guarantee uninterrupted, error-free operation. Maintenance, supplier outages, internet and DNS problems may affect availability. Planned maintenance and required Customer actions are announced when reasonably possible; urgent security intervention may require earlier restrictions.

Features may evolve for security, compatibility and service improvements. A material reduction of agreed paid functionality requires prior notice where possible and a reasonable solution consistent with the order and the Customer’s rights. A version change does not extinguish rights that have already arisen.

Support is available at [email protected]. Include the feature, time and a description of the problem without unnecessary personal data. Guaranteed response times, availability, special support scope or recovery times exist only if expressly set out in a written service-level agreement (SLA).

12. Ending access, exports and data retention

The Provider may proportionately restrict a feature or access due to non-payment, a serious security threat or a material breach of these terms. Where circumstances permit, the Customer receives the reason, notice and a reasonable period to resolve the problem. Urgent data protection needs or a legal obligation may require action before notice. Availability of a technical feature after expiry does not extend the agreed licence.

Before access ends, the Customer should download available exports and request any additional data or attachments in good time. The Provider will enable an authorized representative to obtain a reasonably available export or return of data in a common electronic format, subject to authorization checks, protection of others and the appropriate procedure under the processing agreement. Special migrations or format adaptations are agreed in advance and do not reduce statutory data rights.

Ending a subscription does not trigger automatic immediate deletion of AML, EOP, contractual or other statutory records. Returning and deleting data processed for the agency follows its documented instructions, the processing agreement and legal obligations. A hold or mandatory retention period may restrict deletion; a technical hold alone does not justify indefinite retention.

Periods, criteria, existing backups and obligations for data the Provider processes as controller are described in the Privacy Policy. Copies held by the Customer or their independent suppliers remain under their control. Obligations that naturally survive termination, including confidentiality and protection of lawfully retained data, remain in force.

13. Warranties and liability

Program is provided with the features in the accepted offer. The Provider does not guarantee a sale, rental, specific financial result or fulfilment of agency obligations merely through using Program. The Customer checks their data, calculations, sources and suggestions before deciding or publishing. This does not exclude the Provider’s responsibility for defects in the agreed service or its own obligations.

Each party is responsible for direct damage caused by breaching its obligations. To the fullest extent permitted by mandatory law, neither party is liable for lost profits, indirect or consequential damage that could not reasonably have been foreseen. The Provider’s total contractual liability is limited to the fees paid for Program in the 12 months preceding the event giving rise to the claim.

These limitations do not apply to intent, gross negligence, breaches of confidentiality or data protection, infringement of intellectual property rights or liability that cannot legally be excluded or limited.

14. Versions and final provisions

Version 2.0 was published on 7 September 2026 and is used for new contracts that accept it. For existing contracts, material changes require prior notice describing the change and its effective date, in accordance with previously accepted terms and mandatory law. Publication of a new version alone does not confirm that notice has been sent and does not change rights that have already arisen.

The Customer can cancel future renewal before a material change takes effect. Where express consent is required, continued use does not replace it. Separate written agreements and previously undertaken obligations are handled under their own rules. Previous versions are available in the legal document archive.

If a provision is invalid, the remaining provisions stay in force. Failure to exercise a right immediately does not waive that right.

These terms are governed by the law of the Republic of Serbia, without prejudice to mandatory rules that must apply. The parties will first attempt to resolve a dispute by agreement and then before the court with subject-matter and territorial jurisdiction in the Republic of Serbia.