Privacy Policy

DSA Solutions is operated by Constantinos Costa, trading as “Kiyara Products”, of 39 Leoforos Pervolion, 7550 Kiti, Larnaca, Cyprus (“we”, “us”). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for account and billing information, and a data processor for the business data (customers, invoices, etc.) you store in the Service on behalf of your organization. Contact us at support@dsasolutions.io about anything in this policy.

• Account data: your name, email address, and password (stored securely and hashed by our authentication provider — we never see your raw password).
• Business data you enter: customers, suppliers, products, invoices, quotes, purchase orders, bills, payments, planner jobs, and similar records you or your team create while using the Service.
• Technical data: basic server logs (IP address, timestamps, error logs) generated automatically by our hosting provider for security and reliability. We don't currently use analytics or advertising trackers.

• To provide, maintain, and secure the Service.
• To send you emails you've asked for or that relate to your use of the Service — e.g. team invitations, password resets, invoice emails you choose to send, and (if you switch it on) overdue-invoice reminders to your customers.
• To respond to support requests you send us.
• To comply with legal obligations.

We do not sell your data or your customers' data to anyone, ever.

We use a small number of service providers to run DSA Solutions:

• Supabase — hosts our database, authentication, and file storage.
• Vercel — hosts the application itself.
• Resend — delivers transactional emails (invites, password resets, invoice emails, reminders).
• Stripe — takes subscription payments, and card payments from your customers when you switch that on. Stripe receives the billing details needed to take the payment.
• Anthropic — reads the photos you upload of bills, receipts, till reports and product shelves so the app can fill in the details for you. Anything visible in a photo you upload is sent to them to be read. They do not use it to train their models.
• BudgetSMS — sends appointment reminder texts, where you have turned those on. They receive the mobile number and the wording of the reminder.

These providers process data on our behalf under their own data processing agreements and don't use your data for their own purposes. We don't share your data with anyone else unless required by law.

Your data is stored with our hosting providers' infrastructure, which may be located outside Cyprus/the EEA. Where that's the case, our providers maintain appropriate safeguards (such as standard contractual clauses) for international data transfers.

We keep your account and business data for as long as your account is active. If you're the owner and delete the business, its business data is permanently deleted, immediately, as described below. We do not keep a copy of your invoices, bills, ledger or other accounting records after that, apart from our hosting provider's daily backups described below, which are overwritten within 7 days. If you're a team member and leave the business, your access to it is removed and the business's data stays, including the records you created. Whether you delete a business or leave one, your login stays if you still belong to another business, and you keep your access to that business. If you don't, your login is deleted too, unless a record in a business still refers to it, such as one you created or changed: then the login is kept, you are signed out, and you can ask support@dsasolutions.io to remove it.

When the owner deletes the business, every file it uploaded (receipts, scanned bills, photos, documents), whoever uploaded it, is deleted from our storage at the same time and is not held in any backup. A team member who leaves does not take their uploads with them: the uploads belong to the business and stay with it. Copies of your database records in our hosting provider's daily backups are overwritten within 7 days and are never restored to the Service. Photos on a published public page may remain in search-engine caches after deletion.

If your business has recorded sales through the till, we keep those sales as the record of your receipts and the business cannot be deleted from Settings. You can download all your records, cancel your subscription to stop paying, and ask support@dsasolutions.io to erase your personal data.

Cyprus law requires you, the business, to keep your books, records and supporting documents for 6 to 7 years after the year they relate to (Assessment and Collection of Taxes Law 4/1978 art. 30(2); Companies Law Cap. 113 s.141(3); VAT Law 95(I)/2000 Tenth Schedule para 5; Protection of Wages Law 35(I)/2007 art. 12(2)). Because deleting an organization destroys those records on our side, the owner must download the full accounting export before the deletion is allowed, and should keep it for 7 years.

Apart from the backup copies described above and what Stripe keeps (next paragraph), the one thing we keep after an organization is deleted is the export receipt: the organization's name and id, the owner's e-mail and user id, the date the export was produced, what it contained (the list of files, their size and the record counts) and its SHA-256 checksum, and when the organization was deleted on the strength of it. It contains no accounting data. We keep it indefinitely, as evidence that the export was handed over, and it is readable only by us.

If a Stripe customer record was created for your business (at the first checkout or SMS top-up, even without a payment), Stripe, our payment processor, keeps it after the business is deleted, together with the invoices and payments for what you paid us and any card you saved. The invoices and payments are the record of our own sales, which Cyprus law requires us to keep for 6 to 7 years. The card is not removed when the business is deleted. To have the card removed, ask support@dsasolutions.io.

As a data subject under GDPR, you have the right to:

• Access your data — the owner can export the organization's records at any time from Settings, and any other team member can download the personal data held about them from their Security page while the subscription is active, or from the Subscription page while it is locked (section 8).
• Rectify inaccurate data — edit it directly in the app, or contact us.
• Erase your data — the owner can permanently delete the business from Settings (section 9). Any other team member can leave it from their Security page, or from the Subscription page while the subscription is locked. The records they created and the personal data the business holds about them (section 8) stay with the business; to have that personal data erased, ask the business's owner or contact us.

  If your business has recorded sales through the till, we keep those sales as the record of your receipts and the business cannot be deleted from Settings. You can download all your records, cancel your subscription to stop paying, and ask support@dsasolutions.io to erase your personal data.

• Object to or restrict processing, or request data portability — contact us and we'll action your request.
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection.

To exercise any of these rights, use the tools described above or email support@dsasolutions.io.

From Settings, the owner can download a copy of every record the business keeps in the Service as a file, at any time, without needing to contact us: customers, products, sales and the till, purchases, payroll, bank lines, the asset and loan registers, the journal, the audit trail and the owner's own Personal records. Files the business uploaded (receipts, scanned bills, photos, documents) are not in it.

Any other team member can download, from their Security page under My account, a copy of the personal data the organization holds about them as a file: their membership, sign-in profile, invitations, the changes they made, their working hours and time off, their employee record and payslips, their own Personal records and the feedback they sent.

A team member's download is on their Security page while the business's subscription is active, and on the Subscription page while it is locked. While it is locked, the owner can still download both exports from the Subscription page.

The owner can also download the full accounting export: one zip file with every invoice, credit note, payment received, bill, supplier credit, supplier payment and expense as CSV, the journal (entries and lines), the trial balance, the VAT return figures for every quarter, and the invoice, credit note and bill PDFs the app renders, with a cover note in English and Greek. This is the export the law's retention duty is met with, and the one that must be downloaded before the organization can be deleted.

At any time, the owner can permanently delete the business from Settings, and any other team member can leave it from their Security page (under My account). While the subscription is locked, both are done from the Subscription page.

• If you're the organization's owner, this permanently deletes your entire organization's data — every customer, invoice, product, and record — and removes access for anyone you've invited. This cannot be undone. Before you can delete, Settings requires you to download the full accounting export in the same session; the deletion is refused without an export from the last 24 hours. Keep that export for 7 years. Payroll records and uploaded scans are not in the export; print or download them first if you need them.
• If you're a team member (not the owner), leaving removes your access to that business only. Your organization's business data is unaffected, including the records you created and any files you uploaded.

Whether you delete a business or leave one, your login stays if you still belong to another business, and you keep your access to that business. If you don't, your login is deleted too, unless a record in a business still refers to it, such as one you created or changed: then the login is kept, you are signed out, and you can ask support@dsasolutions.io to remove it.

If your business has recorded sales through the till, we keep those sales as the record of your receipts and the business cannot be deleted from Settings. You can download all your records, cancel your subscription to stop paying, and ask support@dsasolutions.io to erase your personal data.

We use a single essential cookie to keep you signed in. We don't use advertising, tracking, or analytics cookies.

We rely on industry-standard security practices from our infrastructure providers, including encryption in transit, row-level access control so organizations can never see each other's data, and role-based permissions within your own organization.

The Service is intended for business use by adults and is not directed at children.

We may update this policy from time to time. We'll update the “Last updated” date above when we do. See our Terms of Service for the terms governing your use of the Service.

Questions, requests, or complaints about this policy? Email support@dsasolutions.io.