Privacy Policy

DSA Solutions is operated by Constantinos Costa, trading as “Kiyara Products”, of 39 Leoforos Pervolion, 7550 Kiti, Larnaca, Cyprus (“we”, “us”). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for account and billing information, and a data processor for the business data (customers, invoices, etc.) you store in the Service on behalf of your organization. Contact us at support@dsasolutions.io about anything in this policy.

• Account data: your name, email address, and password (stored securely and hashed by our authentication provider — we never see your raw password).
• Business data you enter: customers, suppliers, products, invoices, quotes, purchase orders, bills, payments, planner jobs, and similar records you or your team create while using the Service.
• Technical data: basic server logs (IP address, timestamps, error logs) generated automatically by our hosting provider for security and reliability. We don't currently use analytics or advertising trackers.

• To provide, maintain, and secure the Service.
• To send you emails you've asked for or that relate to your use of the Service — e.g. team invitations, password resets, invoice emails you choose to send, and (if you switch it on) overdue-invoice reminders to your customers.
• To respond to support requests you send us.
• To comply with legal obligations.

We do not sell your data or your customers' data to anyone, ever.

We use a small number of service providers to run DSA Solutions:

• Supabase — hosts our database, authentication, and file storage.
• Vercel — hosts the application itself.
• Resend — delivers transactional emails (invites, password resets, invoice emails, reminders).
• Stripe — takes subscription payments, and card payments from your customers when you switch that on. Stripe receives the billing details needed to take the payment.
• Anthropic — reads the photos you upload of bills, receipts, till reports and product shelves so the app can fill in the details for you. Anything visible in a photo you upload is sent to them to be read. They do not use it to train their models.
• BudgetSMS — sends appointment reminder texts, where you have turned those on. They receive the mobile number and the wording of the reminder.

These providers process data on our behalf under their own data processing agreements and don't use your data for their own purposes. We don't share your data with anyone else unless required by law.

Your data is stored with our hosting providers' infrastructure, which may be located outside Cyprus/the EEA. Where that's the case, our providers maintain appropriate safeguards (such as standard contractual clauses) for international data transfers.

We keep your account and business data for as long as your account is active. If you delete your account, your personal account data and (if you're the owner) your organization's business data are permanently deleted, immediately, as described below. We do not keep a copy of your invoices, bills, ledger or other accounting records after that.

Cyprus law requires you, the business, to keep your books, records and supporting documents for 6 to 7 years after the year they relate to (Assessment and Collection of Taxes Law 4/1978 art. 30(2); Companies Law Cap. 113 s.141(3); VAT Law 95(I)/2000 Tenth Schedule para 5; Protection of Wages Law 35(I)/2007 art. 12(2)). Because deleting an organization destroys those records on our side, the owner must download the full accounting export before the deletion is allowed, and should keep it for 7 years.

The one thing we keep after an organization is deleted is the export receipt: the organization's name and id, the owner's e-mail and user id, the date the export was produced, what it contained (the list of files, their size and the record counts) and its SHA-256 checksum, and when the organization was deleted on the strength of it. It contains no accounting data. We keep it indefinitely, as evidence that the export was handed over, and it is readable only by us.

As a data subject under GDPR, you have the right to:

• Access your data — you can export a full copy of your organization's data at any time from Settings.
• Rectify inaccurate data — edit it directly in the app, or contact us.
• Erase your data — delete your account from Settings, which permanently removes it.
• Object to or restrict processing, or request data portability — contact us and we'll action your request.
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection.

To exercise any of these rights, use the tools in Settings or email support@dsasolutions.io.

From Settings, any team member can download a complete export of your organization's data (customers, products, invoices, and all other records) as a JSON file, at any time, without needing to contact us.

The owner can also download the full accounting export: one zip file with every invoice, credit note, payment received, bill, supplier credit, supplier payment and expense as CSV, the journal (entries and lines), the trial balance, the VAT return figures for every quarter, and the invoice, credit note and bill PDFs the app renders, with a cover note in English and Greek. This is the export the law's retention duty is met with, and the one that must be downloaded before the organization can be deleted.

From Settings, you can permanently delete your account at any time.

• If you're the organization's owner, this permanently deletes your entire organization's data — every customer, invoice, product, and record — and removes access for anyone you've invited. This cannot be undone. Before you can delete, Settings shows you the retention duty described in section 6, in English and Greek, and requires you to download the full accounting export in the same session; the deletion is refused without an export from the last 24 hours. Keep that export for 7 years. Payroll records and uploaded scans are not in the export; print or download them first if you need them.
• If you're a team member (not the owner), this deletes your personal account and access only. Your organization's business data is unaffected.

We use a single essential cookie to keep you signed in. We don't use advertising, tracking, or analytics cookies.

We rely on industry-standard security practices from our infrastructure providers, including encryption in transit, row-level access control so organizations can never see each other's data, and role-based permissions within your own organization.

The Service is intended for business use by adults and is not directed at children.

We may update this policy from time to time. We'll update the “Last updated” date above when we do. See our Terms of Service for the terms governing your use of the Service.

Questions, requests, or complaints about this policy? Email support@dsasolutions.io.