Privacy Policy
In short: we use your data to run DecaBooks for you and nothing else. We never sell it. The accounting data in your workspaces belongs to you and your clients; we process it only on your instructions. Our database is in the EU. Some providers are in the United States, under EU-approved safeguards. Our AI provider does not train on your documents.
1. Who we are
- Renipa LTD, a company registered in the Republic of Cyprus
- Registration number HE 458467
- Registered office: Nikodimou Mylona 3, 3095 Limassol, Cyprus
- Email hello@decabooks.com
For privacy questions or to use your rights, write to hello@decabooks.com.
2. Our two roles
We handle personal data in two different roles, and this matters for your rights:
- We are the controller of data about our own customers and website visitors: your account, your billing, your messages to us, and how you use our website and app. This policy explains that processing.
- We are a processor for the accounting data you put into your workspaces, such as invoices, bills, bank statements, customers, suppliers and employees. For that data, the business that owns the workspace (or the accounting firm acting for it) is the controller, and our Data Processing Agreement applies. If you are, for example, an employee or customer of one of our users, please contact that business first.
3. What we collect
- Account details: name, email address, password (stored only as a one-way hash), the workspaces you belong to and your role in each.
- Company and billing details: company name, address, VAT and registration numbers, and your subscription. Card details are collected and held by Stripe, our payment provider. We never see the full card number.
- Messages: what you send through our demo form, by email or in support conversations.
- Usage and technical data: IP address, browser and device type, pages and features used, errors, and security logs.
- Session recordings: see section 6.
- Workspace data: the accounting data you upload or enter. We process this for you as a processor.
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, providing DecaBooks | Performing our contract with you |
| Billing, invoicing and collecting payment | Performing our contract; legal obligation (tax and accounting records) |
| Answering demo requests and questions | Steps taken at your request before a contract; legitimate interests |
| Keeping the service secure, preventing fraud and misuse | Legitimate interests; legal obligation |
| Finding and fixing faults from error reports | Legitimate interests in a working, reliable service |
| Session recordings | Your consent, which you can withdraw at any time in Settings |
| Telling you about changes to the service, these terms or prices | Performing our contract; legitimate interests |
| Sending product news by email | Your consent, or legitimate interests for existing customers. You can opt out at any time. |
| Meeting legal and regulatory obligations, and defending legal claims | Legal obligation; legitimate interests |
5. AI processing
When you use AI features, the document or question is sent to Google’s Gemini API to be read or answered. We use Google’s paid service, under which Google does not use your data to train its models. The text and figures it returns are stored in your workspace.
AI suggestions are proposals for you to review. They do not make decisions about individuals that have legal or similarly significant effects.
6. Session recordings
To find and fix faults quickly, and only if you allow it, we record how you use the DecaBooks app. A recording shows the screens you see and the actions you take. Recordings can therefore include what is on screen, such as client names, amounts and documents.
The app asks you the first time you use it. Nothing is recorded until you choose “Allow recording”, and you can switch it off at any time in Settings, under Profile. Error reports, which contain no recording of your screen, are sent either way so we can keep the service working.
- Recordings are made by Sentry and stored in the European Union (Frankfurt, Germany).
- Only our technical staff can view them, and only to investigate faults, support requests or security issues.
- They are deleted automatically within 90 days.
- We do not use them for advertising or to profile anyone.
Recordings are made in the app at app.decabooks.com only, not on the public website.
8. Transfers outside the European Union
Our main database is in the European Union (Frankfurt, Germany). Some providers process data in the United States, as shown above. For these transfers we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information at hello@decabooks.com.
9. How long we keep data
- Account data: while your account is open, and for up to six years after it closes, to meet legal obligations and deal with any claims.
- Billing and invoice records: for at least six years, as Cyprus tax law requires.
- Workspace data: until you delete it or close the workspace. A closed workspace can be restored for 30 days. After that we delete its data from our systems within a further 60 days, unless you ask us to keep it or the law requires us to. Copies in backups are overwritten in their normal cycle.
- Demo requests and enquiries: for up to two years after our last contact.
- Session recordings: up to 90 days.
- Security and technical logs: usually up to 90 days, longer if needed to investigate an incident.
10. How we protect data
Data is encrypted in transit and at rest. Passwords are stored only as one-way hashes. Each workspace is kept separate, and access is controlled by role. Posted accounting entries are protected by a tamper-evident hash chain. Staff access is limited to what is needed to provide, support and secure the service. See the security measures in our Data Processing Agreement.
11. Your rights
Under the General Data Protection Regulation and Cyprus Law 125(I)/2018 you have the right to:
- see the personal data we hold about you and get a copy;
- have it corrected if it is wrong;
- have it deleted, or its use restricted, in certain cases;
- object to our use of it based on legitimate interests, and to direct marketing at any time;
- receive it in a portable format;
- withdraw consent where we rely on consent.
Write to hello@decabooks.com. We will reply within one month. We may need to confirm who you are first.
You can also complain to the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (dataprotection.gov.cy, commissioner@dataprotection.gov.cy). We would appreciate the chance to resolve your concern first.
13. Children
DecaBooks is a business service and is not meant for children. We do not knowingly collect data about children as our users. Workspace data may include information about employees’ families where a user enters it for payroll; that data is handled for the user under our Data Processing Agreement.
14. Changes to this policy
We may update this policy. If the changes are important, we will tell our customers by email before they apply. The date at the top shows when it last changed.