Privacy Policy

1. Who we are

• Renipa LTD, a company registered in the Republic of Cyprus
• Registration number HE 458467
• Registered office: Nikodimou Mylona 3, 3095 Limassol, Cyprus
• Email hello@decabooks.com

For privacy questions or to use your rights, write to hello@decabooks.com.

2. Our two roles

We handle personal data in two different roles, and this matters for your rights:

• We are the controller of data about our own customers and website visitors: your account, your billing, your messages to us, and how you use our website and app. This policy explains that processing.
• We are a processor for the accounting data you put into your workspaces, such as invoices, bills, bank statements, customers, suppliers and employees. For that data, the business that owns the workspace (or the accounting firm acting for it) is the controller, and our Data Processing Agreement applies. If you are, for example, an employee or customer of one of our users, please contact that business first.

3. What we collect

• Account details: name, email address, password (stored only as a one-way hash), the workspaces you belong to and your role in each.
• Company and billing details: company name, address, VAT and registration numbers, and your subscription. Card details are collected and held by Stripe, our payment provider. We never see the full card number.
• Messages: what you send through our demo form, by email or in support conversations.
• Usage and technical data: IP address, browser and device type, pages and features used, errors, and security logs.
• Session recordings: see section 6.
• Workspace data: the accounting data you upload or enter. We process this for you as a processor.

4. Why we use it, and our legal basis

5. AI processing

When you use AI features, the document or question is sent to Google’s Gemini API to be read or answered. We use Google’s paid service, under which Google does not use your data to train its models. The text and figures it returns are stored in your workspace.

AI suggestions are proposals for you to review. They do not make decisions about individuals that have legal or similarly significant effects.

6. Session recordings

To find and fix faults quickly, and only if you allow it, we record how you use the DecaBooks app. A recording shows the screens you see and the actions you take. Recordings can therefore include what is on screen, such as client names, amounts and documents.

The app asks you the first time you use it. Nothing is recorded until you choose “Allow recording”, and you can switch it off at any time in Settings, under Profile. Error reports, which contain no recording of your screen, are sent either way so we can keep the service working.

• Recordings are made by Sentry and stored in the European Union (Frankfurt, Germany).
• Only our technical staff can view them, and only to investigate faults, support requests or security issues.
• They are deleted automatically within 90 days.
• We do not use them for advertising or to profile anyone.

Recordings are made in the app at app.decabooks.com only, not on the public website.

7. Who we share data with

We use trusted providers to run DecaBooks. They may only use data to provide their service to us, under contracts that protect it:

When you check a customer’s or supplier’s EU VAT number, that VAT number is sent to the European Commission’s VIES service. We may also share data where the law requires it, for example with a court or public authority, or as part of a sale or reorganisation of our business.

We do not sell personal data.

8. Transfers outside the European Union

Our main database is in the European Union (Frankfurt, Germany). Some providers process data in the United States, as shown above. For these transfers we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information at hello@decabooks.com.

9. How long we keep data

• Account data: while your account is open, and for up to six years after it closes, to meet legal obligations and deal with any claims.
• Billing and invoice records: for at least six years, as Cyprus tax law requires.
• Workspace data: until you delete it or close the workspace. A closed workspace can be restored for 30 days. After that we delete its data from our systems within a further 60 days, unless you ask us to keep it or the law requires us to. Copies in backups are overwritten in their normal cycle.
• Demo requests and enquiries: for up to two years after our last contact.
• Session recordings: up to 90 days.
• Security and technical logs: usually up to 90 days, longer if needed to investigate an incident.

10. How we protect data

Data is encrypted in transit and at rest. Passwords are stored only as one-way hashes. Each workspace is kept separate, and access is controlled by role. Posted accounting entries are protected by a tamper-evident hash chain. Staff access is limited to what is needed to provide, support and secure the service. See the security measures in our Data Processing Agreement.

11. Your rights

Under the General Data Protection Regulation and Cyprus Law 125(I)/2018 you have the right to:

• see the personal data we hold about you and get a copy;
• have it corrected if it is wrong;
• have it deleted, or its use restricted, in certain cases;
• object to our use of it based on legitimate interests, and to direct marketing at any time;
• receive it in a portable format;
• withdraw consent where we rely on consent.

Write to hello@decabooks.com. We will reply within one month. We may need to confirm who you are first.

You can also complain to the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (dataprotection.gov.cy, commissioner@dataprotection.gov.cy). We would appreciate the chance to resolve your concern first.

12. Cookies

Our website sets no cookies. The app uses only the cookies and browser storage it needs to work and stay secure. See our Cookie Policy.

13. Children

DecaBooks is a business service and is not meant for children. We do not knowingly collect data about children as our users. Workspace data may include information about employees’ families where a user enters it for payroll; that data is handled for the user under our Data Processing Agreement.

14. Changes to this policy

We may update this policy. If the changes are important, we will tell our customers by email before they apply. The date at the top shows when it last changed.