Privacy Policy

1. Controller and processor

Setra ("we", "us") is a software company registered in Cyprus. We operate the Setra financial intelligence platform (the "Service"). In relation to the personal data of your employees, suppliers, and other individuals whose data you upload, you are the data controller and we act as your data processor, processing that data on your instructions to provide the Service. In relation to your own account data (name, email, billing), we are the data controller.

2. What data we store

To provide the Service, we store the following categories of data:

• Account data — your name, email address, and role.
• Business data — business name, address, VAT number, industry type, and financial figures you enter.
• Invoices and receipts — supplier invoices, expense documents, and receipt images you upload, including extracted line items and VAT details.
• Payroll data — employee contracts, roles, and shift/hours records you enter for payroll tracking.
• Bank transactions — bank transaction records you import or sync for reconciliation.
• Sales data — daily sales figures and, where connected, point-of-sale transaction data.
• Billing data — payment method details (processed by Stripe; we store only the last four digits and card brand).

3. Why we process it

We process your data to provide the Service — including financial reporting, invoice processing, inventory and recipe costing, VAT period management, payroll tracking, and audit-ready document generation. We also process account and billing data to manage your subscription and comply with our legal obligations (including tax invoicing for our own revenue).

4. Legal basis

We process your data on the following legal bases under the GDPR and Cyprus Law 125(I)/2018: (a) performance of a contract — providing the Service you subscribed to; (b) compliance with a legal obligation — tax invoicing and records retention; and (c) your consent — for optional features such as AI-powered invoice extraction. You may withdraw consent for optional processing at any time without losing core Service access.

5. Sub-processors

We use the following sub-processors, each bound by a data processing agreement:

• Base44 — application hosting, database storage, and authentication infrastructure.
• Stripe — subscription billing and payment processing.
• AI invoice-extraction provider — optical character recognition and structured data extraction from uploaded invoices and receipts.

Your data is stored on infrastructure provided by Base44 within the European Union where possible. We will notify you in advance of any new sub-processor or material change to data location.

6. Retention

We retain your business data for as long as your account is active. After account closure, we delete your business data within 90 days, except where a longer retention is required by law (e.g. tax records). Billing records are retained for the period required by Cyprus tax law. Invoices you upload are retained for the same period as your active subscription plus 90 days post-closure.

7. Your rights (GDPR)

Under the GDPR and Cyprus Law 125(I)/2018, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your personal data ("right to be forgotten").
• Restrict or object to processing.
• Data portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with the Cyprus Data Protection Commissioner (www.dataprotection.gov.cy).

You may export your business data in CSV format at any time from within the Service. To exercise any other right, contact us at the address below.

8. Security

We protect your data with encryption in transit (TLS) and at rest, role-based access controls, and authenticated access to the hosting infrastructure provided by Base44. Access to your business data is restricted to you and the team members you invite. We do not share your business data with third parties except as described in this policy or as required by law.

9. International transfers

Where any sub-processor processes data outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission. We do not transfer your data to jurisdictions without adequate protection.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or within the Service. Continued use after the effective date constitutes acceptance of the updated policy.

11. Contact

For any question about this Privacy Policy or to exercise your data protection rights, contact us at chris@setra.cy.