Privacy and data protection

Who is responsible

The company below decides what is collected and why, and is the one to write to about any of it.

DSO računarsko programiranje DIVERD, Rainci Gornji bb, 75260, Kalesija · privacy@diverd.dev

What we hold

Only what the service needs to work. There is no tracking, no advertising and no profiling.

• Your account: email address, name, interface language, and a password stored only as a hash. If you switch on a second factor, the key your authenticator app scanned; if you create an API key, a hash of it, never the key itself.
• Your company details and logo, because they are printed on the documents you issue.
• The documents you create and the clients you address them to. This is your data; we do not read it and do not use it for anything else.
• Files you attach to an invoice — a timesheet, a delivery note. We store them, we do not open them, and they are never published on the link you send your client.
• The people at your clients you ask us to copy: their name, address and role, as you entered them.
• Your subscription payments: the amount, the currency, the date and which plan they bought. No card details — see below.
• A record of significant changes on your account — who changed the bank details, who issued or voided a document, who was added to the team — with the time and the connection it came from.
• Ordinary server logs, kept briefly to keep the service running and secure.

Cardholder data

We never receive your card number, expiry date, CVV or PIN, so there is nothing of the kind for us to store, retain or lose.

Card details are entered on a page hosted by Raiffeisen BANK dd Bosna i Hercegovina and are handled by the bank alone, under the card schemes' own security rules. Our application is not part of that exchange.

What comes back to us is the outcome and nothing else: whether the payment succeeded, the amount, the currency, the date and a reference we can quote to the bank if you ever query it.

We also do not currently hold the credentials of your own card-processing contract. That option is not offered at the moment; if it is ever switched on, this notice will say what is stored before anybody can enter anything.

How this works in detail is set out in Payment security.

Why

Every piece of data above is held for one of three reasons:

• To provide the service you signed up for — an account cannot exist without an address to sign in with.
• To meet accounting and tax obligations, which set their own minimum retention periods.
• To keep the service running and secure — logs that let us find a fault or stop an attack.

How long

Nothing is kept longer than it has to be:

• Account data: for as long as the account exists. Delete the account and it goes with it.
• Documents and clients: until you delete them, or until you delete the account.
• Payment records: kept for as long as accounting and tax law requires, even after an account is closed. They are the record of a transaction and cannot simply be erased.
• The record of account activity: two years, then deleted automatically. Sign-in links for the client portal are deleted thirty days after they are used or expire.
• What we sent to a system you connected: ninety days, then deleted. The connection itself stays until you remove it.

Who else sees it

Your data is shared with three kinds of service provider, each doing one job on our behalf:

• Raiffeisen BANK dd Bosna i Hercegovina, which processes card payments and is the only party that ever handles your card details.
• Our hosting provider, which runs the servers the application and its database sit on.
• Our email provider, which delivers the messages the service sends — reminders to your clients, and notices to you.

We do not sell your data, rent it, or hand it to anyone for advertising. We disclose it otherwise only where the law obliges us to.

Systems you connect yourself

You can give another system a key to read and write your billing, or ask us to notify one when something happens — an invoice issued, a payment recorded. Both are off until you set them up.

Where you do, we send that system what you asked for: the document, its amounts, its lines, and the name of the client it is addressed to.

You choose the system and you point us at it, so what happens to the data once it arrives is between you and whoever runs it. We are not choosing the recipient, and we do not send anything to a system you have not connected.

Cookies

The site sets only the cookies it needs to function: one that keeps you signed in, one that remembers your language, and one that remembers your answer to the cookie notice itself. There are no advertising or analytics cookies, which is why nothing is set before you choose.

Your rights

You can ask us to do any of the following, and we answer within 30 days:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Delete your account and its data, subject to the retention periods above.
• Give you a copy of your documents and clients — the app exports both to CSV without asking us.

Write to us at privacy@diverd.dev