Privacy Policy

This privacy policy explains what information ParasalHesap collects, how it is used, where it is stored and who it is shared with. It applies to the web application at app.parasalhesap.com, the ParasalHesap desktop application and the ParasalHesap point-of-sale device apps (together, "the service").

1. Who we are

The service is provided by ParasalHesap, based in the Turkish Republic of Northern Cyprus (KKTC). You can contact us about this policy or about your data at [email protected].

2. Two kinds of data

Businesses that use ParasalHesap ("customers") enter information about their own customers, suppliers, staff and operations. Each customer decides what it stores in the service, and we process that information on the customer's behalf, to run the service for it.

For the account information of the people who log in to the service, we are responsible for how that information is handled.

3. What we collect

• Account data: name, email address, password (stored only as a one-way hash), PIN (stored only as a hash), language and appearance preferences and, if two-factor login is turned on, the two-factor secret, which is stored encrypted.
• Account requests: the name, phone number and message you send with the "Request an account" form on our homepage, and the IP address it came from. We use them only to contact you about an account and to keep the form free of abuse, and we delete them when they are no longer needed.
• Business data entered by customers: contact details of customers and suppliers; sales, payments, cheques, installment plans, expenses, stock, quotes, work orders and restaurant orders; and notes.
• Files: company logos, which we store on our servers. Files attached to work orders are stored in the cloud storage account your company connects (see section 6); we do not keep a copy.
• Password vault: entries a customer saves in the password vault are encrypted with a master password that we never store. We cannot read vault contents.
• Technical data: IP address, browser or device information (user agent), and which pages were used and when (security access logs); an audit log recording who created, changed or deleted records; and the identifiers of registered POS and desktop devices.
• Cookies: only cookies that are strictly necessary or that remember your preferences: the session cookie, a CSRF protection cookie, and cookies for language, appearance and sidebar state. We do not use analytics, advertising or tracking cookies.

4. How we use data

We use the information above to provide the service, keep it secure, keep backups, provide support and meet legal obligations.

We do not sell personal data, show advertising or build marketing profiles.

5. Where data is stored and who we share it with

• Our servers are located in data centers in the European Union.
• Database backups are stored with Cloudflare R2.
• Files attached to work orders are stored in your company's own connected cloud storage, not on our servers.
• Our web pages load fonts from fonts.bunny.net, which receives your IP address when the fonts are loaded.
• Google receives data only when a customer connects Google Drive (see section 6).

We do not share personal data with anyone else, unless we are required to by law.

6. Google user data

This section describes how ParasalHesap handles the data it receives from Google when a customer connects Google Drive.

What we access

When a company admin connects Google Drive, ParasalHesap asks Google for:

• The account's email address (the openid and email permissions), which we keep to show which Google account is connected. We do not ask for your name, profile picture or any other profile information.
• The drive.file permission: this lets ParasalHesap create files and manage only the files it created itself. ParasalHesap cannot see, open or list any other file in your Google Drive.

How we use it

• To save each file uploaded to ParasalHesap into a folder named "ParasalHesap - (company name)" in the connected Google Drive.
• To open those files for your company's users when they view or download them in ParasalHesap.
• To move a file to Google Drive's trash when it is deleted in ParasalHesap.

We do not use Google user data for any other purpose.

How we store it

The access and refresh tokens that Google issues are stored encrypted in our database. We also store the connected account's email address and the identifiers of the files we create, so that we can open them again. File contents pass through our servers only while they are uploaded or downloaded; we do not keep them.

Sharing

Google user data is not shared with anyone, not sold, not used for advertising, and not used to develop, improve or train artificial intelligence or machine learning models.

Retention and deletion

• Disconnecting a Google Drive account in Settings → Integrations deletes its stored tokens immediately and asks Google to revoke ParasalHesap's access.
• You can also revoke ParasalHesap's access at any time from your Google Account at https://myaccount.google.com/permissions.
• Files stay in your Google Drive and remain under your control. They cannot be opened through ParasalHesap until the same account is connected again.

Limited Use

ParasalHesap's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. How long data is kept

• Account and business data is kept while the customer uses the service, and may be deleted after the service ends.
• Audit and access logs are kept for the retention period each customer sets in its settings or, if none is set, for as long as the customer's account exists.
• Copies of the database in backups may be kept for up to two years before they are deleted.

8. Security

We use reasonable technical measures to protect data, including HTTPS encryption in transit, hashed passwords and PINs, encrypted tokens and secrets, optional two-factor login, separation between customers' data, and role-based permissions.

No system is completely secure, and we cannot guarantee the security of your data.

9. Your requests

You can ask to see, correct, export or delete your personal data by writing to [email protected].

If your data was entered by a business you deal with (for example, a shop that keeps you as a customer), please contact that business first, because it decides what it stores. Requests we receive about such data are passed on to that business.

10. Children

The service is intended for businesses and is not directed at anyone under 18.

11. Changes to this policy

We may update this policy. Material changes are announced in the app, and the date at the top of this page shows when the policy was last updated.

12. Contact

ParasalHesap, KKTC · [email protected]