1. Controller and roles
The sole proprietor identified above is the controller for account-owner, website, support, and Daliya business-operation data. For customer and employee data uploaded or received by a business through connected channels, the business is generally the controller and Daliya processes the data on its instructions.
2. Data categories
- Account and business data: name, work email, company name, roles, settings, and sign-in history.
- Operational data: services, schedules, appointments, staff, attendance, training, checklists, orders, feedback, and related reports.
- Communication data: messages, attachments, and technical metadata from connected Meta and Telegram channels.
- Files and media: knowledge-base documents, verification photos, and other business uploads.
- Billing and technical data: subscription status, transaction records from the billing provider, IP address, device, security logs, and diagnostics.
3. Purposes and legal bases
We process data to provide and secure the Service, authenticate users, operate selected modules and integrations, provide support and billing, prevent abuse, comply with law, and improve reliability. Legal bases include contract performance, legitimate interests in safe service operation, legal obligations, and consent where required. When processing on a business's instructions, that business determines the applicable basis.
4. Providers and disclosures
We do not sell personal data. We disclose necessary data to service providers to operate Daliya and may disclose it when legally required, to protect rights and safety, or in a corporate transaction with appropriate safeguards. Key provider categories include Google Cloud and Firebase for authentication, database, storage, and infrastructure; Gemini for business-selected AI processing; Vercel for application hosting and delivery; Meta and Telegram for business-connected messaging; and Lemon Squeezy for payments, tax records, and subscriptions, where it may act as an independent controller for its payment duties.
5. International processing
Providers may process data in Serbia, the European Economic Area, the United States, and other countries whose protections may differ. Where required, we use contractual and organizational safeguards available under applicable law and rely on the providers' published transfer mechanisms.
6. Retention
We retain data only while needed for an active account, selected features, support, and legitimate business purposes. After service ends, data is deleted or de-identified following an applicable request and backup cycle, except records required for tax and accounting duties, fraud prevention, security, dispute resolution, or legal compliance.
7. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, object to processing, or withdraw consent. If a Daliya business customer controls the data, we may refer the request to that business. You may also complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection or your local supervisory authority.
8. Security
We use reasonable technical and organizational measures, including authentication, business- and role-scoped access, encryption in transit, protected integration storage, security logging, and backups. No internet service can guarantee absolute security.
9. Minors
Daliya is a business service and is not offered directly to children. We do not knowingly create accounts for people under 18. Businesses must follow applicable rules when their own services process minors' data.
10. Requests and changes
To ask a question or exercise a right, email privacy@daliya.pro. The deletion procedure is published on the Data Deletion page. Material policy changes will be posted here with a new effective date.