Privacy policy

General

Alya Books takes the protection of personal data seriously and processes it in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), its executive regulations, and, where applicable to a user, the data protection laws of the free zone in which the user is established or other applicable laws such as the GDPR.

1 · Controller

Alya Nexus Auditing, [[licence number]], [[registered address]], Dubai, United Arab Emirates ("Alya Books", "we"). Data protection contact: [[dpo@alyabooks.ai]].

For personal data of the User's customers, suppliers and contacts that the User enters into the Platform, the User is the controller and Alya Books is the processor under the Data Processing Agreement.

2 · Data collection on the website

2.1 Server logs

When you visit alyabooks.ai, our hosting provider stores the IP address, date and time, requested page, referrer, browser and operating system in server logs for security and troubleshooting. Legal basis: our legitimate interest in a secure website. Retention: [[30]] days.

2.2 Cookies and local storage

The website uses only technically necessary cookies and local storage (session, language, cookie preference). We do not use advertising cookies. [[If analytics are added: name the tool, purpose, legal basis, opt-out.]]

2.3 Contact, demo and trial forms

When you send a request through the website we store your name, email address, company, phone number (if given), topic, message and the page it was sent from, to answer your request. Legal basis: steps prior to a contract at your request. Retention: [[12]] months after the last contact, unless a contract follows.

2.4 Registration and account

When you register we process your email address, name, password (hashed), preferred language, position, organization data (legal name, legal form, licence details, TRN, address, Peppol ID, bank details) and your role. Legal basis: performance of the contract. Retention: for the term of the contract and thereafter as required by law.

2.5 Use of the application

The application processes the documents you create and receive (invoices, contacts, items, payments, bank transactions), audit logs (who did what and when), API request logs, webhook deliveries and email delivery logs. This data is needed to provide the service and to meet record-keeping obligations. Personal data in documents is processed on your behalf under the DPA.

2.6 Emails

Transactional emails (verification, invitations, invoice delivery on your behalf, notifications) are sent through our email provider [[Resend]] or, if you configure it, your own SMTP server. We do not send newsletters without your consent.

3 · Disclosure of data

We disclose data only where necessary to provide the service and at your instruction:

• to the Accredited Service Provider (Taxilla) and, through it, the FTA and the recipient's service provider, for documents you submit;
• to buyers and suppliers you send documents to;
• to connected third-party services you enable (accounting systems, payment gateways, bank data providers, AI extraction for uploaded documents);
• to our sub-processors (hosting, database, email, PDF rendering) listed in the DPA;
• to authorities where required by law.

Data is hosted in [[hosting region, e.g. the UAE / EU]] as set out in the DPA. Where data is transferred outside the UAE, we rely on the safeguards permitted by the PDPL.

4 · Your rights

Under the PDPL you have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent where processing is based on consent. You can exercise most of these in the application (profile, organization settings, data export, account deletion) or by writing to [[dpo@alyabooks.ai]]. You may lodge a complaint with the UAE Data Office or the competent authority.

5 · Data security

Data is encrypted in transit (TLS) and at rest, separated per organization through row-level security, backed up daily and accessible only to authorised personnel under confidentiality obligations. Details are in the SLA and the technical and organisational measures annexed to the DPA.

6 · Currency and amendment of this policy

This policy is current as of 24 September 2026. We amend it when the service or the law changes and publish the current version here.

7 · Complaints and queries

For any question about this policy write to [[dpo@alyabooks.ai]] or support@alyabooks.ai.