Privacy

This notice explains how Duevia handles your information.

Last updated: 15 September 2026

Who controls your data

Duevia is a product operated under the Aegean Astraea brand from Cyprus. For personal data covered by this notice where Duevia determines why and how the data is processed, Aegean Astraea is the data controller.

Location: Nicosia, Cyprus.

Privacy questions or requests: support@dueviaapp.com.

What we store

The documents you upload, standalone due-date / obligation records you create, the details you confirm about them (such as title, dates, issuer and reference number where relevant), the people and assets you link them to, and the account details of the users you invite.

Why we store it

To show the records in your workspace, calculate due or expiry status, and send reminders before a confirmed date. We do not sell your data or use your documents or workspace records for advertising.

Legal bases for processing

We process personal data only where we have a lawful basis to do so. Depending on the processing involved, we may rely on:

performance of a contract with you, or steps requested by you before entering into a contract, including providing your account, workspace, reminders and paid Duevia services;
compliance with legal obligations that apply to us;
our legitimate interests in operating, securing, supporting and improving Duevia, provided those interests are not overridden by your rights and interests; and
your consent where we ask for it and consent is the appropriate legal basis.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Automatic document reading

AI reading is never automatic. It happens only when you explicitly choose “Extract details with AI” for a document. When you do, the document content is sent through the Lovable AI Gateway to Google Gemini so Duevia can suggest the details it needs — title, issuer, reference number, issue date and expiry date. The purpose is operational document extraction only. Duevia does not use your document or the extracted information for advertising, profiling or automated decisions about you. Suggested values are only saved to your workspace after you review and confirm them. Please avoid including personal information that is not necessary for the business purpose. We may use service providers and subprocessors to support document processing, hosting, storage, email delivery and related infrastructure. Where these providers process personal data on our behalf, they do so subject to applicable contractual and data-protection safeguards.

Who can see your workspace records

Only the users you invite to your workspace, limited by the role you give them: Owner, Admin, Member or Viewer. Files remain private, and changes to tracked records are recorded in the activity log.

How long we keep it

Active records are kept for as long as your workspace is active. When you delete a document, it is removed from your active library. If an Owner schedules deletion of the workspace, a 7-day grace period applies during which the request can be cancelled. After that period the workspace enters a controlled deletion process. Limited copies may remain temporarily in backups or with our service providers in accordance with their retention practices, legal obligations and security requirements. Other records may be retained for as long as reasonably necessary to operate and secure the service, maintain required records, resolve disputes or meet applicable legal obligations.

Your rights and choices

In the app you can view and correct the details of your documents and your profile, delete individual documents, and download the files you uploaded where a file is available. CSV export of your records is available on eligible plans. An Owner can schedule deletion of the workspace, which starts a 7-day grace period during which the request can be cancelled. You may also contact Duevia to request access to or a copy of your data, correction where applicable, and account or workspace deletion where applicable.

Security

Files are held in private storage and are transferred over encrypted connections, and access requires a signed-in account. You can sign in with an email and password or with Google. Duevia’s primary cloud infrastructure is hosted in Europe (Ireland). We also use service providers to support the operation of the service, and appropriate contractual and technical safeguards are used where personal data is processed on our behalf.

Payments and Paddle

Paid Duevia subscriptions are sold and processed by Paddle, our Merchant of Record. When you purchase or manage a subscription, Paddle processes payment, billing, tax, fraud-prevention and transaction information under its own privacy terms.

For personal data shared between Paddle and Duevia in connection with purchases and subscriptions, Paddle and Duevia may each act as independent data controllers for the purposes for which each determines how and why that data is processed.

Duevia may receive and use customer, subscription and transaction information from Paddle where necessary to activate and manage your plan, provide customer support, maintain appropriate records and comply with applicable legal obligations.

For more information about how Paddle processes personal data, please see Paddle’s Privacy Notice.

Service providers and international transfers

Duevia uses third-party service providers and subprocessors to provide hosting, storage, document processing, email delivery and other supporting services. Some processing may involve transfers of personal data outside the country or region where you are located. Where required, such transfers are protected by appropriate safeguards, which may include Standard Contractual Clauses or other mechanisms permitted by applicable data-protection law.

Contact

For privacy questions or requests relating to your personal data, contact:

Aegean Astraea (Duevia)

Nicosia, Cyprus

support@dueviaapp.com

You may also use the Duevia Contact page. We aim to respond promptly and within any timeframe required by applicable law.