Consaya ("Consaya", "we", "us") respects your privacy. This policy explains what personal data we collect, why, the legal basis for it, and how we protect it. It applies to consaya.com and the Consaya application at app.consaya.com. Consaya is a brand wholly owned and operated by Thanaaya Technologies (thanaaya.com), a software company established in 2021 and licensed by the Department of Economy and Tourism, Government of Dubai, UAE under professional licence 964356 (federal unified licence BL1484), VAT registration number 104056148000003 and corporate tax registration number 104056148000001, of Office 304, Westburry Tower 1, Business Bay, Dubai, which acts as the data controller.
We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations. Where you are our customer, you are the controller of the business data you enter and Consaya acts as your processor, handling that data only on your instructions to provide the service.
Account details you provide (name, email, phone, company, TRN), enquiry and newsletter submissions, and the business data you enter into the product (clients, invoices, expenses, ledgers). We also collect basic technical logs (IP, device, timestamps) to keep the service secure and reliable.
We rely on: performance of our contract with you (to run the service and bill it); your consent (for the newsletter, withdrawable anytime); and our legitimate interests and legal obligations (security, fraud prevention, UAE tax and accounting record-keeping).
To provide and improve the service, respond to enquiries, send the newsletter you asked for, issue invoices, and meet UAE legal and tax obligations. We do not sell your personal data and we do not use your business data to train third-party AI models.
We share data only with the sub-processors needed to run the service — our email provider (Brevo) for transactional and newsletter email, our payment gateways (CCAvenue, Stripe) for billing, Complyance Electronics L.L.C for UAE e-invoicing transmission where you use that feature, and our hosting on secured servers in the UAE/EU. Each is bound to protect your data.
If you use Consaya to send UAE e-invoices, the invoice is transmitted through Complyance Electronics L.L.C, an e-invoicing service provider listed by the UAE Ministry of Finance and appointed by us for that purpose. Only what the invoice itself must contain is sent: the seller and buyer details, tax registration numbers, line items, tax amounts and the document identifiers required by the PINT AE standard. It is sent when you or your team ask for it, never automatically, and every attempt — including what the provider or the Federal Tax Authority said back — is recorded in your workspace and visible to you. Nothing else in your account is shared with them.
Consaya can send your proposals, invoices and reminders from your own company address instead of ours. There are two ways to allow it, both optional and both reversible by you. You may publish DNS records that authorise our mail server to sign messages as your domain — this gives us no access to your mailbox at all. Or you may connect a Microsoft 365 or Google mailbox, in which case we request send-only permission (Microsoft Graph Mail.Send, Google gmail.send). We do not request, and cannot obtain, permission to read, search, download or delete your mail; replies to your clients come back to a Consaya address that we control, not by reading your inbox. Access tokens are stored encrypted, are used only to send the messages you or your team trigger in the product, and you can revoke them at any time from your Microsoft or Google account or by disconnecting in Settings.
Consaya's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used solely to provide the sending feature described above. It is not sold, not used for advertising, not used to train any AI model, and not transferred to third parties except as needed to deliver the message you asked us to send or where required by law. No human at Consaya reads it except with your explicit consent for support, or for security or legal reasons.
Where data is processed outside the UAE, we only use providers that offer an adequate level of protection or appropriate safeguards, as required by the PDPL.
We keep account and transactional records for as long as your account is active and thereafter for the period required by UAE tax and commercial law (generally at least 5–7 years for accounting records), then delete or anonymise them.
Under the PDPL you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, request portability, and withdraw consent. Unsubscribe anytime via the link in each email or by emailing [email protected]. We respond within the periods set by law.
Questions or requests about this policy or your data? Email [email protected] or write to Thanaaya Technologies, Office 304, Westburry Tower 1, Business Bay, Dubai, UAE. You may also contact the controller directly at [email protected].