Privacy policy

Last updated 2 October 2026

This policy explains what personal data Cekira collects, why, who receives it, and what you can do about it.

Who we are

Cekira is run by MASA SOLUTIONS LLC, a US company. We are responsible (“controller”) for account, billing, support and security data. Contact us at support@cekira.com.

Data a business stores in Cekira about its clients, contacts or team belongs to that business, and we process it on its behalf under our data processing agreement. If your question concerns someone else's workspace, contact that business.

What we collect

• Account: your name, email address, a password hash if you use a password, and your Google identity and profile picture if you sign in with Google.
• Workspace: your business details (including tax numbers, bank accounts and logo), clients and contacts, invoices, work records, comments, team members and notes.
• Files: invoices you import, kept unchanged as the original record; your logo; PDFs we generate.
• Billing: your plan, its status and dates, and payment references. Stripe collects your card details; we never see the full card number.
• Connected tools: encrypted credentials and task details if you connect Linear; Gmail details as described below.
• Support and technical records: messages you send us, and your IP address, browser and errors, for security and troubleshooting.

Your account details are needed to create an account; everything else only for the features you use. Cekira is a business tool and is not intended for anyone under 18.

Why we use it

• To provide Cekira and manage your subscription, because our agreement with you requires it.
• To keep Cekira secure and fix problems, which is our legitimate interest.
• To send account and service emails. We ask for consent before sending marketing where the law requires it.
• To meet legal obligations, such as keeping billing records.

We do not sell personal data or use it for advertising.

Who receives it

Support emails are handled by our email provider. Workspace members see what their role allows. A company lookup sends the registration number you enter to the public business register. We disclose data to authorities only where the law requires it.

AI invoice imports

When you import an invoice with AI extraction, its contents are sent through OpenRouter to an AI model provider, such as OpenAI or Google, which returns suggested fields for you to check. We do not use your documents to train AI models, and Cekira makes no automated decisions about you with legal or similar effects.

Google sign-in and Gmail

Sign-in. Google sign-in shares your name, email address and profile picture so we can create and identify your account, and we store the sign-in tokens Google issues to manage that sign-in. Your name and picture may be visible to your workspace. Signing in does not give us access to your Gmail, Drive or Calendar.

Gmail sending (optional). Connecting Gmail asks only for permission to send email (gmail.send); it cannot read your inbox, contacts or existing messages. We store your connected address, encrypted access tokens, the permissions granted and connection dates. You review every email before it is sent. The message and invoice PDF go to Google for delivery, and we keep the recipients, time, outcome and Google's message reference, but not the email body.

Disconnecting. Disconnect Gmail in Settings → Integrations, which deletes its credentials and asks Google to revoke access, or remove Cekira in your Google Account connections. Email support@cekira.com to delete Google profile data we hold.

Limits on Google data. We use Google API data only for the features above. We do not sell it, or use it for advertising, credit decisions or lending. People see it only with your permission, for security investigations or where the law requires. We transfer it only to provide these features, for security or as the law requires. Cekira does not use Google API data, including data obtained through Google Workspace APIs or derived from it, to develop, improve or train non-personalized AI or machine-learning models, and does not transfer it to third parties for those purposes. Our use follows the Google API Services User Data Policy, including its Limited Use requirements. Before using Google data for a new purpose, we will ask for your consent.

Where data is processed

We are a US company run from Serbia. Your workspace is stored in Germany, and some providers above are in the United States, so your data may be handled outside your country. We protect these transfers with the safeguards the law requires, such as the EU standard contractual clauses in our data processing agreement.

Cookies and browser storage

We use only the cookies and browser storage needed to run Cekira. We use no analytics or advertising cookies and do not track you across websites, so we do not respond differently to Do Not Track signals. Stripe's checkout page uses its own cookies, and invoice print views load fonts from Google Fonts, which receives your IP address.

“Delete saved drafts” in Invoice Maker removes remembered drafts; signing out does not. Clearing your browser's site data removes everything, and signs you out.

How long we keep it

We keep your data while your account is open. Ending a subscription does not delete it; your records stay available to read and export. You can delete records in the app, or email us to delete your account. Deleted data leaves our backups as they expire; for example, we keep the seven most recent database backups, and deleted files can be recovered for seven days. Technical logs are rotated regularly. We keep billing and support records where the law requires, and Stripe keeps its own payment records. You remain responsible for keeping invoices as long as your own laws require.

Your rights

Wherever you live, you can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent you have given. Email support@cekira.com. We may need to confirm your identity, and we reply within one month. You can also complain to a data protection authority, such as your EU authority, the UK's ICO or Serbia's Poverenik.

Security

Cekira uses HTTPS, hashed passwords, permission checks on every request and encrypted connection credentials, and Microsoft encrypts stored files. Staff can view a customer's workspace only in a read-only support session that ends after 30 minutes, requires a recorded reason and is logged. We notify people and authorities about data incidents where the law requires. More on our security page.

Changes

When this policy changes, we update the date above, and we tell you about important changes by email or in the app.