Privacy

Last updated: 30 September 2026

Roundkit is run by one person, Alexandros Constantinou, a sole trader in Nicosia, Cyprus. This page says what Roundkit stores about you, where it goes, how long it stays, and what you can ask me to do about it. Where the system cannot do something yet, this page says so.

Who is responsible

Alexandros Constantinou, operating as Roundkit, Nicosia, Cyprus. Email hello@roundkit.app. My postal address is available on request.

Two different roles

For pool company accounts, I decide what is collected and why, and I am responsible for it.

For the customers a pool company adds to Roundkit (the villas, hotels and people it services and invoices), the pool company decides. I store and process that data on the company's behalf. If you are one of those customers, ask the pool company first. If you write to me instead, I will pass your request on to them.

If you have a Roundkit account

When you sign up I keep your email address, your password and the company name you entered. Supabase, which handles sign-in, stores the password hashed, so I cannot read it, and keeps the company name alongside your login. Supabase also sends the confirmation email.

Each time you sign in, the session is recorded in Roundkit's database in Frankfurt, along with the IP address and the browser you signed in from. Sign-in events — signing in and out, confirming your email address, resetting your password — are recorded too, with the IP address, in a log that is not kept. When I checked that log it was empty, on an account that has had sign-ins and confirmations since early September.

In your company settings you can add the company's name, email address, phone number, postal address, VAT number and bank details. If you trade under your own name, these are personal data about you. They are printed on every invoice and reminder you send, and everyone with access to your company account can see them.

Your company email address is the reply-to address on every invoice and reminder. Each one is also copied to it, unless it is the address the email is going to, so you have what your customer received.

I use all of this to provide the service you signed up for. The legal basis is our contract (Article 6(1)(b)).

Your customers' data, which I hold for you

For each customer, a pool company can store a name, area, address, contact name, email address, phone number, number of pools, monthly fee, billing day, payment method, invoice language and free-text notes.

Roundkit also stores:

• Invoices and their lines: numbers, dates, amounts and VAT, whether and when each was paid, and the reason if one was cancelled.
• Service days and visits: which weekday a property is serviced, the date of each visit, whether it was done or skipped and why, and free-text notes. Notes can hold things like gate codes.

Customers are never deleted inside the app, only marked inactive. Invoices cannot be deleted at all, because a numbered invoice is an accounting record.

What is recorded when an email goes out

Invoices, payment reminders and review requests are sent from invoices@roundkit.app under the pool company's name, through an email service called Resend.

For each invoice, Roundkit records when it was first and last emailed, how many times, the address it went to, and Resend's reference for the message. For reminders it records how many have been sent, and the time, address and Resend reference of the most recent one. For a review request it records only the date that customer was asked, because a request is not a document anybody has to be able to look up later.

The text of the email is not stored in Roundkit. Resend keeps its own record of every message it sends, including the recipient, subject and content, and stores account data, email metadata and logs in the United States.

What runs without anyone pressing a button

Three jobs run every morning.

Between about 06:00 and 07:00 Cyprus time in summer (05:00 to 06:00 in winter), Roundkit fills in each company's upcoming visits from its service days. For each company it records whether that worked, how far ahead the schedule now reaches, and how many visits were added. That record holds no customer details.

Between about 09:00 and 10:00 Cyprus time in summer (08:00 to 09:00 in winter), Roundkit sends payment reminders for invoices that were emailed and are still unpaid. An invoice gets at most three reminders, and then they stop. For each overdue invoice it reads the customer's name, email address, contact name, address and payment method, then builds and sends the reminder. For each company it records that the run happened and how many reminders were sent, failed, or were left for the next day.

In the same window, Roundkit asks customers for a Google review. A customer is asked once, the day after a visit of theirs is marked done, and never again — at most five a day for each pool company, and only where that company has saved a review link. For each one it reads their name, email address, contact name, the date of that visit and which language they read, then builds and sends the request. Afterwards it records only the date they were asked.

All three jobs send a report back to Vercel, which runs them in the United States. The reports name pool companies, not their customers. The reminder report lists each invoice by number, with what happened to its reminder and which reminder it was. The review report says which customers were asked by their database id and nothing else about them — no name and no address — and, when I rehearse it, the part of each address after the @ and the subject line, which carries the pool company's name rather than the customer's. When I rehearse that job by hand, nothing is sent and the report comes back to me, not to Vercel's scheduler. That report also shows the part of each address after the @, and each reminder's subject line. The visits report counts the visits added and gives each reason others were not, with how many customers it applied to. If a step fails, the report carries the error message the database returned. The reports are not stored in Roundkit's database. An invoice number or a customer id on its own identifies a person only to someone who can see that database.

While the jobs run, Vercel's logs record what they write: which company they are working on, the counts, and any error messages. According to Vercel's documentation, on Roundkit's current plan those logs are kept for an hour, and they do not show the reports themselves. Whether Vercel keeps the reports anywhere else, I have not confirmed.

These jobs use a key that can read every company's data, not only one company's. In Roundkit's code, three files use that key and nothing else does: one for each morning job. Where the key itself is held, and whether anything outside the live site could use it, I have not verified. Neither limit is enforced by the database.

Who else handles the data

• Supabase: the database and sign-in. Roundkit's database is in Frankfurt, Germany, and your sign-in sessions — with the IP address and browser used — are stored there along with everything else.
• Vercel: hosts the website and runs the code, including the three morning jobs. Like any web host, it receives your IP address and browser details with each request. Its code runs in Washington, D.C., in the United States. Its logs of the requests that run that code are kept for an hour on Roundkit's current plan.
• Resend: sends invoice and reminder emails. They are sent from Resend's Ireland region, inside the EU. Resend's own record of them is not: it stores account data, email metadata, logs and API records in the United States.

So two parts of Roundkit reach the United States: Resend's record of every email it has sent for me, and Vercel running Roundkit's code, which is also where the morning jobs' reports go. Sending personal data outside the EU needs a legal safeguard behind it. I have not yet confirmed which safeguard covers either company. When I have, this page will name it.

No one else. The site has no analytics, advertising or tracking code. Its font is served from roundkit.app itself, so loading a page does not contact Google. I do not sell data.

Cookies

If you are not signed in, Roundkit sets no cookies. When you sign up, a short-lived cookie lets the confirmation link finish setting up your account, which is why the link has to be opened in the same browser. When you sign in, a cookie keeps you signed in. Signing in can't work without them, so there is no consent banner.

How long things are kept

• A closed account: deleted 90 days after you close it, except invoices. Email hello@roundkit.app to close it. There is no button yet, and I do the deletion by hand.
• Invoices: kept after an account closes for as long as the company that issued them has to keep its accounting records under Cyprus tax law. That is at least six years from the tax return the invoice belongs to, and it can be longer — the clock runs from the return, not from the date on the invoice. An invoice cannot be read without the details it names, so these stay with it: the customer's name and contact details, the addresses the invoice and its reminders were sent to, and the company's details. Everything else is deleted.

There is no export in the app yet. If you want a copy of your company's data before it is deleted, ask me and I will send it.

Your rights

You can ask me:

• what I hold about you, and for a copy of it
• to correct it
• to delete it, apart from the invoice records above
• to limit or stop how I use it, or to object to how I use it
• for your data in a form you can take elsewhere

Email hello@roundkit.app and I will reply within one month. I handle every request myself, by hand. If you are unhappy with how I've handled your data, you can complain to Cyprus's Commissioner for Personal Data Protection.

Changes

When this page changes, the date at the top changes too. If a change affects how account data is used, I will email account holders before it takes effect.