DAMOCLES SERVICES

Privacy Policy

Last updated: 5 October 2026

1. Controller and contact

This Privacy Policy explains how personal data and business information are processed when you use currently available SALES services: the SALES-T Android application, SALES Admin (Management Web), Professional Account and Company Account surfaces, Organizations, the TULSATO product website at https://tulsato.com, and the public Damocles Services website at https://damocles-services.com. Scope is limited to currently available SALES services and does not describe unreleased SALES modules.

TULSATO is the product/platform. DAMOCLES SERVICES SINGLE MEMBER P.C. is the operating/legal company that provides TULSATO. TULSATO is not a separate legal company.

The controller for Damocles Services website communications and for TULSATO-controlled platform-level account and security processing described here is:

DAMOCLES SERVICES SINGLE MEMBER P.C.
DAMOCLES SERVICES ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.
Trade name: DAMOCLES SERVICES
TULSATO is operated by DAMOCLES SERVICES SINGLE MEMBER P.C.
Registered office: ΕΡΜΟΥ ΚΑΙ ΛΥΚΟΒΡΥΣΕΩΣ 14, 14452 ΜΕΤΑΜΟΡΦΩΣΗ, ΑΤΤΙΚΗ, ΕΛΛΑΔΑ
GEMI: 196664401000
EUID: ELGEMI.196664401000
AFM: 803425673
VAT: EL803425673
Formed: 08/10/2026
Email: info@damocles-services.com
Privacy: privacy@tulsato.com
Website: https://damocles-services.com

For privacy questions or requests about the TULSATO product, contact privacy@tulsato.com. Security reports: security@tulsato.com. Product support: support@tulsato.com. The operator contact remains info@damocles-services.com.

When an Organization uses SALES to enter or generate operational business records, that Organization normally determines the purposes and means of that processing and acts as controller for those records. DAMOCLES SERVICES SINGLE MEMBER P.C., operating TULSATO, may process such data as a processor to host, secure, maintain, synchronize, support and operate the service. The Data Processing Agreement remains the separate Organization/controller-processor instrument and is not replaced by this Privacy Policy.

2. Account data

Depending on the account type and functions used, SALES may process:

  • name;
  • email address;
  • user and account identifiers;
  • optional profile information you or an Organization administrator provide;
  • authentication identifiers;
  • account status and lifecycle status.

Identity / KYC verification for Professional withdrawals and related fraud, compliance, and same-owner payout controls is performed when those operations are requested. Didit is the primary hosted identity-verification provider. The provider may, under its own verification flow, process identity documents, selfies, liveness checks, biometric or equivalent verification data, company documents, and related compliance information. TULSATO does not store raw identity documents, selfies, liveness video, biometric templates, KYB supporting documents, UBO dossiers, or raw provider questionnaires. Current implementation does not retain those raw artifacts at TULSATO.

For identity verification and payout same-owner matching, TULSATO processes and may retain minimized verification records, including: identity verification provider reference; verification status and timestamps; minimized verified identity name returned by the provider; a normalized identity-name representation and a hash/evidence representation used for deterministic matching; payout-destination ownership verification evidence; and manual review evidence where applicable. Access is restricted through authenticated roles and server-side controls. Retention follows legal, accounting, fraud, dispute, and security obligations and is not the same as raw GPS retention. Didit does not independently verify bank-account ownership for TULSATO; same-owner payout matching is performed by TULSATO using verified identity-name matching and/or controlled TULSATO or manual evidence. Real fiat funding and Professional earnings payout remain disabled until go-live configuration enables them.

3. Professional, Company and Organization structure

SALES currently supports Professional Accounts (a personal identity, including field use of SALES-T), Company Accounts (the Company identity that may create and manage Organizations), and Organizations (the workspace that holds business records), including roles and membership assigned by the Company. A Professional may be linked to more than one Organization. Access to an Organization’s records follows the membership and role assigned for that Organization.

4. CRM and business records

Authorized users may enter or access business records such as Customers, Contacts, Visits, Communications, Activities, and related notes, status and history.

SALES CRM Contacts are business records that a user or Organization manually enters into SALES. SALES does not access the Android address book and does not collect device contacts.

The Organization and its authorized users are responsible for ensuring that information entered is accurate, appropriate and lawfully processed.

5. Precise location

SALES-T collects precise location only after the user starts a tracking session. Only the authenticated tracked user may start Tracking. Company, Admin, Manager and Platform Admin cannot remotely start GPS Tracking. Tracking does not start if the user cancels the in-app location disclosure. The user starting Tracking is a privacy safeguard and is not GDPR consent. The public website does not request continuous GPS tracking from visitors.

While a session is active and shared with a selected Organization, authorized Organization management may see the live precise GPS position of that user in Management/Admin Web. The Company identity site is not a live Tracking map. Stop Tracking ends new GPS collection immediately. Historical pre-Stop route data may remain according to the applicable retention setting. Historical visibility after Stop is not live tracking.

Location is used for field route recording and visit verification. Visit verification uses customer premises coordinates together with available session GPS, not the button-press location as a substitute for the customer location.

GPS accuracy depends on the device, permissions, satellite visibility, network conditions, operating-system restrictions, battery settings and other technical factors. Routes may contain gaps or incomplete segments. SALES-T uses simplified tracking semantics: GPS route geometry with quality filtering and speed-based sampling. Map coloring uses movement-speed ranges. This policy does not claim automatic AI transport recognition as a current product capability.

6. Raw GPS retention

Detailed raw GPS / route history is a separate retention system from permanent business records. Professional Personal raw GPS retention may be set to 0 (same local calendar day only) or 1, 3, 6, 12, 18 or 24 months. The current default is 12 months. Reducing Personal retention makes older Personal raw GPS history unavailable according to that setting. Increasing Personal retention later does not restore previously excluded Personal history.

Organizations have an independent raw GPS retention setting using the same value set (0 / 1 / 3 / 6 / 12 / 18 / 24 months). Organization-retained location history is not the same store as Personal retention.

Derived business records (for example verified visits, activities, KPIs and permanent distance summaries) follow their own business lifecycle and are not deleted merely because raw GPS history expires.

Reducing retention currently makes expired raw GPS logically unavailable according to existing rules. Expired raw GPS points are then physically deleted once no legitimate Personal or Organization holder remains entitled to retain that point. A later retention increase does not restore already-purged points. Legal hold may defer deletion only through the explicit hold mechanism. Purge audit records counts and identifiers, not raw coordinates.

7. Camera, gallery and photos

SALES-T may capture a camera photo (user-initiated; SALES-T may record current location context according to current app rules) or attach a photo the user explicitly selects from the system gallery / Photo Picker. On Android 13 and later, gallery selection does not require unrestricted persistent access to the device photo library. Gallery EXIF location is not treated as SALES-T tracking evidence.

Photo attachments are optional. If a photo includes location metadata, that metadata reflects the attachment context in SALES and is not evidence of the original gallery capture location. Customer photos are private Organization media stored in SALES private storage with signed access for authorized users. Media follows a holder-aware lifecycle. Automated media-cleanup scheduling is not claimed as enabled in the current service configuration.

8. Device Health

For security, support and operational monitoring of an authorized work device, SALES may process battery level, charging status, network state/class, GPS status, last GPS upload, heartbeat, device model and manufacturer, Android version, and app version.

Device Health does not access personal photographs, personal messages, call contents, Android contacts, passwords, personal documents or the contents of other applications.

9. Device authorization and installation identifier

SALES-T may restrict tracking and access to an authorized installation. An installation identifier and related device-authorization records are processed so an Organization can approve, replace or revoke a device.

10. Security and MFA

SALES processes authentication data, device-authorization records, and audit/security logs needed to protect accounts and Organizations. Where the device supports it, biometric unlock may be used to unlock the app on that device. Biometric templates remain on the device and are not uploaded to SALES.

11. Multi-organization behavior

A Professional may belong to more than one Organization. Tracking share and CRM visibility follow the Organizations selected or assigned for that activity. Data belonging to one Organization is not made available to another Organization except through authorized membership, role or explicit sharing controls in the current product.

12. Website enquiries and technical logs

When you use the contact form or communicate with us directly, we may collect your name, email address, company or organisation, subject and content of your message, and any other information you voluntarily provide.

Website systems or hosting providers may process limited technical information such as IP address, browser and device information, date and time of requests, requested pages, and security logs needed to detect spam, abuse or malicious activity.

13. Service providers actually used

SALES does not include advertising or consumer analytics SDKs and does not sell personal data.

Processors and infrastructure actually used for current services include:

  • Supabase (authentication, database, private storage, related backend functions);
  • CARTO map tile infrastructure using OpenStreetMap data for in-app and Admin maps;
  • Google / Android location services on the device for GPS while tracking is active;
  • server-side geocoding (Google Geocoding via a Damocles-operated function) when an address is geocoded in the product;
  • Google Gemini and OpenAI API services for Ask SALES product-help answers when remote assistance is used;
  • a Google AI provider for the complimentary FREE Agent (authorized, scoped tool context only; not a paid Agent);
  • Google Cloud Vision and OpenAI for Scan Card OCR and extraction when that function is used;
  • website and email hosting/infrastructure required to operate public pages and transactional messages.

Didit is the PRIMARY hosted KYC/KYB provider and is PRODUCTION READY for hosted identity/business verification when those operations are requested. Sumsub remains DORMANT / NOT_CONFIGURED. TULSATO may rely on independent verification providers for identity, business, security or payout verification. Didit may process identity documents, selfies, or biometric/equivalent data under its own verification flow; TULSATO does not store those raw artifacts under the current implementation. TULSATO does not claim that Stripe performs KYC/KYB, and Didit does not independently verify bank-account ownership for TULSATO. Where TULSATO plan subscription billing is configured, billing may be processed by a payment service provider (currently Revolut for that subscription billing rail only). That billing rail, where used, does not credit Service Balance or Earnings and does not pay out Professional earnings. Wallet funding of Service Balance and Professional earnings payout remain unavailable until the relevant payment/payout service provider rail is enabled. Stripe is not an active TULSATO payment, KYC, KYB, or payout provider.

Advertising SDKs, ad-network scripts and a payment-service provider are not configured in the current service. HubSpot and Salesforce integrations exist only when an authorized user directs a CRM import connection; they are not a default data flow for every user.

Information may also be visible to the Organization that holds the relevant business records, authorized administrators and users of that Organization according to role, and public authorities where disclosure is required by law. Processor sharing (hosting/operation) is not the same as making records visible to other users or Organizations.

14. Account deletion

A Professional may request deletion of the Professional Account. A one-year recovery period applies. During recovery, normal operational access is disabled and the Professional may recover the account.

A Company may request deletion of the Company Account. A one-year recovery period applies. During recovery, normal operational access is disabled.

After finalization, SALES deletes or anonymizes by default except the minimum data necessary for legal obligations, accounting and tax obligations where applicable, fraud and security, disputes, establishment/exercise/defence of legal claims, protection of other legitimate users and Organizations, and protection of Damocles Services. SALES does not immediately erase every record, and does not keep everything forever.

15. CRM last-holder principle

Deleting the creator of a Customer or Contact does not automatically delete those business records. CRM/business data remains while another legitimate holder or context has a valid basis. When no legitimate holder/basis remains, the data becomes eligible for deletion or anonymization.

Raw GPS retention is a separate system from CRM last-holder rules, except where a specific deletion or legal-hold process also covers location records.

16. Legal hold

Where a legal hold, lawful request, security investigation or dispute requires preservation, SALES may retain the minimum necessary information even if a user or Organization has requested deletion.

17. Your rights

Subject to applicable law, an individual may have the right to access, correction, deletion, restriction, objection where applicable, portability where applicable, and lodging a complaint with a supervisory authority. In Greece: Hellenic Data Protection Authority, https://www.dpa.gr.

SALES does not claim that every right can be exercised through fully automated self-service tooling. Requests may be handled through the Organization (for Organization-controlled records), through the in-product Compliance Center where available, and/or privacy@tulsato.com or info@damocles-services.com, with identity verification where appropriate. Erasure is not fully automated.

18. Security and transfers

Reasonable technical and organizational measures are used, including authenticated access, role-based permissions, row-level database security, encrypted transmission, authorized-device controls and security logging. Some processors may process data outside Greece or the EEA. Where required, an applicable transfer mechanism is used (for example an adequacy decision or Standard Contractual Clauses). No electronic service can be guaranteed completely secure or continuously available.

19. Cookies

The website may use technologies strictly necessary for its technical operation, security and user-requested functionality. Non-essential analytics, advertising or similar tracking technologies will not be intentionally activated without any consent mechanism required by applicable law.

20. Children and audience

SALES services and this website are intended for business and professional use by authorized personnel. TULSATO accounts are available only to persons aged 18 or older. They are not directed to children.

21. Ask SALES assistance

Ask SALES is a question-and-answer product-help assistant. When you use it, SALES processes the text you enter to provide product help. The public website assistant does not access your account, Organization or customer records. In signed-in product surfaces, non-sensitive contextual flags (for example current screen) may be sent to improve answers. Ask SALES is not the FREE Agent and does not execute CRM or Tracking actions.

To generate some answers, SALES may send your question and relevant product-help excerpts to Google Gemini and, if needed, an OpenAI fallback under the service’s provider routing. This policy does not claim that no data is sent to third-party AI. It also does not claim that a full CRM database is sent; Ask SALES uses allowlisted help context, not bulk export of customer files.

22. Complimentary FREE Agent

The complimentary FREE Agent is an action-executing assistant available to eligible signed-in users, currently capped at 3 successful actions per eligible user per UTC calendar month. It is not Commercial Agenting. Paid Agent features are off. Unused complimentary actions do not roll over.

When you use the FREE Agent, SALES processes your instruction and the minimum account/business records the authorized tool needs (records you can already access). The Agent proposes a typed action; SALES servers authorize it against your signed-in identity and existing permissions. The model does not alone authorize actions. A dedicated Google AI provider may process Agent traffic. Failure of that free provider fail-closes; it does not spill into a paid provider.

23. Scan Card

Scan Card is an OCR/extraction function. When used, the image is processed server-side with Google Cloud Vision and then an OpenAI extraction model. The image is transient and is not stored as a dedicated Scan Card object. The user reviews extracted values before any CRM mutation. Scan Card is not Ask SALES and is not the FREE Agent.

24. Features not currently available

The following are not currently available as live user services, even if the product has runtime readiness: advertising networks and AdMob (not configured); wallet Service Balance funding through a payment/payout service provider (not enabled); Professional earnings payout (disabled); public Freelancer marketplace self-registration (closed); Commercial Agenting (closed/hidden); Plus++ (Coming Soon). Authenticated Company and Professional users may use Freelancer Core for Trial and internal USD-denominated engagements under the Financial Terms. Current product currency is USD. SALES Credits are not the current product currency. This policy does not describe Stripe as an active data recipient. TULSATO is not a bank, EMI, or payment institution.

25. Storage and files

Photos, documents and similar files are stored in private object storage with signed access for authorized users. Commercial storage quota is a logical product limit. When over quota, new material writes may be blocked; existing readable data is not automatically deleted. Logical quota is not the same as the hosting provider’s physical byte accounting.

26. Data-subject requests and provider switching

Organizations may use the Compliance Center for ACCESS, PORTABILITY, RECTIFICATION, ERASURE, RESTRICTION, OBJECTION or OTHER requests. Provider Switching / Exit is a separate legal-portability path and is not the same as paid commercial CRM export. Ordinary commercial export, where available, follows published commercial pricing. SALES does not treat every commercial export as an automated statutory right.

27. Financial and wallet records

TULSATO processes commercial and related personal data needed to operate USD Service Balance, Earnings, conversion, withdrawal review, identity verification for withdrawals, same-owner payout-destination verification, and (where configured) plan billing. Depending on role and functions used, this may include wallet and transaction records; Service Balance history; Earnings history; earnings-conversion records; withdrawal requests and review outcomes (ACCEPT / REJECT / FURTHER REVIEW); payout-destination metadata (masked/display identifiers, ownership lifecycle / verification status, ownership assertions) — not full bank or card credentials if TULSATO does not store them; identity verification provider references, status, and timestamps; minimized verified identity name, normalized name representation, and hash/evidence used for same-owner matching; payout-destination ownership verification evidence and manual review evidence where applicable; provider transaction identifiers and billing references; fraud, security, and account-review metadata; accounting and audit records; and financial-environment isolation metadata. TULSATO-controlled records are distinct from provider-controlled payment or KYC data. Raw identity documents, selfies, and biometric artifacts remain with the verification provider under its flow and are not stored by TULSATO under the current implementation. Historical completed payouts may retain immutable verification evidence. These categories do not make TULSATO a bank or payment institution.

28. Updates

This Privacy Policy may be updated. The “Last updated” date on this page identifies the current public text. The TULSATO product public copy is published at https://tulsato.com/privacy/. An aligned Damocles Services copy is published at https://damocles-services.com/privacy/. The in-app Privacy Policy is intended to remain factually aligned with this public version. Material changes may also be communicated through the application, an Organization administrator or another appropriate channel.

29. Contact

TULSATO product privacy: privacy@tulsato.com
Security: security@tulsato.com
Support: support@tulsato.com

Damocles Services (operator)
Email: info@damocles-services.com
Website: https://damocles-services.com