Privacy

• Account data. The email address you sign in with, the holder entity name, and the MAS contract numbers you register.
• Transaction data. The sales lines you import: order numbers, item descriptions, quantities, unit prices, totals, dates, ship-to ZIP codes, and the codes the report needs.
• Catalog data. Your items and the mapping you build for them — SIN, unit of measure, manufacturer, part number — with its version history.
• Generated files and their history. Every file the service produced, kept as an immutable snapshot with the inputs recorded against it.
• Subscription state. Which plan is active, from the payment processor’s record. Card details are held by the processor and never by Lyra Ventures LLC.
• QuickBooks Online tokens, where you connect one. Access and refresh tokens, encrypted at rest, used only to read the sales data you asked the service to pull.

It also does not hold your bank details, your card number, or any credential for GSA’s portal. You sign in to SRP yourself; the service has no connection to it.

To run the service for you: to import a month, to map your catalog, to check the data against the file rules, to produce the file, to calculate the fee figure, to track deadlines, and to keep the archive.

Your data is not sold, not shared with advertisers, and not used to train any model. Where a suggestion for an item’s mapping is generated, the item’s description is sent to the model provider for that one request and the provider is contractually barred from training on it; no sales figures are sent, and the feature works without a model at all.

• To you. Every file, every export, whenever you ask.
• To the payment processor. Your email address and the plan, so a subscription can exist.
• To QuickBooks Online, if connected. A read request for the date range you chose.
• To error monitoring and the event log. Counts and identifiers only.

Nothing goes to GSA from here. The upload is yours.

Data is scoped to your organization at the database level, so one account cannot read another’s rows even if a request asks for them. QuickBooks tokens are encrypted at rest.

No sign-in link, session token, QuickBooks token, sales figure or item code is written into a URL sent to analytics, into a server log, into an error report, or into an event property. That scrubbing is shared, tested plumbing rather than something each part of the code is trusted to remember — which is what makes the sentence a claim rather than an intention.

Your reported sales are part of your federal contract record, so the archive is kept for as long as the account exists rather than expired on a schedule. If the subscription lapses, read and export access to the archive and the catalog mapping stays open.

You can export everything at any time, and you can ask for the account and its data to be deleted. Deletion removes the transaction data, the catalog, the generated files and the connection tokens; export first, because it cannot be undone.

If a breach affects your private information and you live in New York, we will notify you as New York General Business Law § 899-aa (the SHIELD Act) requires — in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered, unless a law-enforcement agency determines that notice would impede a criminal investigation. Wherever you live, we will also notify you as other state and federal breach-notification law requires.

Entity

Lyra Ventures LLC

Address

348 4th Avenue Ste 1031, Brooklyn, NY 11215, United States

Contact

Contact pending

The contact mailbox is recorded as pending rather than filled with a plausible value: a support address that bounces is worse than none.