Privacy policy

Who runs this service

The controller is Alexander Mauz, individual activity (individuali veikla) in Lithuania, individual activity no. 1174510, Vytauto g. 8-37, LT-66130 Druskininkai, Lithuania, VAT number LT100015222816, email support@vectorinvoice.lt. No data-protection officer is named. The operator is established in Lithuania, so no Article 27 representative is named.

Controller and processor

For the account, the website, and security logs, the operator is the controller. For invoice files and fields a customer uploads, the customer is the controller and the operator is the processor under Article 28. The data processing agreement (DPA) is part of the Terms of Service and is accepted with them. It is published on the DPA page. A team administrator decides processing inside that team. The host is not the employer.

What is stored

Account email, name, a password hash (Argon2id), and an optional authenticator secret. A plan name and a billing-status label. For paid plans: the billing name, email, billing address, the VAT number if you enter one, the Stripe customer and subscription IDs, and invoice amounts, periods, and payment status. Card and other payment details are entered on Stripe’s page and held by Stripe; VectorInvoice does not receive the card number. Receipt images and extracted invoice fields. Supplier name, invoice number, amounts, buyer name, line text, VAT codes, addresses, IBANs, buyer codes, buyer emails, and the receipt file are encrypted with AES-256-GCM. A company code, VAT number, or individual activity number given at signup is encrypted on the account. A personal code, when you enter one, is encrypted and is not returned in full by the API. An i.MAS file and its password, when you upload them, are encrypted; sending to the production VMI endpoint is refused. A launch waitlist stores an email after you confirm it. A first-party device id is kept in the browser for sign-in on a business device. Shopify data is read only when you connect a shop. One trial per email address is enforced with a blind index, not the address itself. Accountant access is an invite you can revoke. Public figures, when that switch is on, are aggregates that hide small groups. The contact form stores the name, email, and message as a support ticket. Team invite emails and review comments. An append-only audit log keeps the action and a count, not the email, the amount, or free text. Support can open invoices only after you grant access for a limited time. Suggestions from automatic reading are for you to check. They are not a decision about you under Article 22.

Why

To open and run the account, show the invoices you uploaded, suggest fields when a Mistral key is set, prepare files you download, and take payment for a paid plan. An email, a password, and a business identifier are required to open an account. The account, the subscription, and billing are processed because this is necessary for the contract under Article 6(1)(b) (see the terms of service). Keeping invoices and billing records that accounting and tax law require is based on Article 6(1)(c). Security logs, abuse prevention, and the audit log are a legitimate interest under Article 6(1)(f): securing the service. The launch waitlist uses your consent under Article 6(1)(a). You can withhold that consent by not confirming the email, or ask for the address to be removed. Automatic reading suggests fields for you to check. It does not produce a legal effect about you.

Who receives it

Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France (region fr-par, EU) hosts the site, the API, the database, and file storage, and sends outgoing email. Hostinger (EU) provides the domain, DNS, the mailboxes that receive email sent to us, and receipt mail when that module is on. Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, receives a receipt, a sentence, or a short recording only when an API key is set, and only through the EU endpoint. The European Commission VIES service and the Lithuanian open-data set at get.data.gov.lt are called when a VAT number or a company code is looked up and the lookup is not switched off. Stripe Payments Europe, Limited (Dublin, Ireland) processes payments for paid plans. It receives the name, email, billing address, VAT number if entered, and the payment details entered in Stripe Checkout, to process the payment under Article 6(1)(b). Stripe also processes some of this data as its own controller, for example for fraud prevention and legal obligations, under its privacy policy at https://stripe.com/privacy. No analytics vendor is connected. Customer data is not sold. The contact form stores the name, email, and message as a support ticket. A staff reply to that ticket is emailed to the address on the form.

Where it is processed

The site, the API, the database, file storage, and outgoing email run at Scaleway in the Paris region (EU). The mailboxes for incoming email are at Hostinger (EU). Mistral calls go to https://api.eu.mistral.ai. The code refuses the United States host, the global host api.mistral.ai, and the files and agents APIs. Mistral documents that account and billing metadata may sit outside the inference region. The training opt-out is active on the confirmation of 17 October 2026. Zero Data Retention has not been requested. Stripe may transfer payment data to countries outside the EU, including the United States and India. Stripe states that it uses the EU-U.S. Data Privacy Framework (Stripe, LLC), the EU Standard Contractual Clauses, or other lawful transfer mechanisms (https://stripe.com/privacy).

How long

A compressed copy of each receipt file is kept for 2 years from the document date (730 days, configurable). Extracted invoice fields and the journal stay after that file copy is deleted. Email and in-app reminders are sent 60 and 14 days before that file deletion, with a one-click ZIP export. After you cancel, or after a free trial ends, the account is read-only and you can export your data for 30 days. After that window the account data is deleted, except a reduced row that may be kept for the retention window configured in the application (default 10 years): period, direction, document number, date, and amounts. Not the file, the name, the address, or the notes. That window is a setting in the application. Keeping your own bookkeeping copies is your responsibility. This is not tax advice. Settings can also download the account data, delete stored files, delete stored records, or delete the account. Each deletion asks for the password again and a one-time email code. The button does not erase provider backups, disk snapshots, database free space until unused space is reclaimed, email already sent, or the audit log. Logical backups of the database are not volume encryption; field and file ciphertext stays ciphertext in those copies. Billing records (invoices, amounts, periods, payment status, and the Stripe IDs) are kept for the contract and afterwards for as long as accounting and tax law requires; then they are deleted. Stripe keeps payment data under its own retention rules.

Security

AES-256-GCM for the fields and files named above. Passwords use Argon2id. Session cookies are httpOnly except the CSRF cookie, SameSite=Strict, and always Secure in production. Administrator accounts must enrol an authenticator in production. The server refuses to start if that rule is off. The database is Scaleway managed PostgreSQL in Paris, with volume encryption at rest. Logical backups exist through that service. Internal penetration tests were run in October 2026. This page does not claim an ISO certificate or a SOC report.

Your rights

You can ask for access, correction, erasure, restriction, and objection where processing is based on legitimate interest. You can download a copy of your account data in Settings (Article 20). You can withdraw consent for the launch waitlist. Where the operator is the controller, you can complain to the State Data Protection Inspectorate (VDAI) in Lithuania, and to the authority of your place of residence, your place of work, or the place of the alleged infringement. Where you are the controller of invoice content, the operator acts as processor and refers the request to you. For requests that do not use the buttons in Settings, write to support@vectorinvoice.lt or to the postal address above.

Cookies

Before you sign in, this site sets no cookie. After sign-in it uses only the first-party cookies and browser storage listed below. All of them are set by www.vectorinvoice.lt or its API, are always Secure in production, and are needed to sign you in, protect requests, or remember a choice you made. There is no analytics, advertising, or tracking cookie, and the site loads no third-party scripts, fonts, or embeds. Service workers and offline caches are not used: the app removes any it finds. The language is the address prefix, not a cookie.

Legal basis: storage that is strictly necessary for a service you asked for does not need consent under Art. 5(3) of the ePrivacy Directive 2002/58/EC, Art. 73(4) of the Lithuanian Law on Electronic Communications, and § 25(2) no. 2 TDDDG (Germany). This is why no cookie banner asks for consent. If a non-essential cookie or storage item is ever added, consent will be asked first.

To remove them, sign out (this deletes the sign-in cookies) or clear cookies and site data for vectorinvoice.lt in your browser settings. Clearing them signs you out and resets the display choice and the notice.

Children

The service is for people who run a business or an individual activity. It is not directed at children.

Changes

The date at the top is the date of this text. When a new version of the terms, the data processing agreement, or this policy needs acceptance, the app asks for it before you continue.