Subprocessors
Subprocessors
Third parties this service uses to process personal data. The data processing agreement (DPA) is part of the Terms of Service and is published on the DPA page.
Scaleway
Hosting, database, file storage, and outgoing email, in Paris (EU).
Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France. Region Paris (fr-par). Runs the website and the API, the PostgreSQL database, the object storage for encrypted receipt files, logs, and Transactional Email for outgoing messages. Account encryption keys in this deployment are held by the application.
Hostinger
Domain, DNS, mailboxes, and receipt mail when that module is on.
Hostinger (EU) provides the domain vectorinvoice.lt, its DNS records, the mailboxes that receive email sent to our addresses, and receipt mail when that module is switched on.
Mistral AI
Reading a receipt, only through the EU endpoint.
Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. Called only at https://api.eu.mistral.ai, to read a receipt, turn one sentence into a draft, or transcribe a short recording. The code refuses other Mistral hosts and the files and agents APIs. Training on API calls is switched off in the Mistral account (confirmed on 17 October 2026). Zero Data Retention has not been requested.
Stripe
Payments for paid plans.
Stripe Payments Europe, Limited, Dublin, Ireland. Runs Checkout, the customer portal, subscriptions, and invoices for paid plans. Receives the name, email, billing address, VAT number if entered, and the payment details. Card details are entered on Stripe’s page and are not stored by VectorInvoice. Stripe may transfer data outside the EU, including to the United States and India, under the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses (https://stripe.com/privacy).
European Commission VIES
VAT-number lookup.
The public VAT-number lookup of the European Commission, used when a VAT number is checked and the lookup is not switched off.
Lithuanian open data
Lithuanian company-code lookup.
get.data.gov.lt, for a Lithuanian company code, under the same lookup switch as VIES.
Not connected
No analytics vendor and no advertising network is connected. The contact form stores the name, email, and message as a support ticket.
Outgoing email (codes and notices) is sent through Scaleway Transactional Email in Paris. Incoming email arrives in the Hostinger mailboxes.
Have I Been Pwned is not implemented. No password hash is sent to that service.
Checked against the code and configuration on 23 October 2026.