VectorInvoicePrivacy
Privacy policy
25 October 2026.
This page describes how VectorInvoice handles personal data. It describes this service as it is built. It is not legal advice and it is not tax advice.
Who runs this service
The controller is Alexander Mauz, individual activity (individuali veikla) in Lithuania, individual activity certificate no. 1174510, Vytauto g. 8-37, LT-66130 Druskininkai, Lithuania, VAT number LT100015222816, email support@vectorinvoice.lt. No data-protection officer is named. The operator is established in Lithuania, so no Article 27 representative is named.
Controller and processor
For the account, the website, and security logs, the operator is the controller. For invoice files and fields a customer uploads, the customer is the controller and the operator is the processor under Article 28. The data processing agreement (DPA) is part of the Terms of Service and is accepted with them. It is published on the DPA page. A team administrator decides processing inside that team. The provider is not the employer of team members; the customer decides who has access.
What is stored
Account email, name, a password hash (Argon2id), and an optional authenticator secret. A plan name and a billing-status label. For paid plans: the billing name, email, billing address, the VAT number if you enter one, the Stripe customer and subscription IDs, and invoice amounts, periods, and payment status. Card and other payment details are entered on Stripe’s page and held by Stripe; VectorInvoice does not receive the card number. Receipt images and extracted invoice fields. Supplier name, invoice number, amounts, buyer name, line text, VAT codes, addresses, IBANs, buyer codes, buyer emails, and the receipt file are encrypted with AES-256-GCM. A company code, VAT number, or individual activity number given at signup is encrypted on the account. A personal code, when you enter one, is encrypted and is not returned in full by the API. An i.MAS file and its password, when you upload them, are encrypted; sending to the production VMI endpoint is refused. A launch waitlist stores an email after you confirm it. A first-party device id is kept in the browser for sign-in on a business device. Shopify data is read only when you connect a shop. One trial per email address is enforced with a blind index, not the address itself. Accountant access is an invite you can revoke. Public figures, when that switch is on, are aggregates that hide small groups. The contact form stores the name, email, and message as a support ticket. Team invite emails and review comments. An append-only audit log keeps the action and a count, not the email, the amount, or free text. Support can open invoices only after you grant access for a limited time. Suggestions from automatic reading are for you to check. They are not a decision about you under Article 22.
Why
To open and run the account, show the invoices you uploaded, suggest fields when a Mistral key is set, prepare files you download, and take payment for a paid plan. An email, a password, and a business identifier are required to open an account. The account, the subscription, and billing are processed because this is necessary for the contract under Article 6(1)(b) (see the terms of service). Keeping invoices and billing records that accounting and tax law require is based on Article 6(1)(c). Security logs, abuse prevention, and the audit log are a legitimate interest under Article 6(1)(f): securing the service. The launch waitlist uses your consent under Article 6(1)(a). You can withhold that consent by not confirming the email, or ask for the address to be removed. Automatic reading suggests fields for you to check. It does not produce a legal effect about you.
Who receives it
Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France (region fr-par, EU) hosts the site, the API, the database, and file storage, and sends outgoing email. Hostinger (EU) provides the domain, DNS, the mailboxes that receive email sent to us, and receipt mail when that module is on. Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, receives a receipt, a sentence, or a short recording only when an API key is set, and only through the EU endpoint. The European Commission VIES service and the Lithuanian open-data set at get.data.gov.lt are called when a VAT number or a company code is looked up and the lookup is not switched off. Stripe Payments Europe, Limited (Dublin, Ireland) processes payments for paid plans. It receives the name, email, billing address, VAT number if entered, and the payment details entered in Stripe Checkout, to process the payment under Article 6(1)(b). Stripe also processes some of this data as its own controller, for example for fraud prevention and legal obligations, under its privacy policy at https://stripe.com/privacy. No analytics vendor is connected. Customer data is not sold. The contact form stores the name, email, and message as a support ticket. A staff reply to that ticket is emailed to the address on the form.
Where it is processed
The site, the API, the database, file storage, and outgoing email run at Scaleway in the Paris region (EU). The mailboxes for incoming email are at Hostinger (EU). Mistral calls go to https://api.eu.mistral.ai. The code refuses the United States host, the global host api.mistral.ai, and the files and agents APIs. Mistral documents that account and billing metadata may sit outside the inference region. The training opt-out is active on the confirmation of 17 October 2026. Zero Data Retention has not been requested. Stripe may transfer payment data to countries outside the EU, including the United States and India. Stripe states that it uses the EU-U.S. Data Privacy Framework (Stripe, LLC), the EU Standard Contractual Clauses, or other lawful transfer mechanisms (https://stripe.com/privacy).
How long
A compressed copy of each receipt file is kept for 2 years from the document date (730 days, configurable). Extracted invoice fields and the journal stay after that file copy is deleted. Email and in-app reminders are sent 60 and 14 days before that file deletion, with a one-click ZIP export. After you cancel, or after a free trial ends, the account is read-only and you can export your data for 30 days. After that window the account data is deleted, except a reduced row that may be kept for the retention window configured in the application (default 10 years): period, direction, document number, date, and amounts. Not the file, the name, the address, or the notes. That window is a setting in the application. Keeping your own bookkeeping copies is your responsibility. This is not tax advice. Settings can also download the account data, delete stored files, delete stored records, or delete the account. Each deletion asks for the password again and a one-time email code. The button does not erase provider backups, disk snapshots, database free space until unused space is reclaimed, email already sent, or the audit log. Logical backups of the database are not volume encryption; field and file ciphertext stays ciphertext in those copies. Billing records (invoices, amounts, periods, payment status, and the Stripe IDs) are kept for the contract and afterwards for as long as accounting and tax law requires; then they are deleted. Stripe keeps payment data under its own retention rules.
Security
AES-256-GCM for the fields and files named above. Passwords use Argon2id. Session cookies are httpOnly except the CSRF cookie, SameSite=Strict, and always Secure in production. Administrator accounts must enrol an authenticator in production. The server refuses to start if that rule is off. The database is Scaleway managed PostgreSQL in Paris, with volume encryption at rest. Logical backups exist through that service. Internal penetration tests were run in October 2026. This page does not claim an ISO certificate or a SOC report.
Your rights
You can ask for access, correction, erasure, restriction, and objection where processing is based on legitimate interest. You can download a copy of your account data in Settings (Article 20). You can withdraw consent for the launch waitlist. Where the operator is the controller, you can complain to the State Data Protection Inspectorate (VDAI) in Lithuania, and to the authority of your place of residence, your place of work, or the place of the alleged infringement. Where you are the controller of invoice content, the operator acts as processor and refers the request to you. For requests that do not use the buttons in Settings, write to support@vectorinvoice.lt or to the postal address above.
Anonymous statistics
When this switch is on, the website and the app count page views without a cookie and without a script from another company. When a proxy sends a country header, that country is used. Otherwise the country comes from a local country-only database loaded in memory (IP Geolocation by DB-IP, https://db-ip.com/, licence CC BY 4.0, https://creativecommons.org/licenses/by/4.0/). The IP address is read from the first hop of X-Forwarded-For, used for that lookup and for a one-day code, and then discarded. The IP address and the browser name are not stored. A visitor is recognised for one day with a salt that changes the next day and is deleted the same day. What is kept are totals: the date, a page group, the country, the kind of device, the referring domain, and whether a person was signed in. A short list of the daily visitor codes is deleted within 24 hours. A browser that sends Do Not Track or Global Privacy Control is left out. This is not advertising and it does not build a profile of a person.
Children
The service is for people who run a business or an individual activity. It is not directed at children.
Changes
The date at the top is the date of this text. When a new version of the terms, the data processing agreement, or this policy needs acceptance, the app asks for it before you continue.