Privacy policy

This policy describes how Integravizija (“we”) processes personal data when you use integravizija.lt — registering, buying an Apskaita5 add-on licence, or downloading the installer. The Lithuanian text prevails if it conflicts with this English translation.

1. Data controller

MB „Integra vizija“ (trading as “Integravizija”), company code 306998587, registered office V. Krėvės pr. 80B-37, LT-50385 Kaunas, the Republic of Lithuania. Registered in the Register of Legal Entities of the Republic of Lithuania. Email: info@integravizija.lt. Phone: +370 699 52662. The seller is not a VAT-registered person and has no VAT ID.

2. Whose data

The account holder’s email and name are personal data even when the licensed entity is a company. Company codes of legal persons are not personal data. Identifiers of a sole trader can be.

3. Data we store

We store: email address, a cryptographic hash of your password (if you set one) or your Google account identifier, name, company names and company codes (I_Kodas), Stripe customer ID, subscription, entitlement and trial records (including the client IP of a trial start), and the licence payload (account ID, add-ons, companies, dates, refresh token).

When you use the invoice-scanner add-on, we also store scan metadata: file size, file type, the model identifier, processing time and timestamp, linked to your account. We process this metadata as a separate controller, for security, quota enforcement and abuse prevention (legitimate interests — see section 4); it is outside the data processing agreement at /legal/dpa, which covers only the content of the documents you upload. We never store the invoice file itself or the extracted content — on our side the document is processed in memory only, to produce the extraction, and is then discarded (for the AI provider’s handling of the transmitted content, see section 5).

We do not see or store payment-card numbers. Billing address and tax ID are collected and stored by Stripe at checkout, not in our shop database.

4. Why we process it (legal bases)

Article 6(1)(b) GDPR — performance of a contract: account, licence, installer, support.

Article 6(1)(c) GDPR — legal obligation: accounting records kept for 10 years under the Law on Accounting of the Republic of Lithuania.

Article 6(1)(f) GDPR — legitimate interests: session cookie, security, server logs, rate limits, scan metadata (for security, quota enforcement and abuse prevention), and enforcing one free trial per account and per company code (including the client IP stored on the trial grant). We do not send marketing, so we do not rely on consent for that purpose.

For documents you upload through the invoice-scanner add-on, your role and ours differ: you are the controller of that data (including your clients’ data in it) and we process it solely as your processor under the data processing agreement at /legal/dpa, on your instructions and for no other purpose.

5. Service providers, processors and recipients

We use these providers. Payments are processed by Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States): for payment processing they act as our processors, and for some processing (for example fraud prevention) Stripe acts as an independent controller under its own privacy notice. Sign-In is authenticated by Google LLC (United States), which acts as a controller for the account data you provide to it under Google’s terms. Transactional email is sent by Resend, Inc. (United States) as our processor. The website and database are hosted by Amazon Web Services in the eu-north-1 region (Stockholm) as our processor. Invoice-scan content is extracted by Mistral AI, SAS (France) as our processor under the agreement at /legal/dpa, under zero data retention: inputs and outputs are not retained once the response has been returned.

Under our agreement with Mistral AI all data is hosted in Europe; if in exceptional circumstances data were processed outside the European Union, we ensure appropriate safeguards under Article 46 GDPR so that the processing complies with the GDPR.

6. Cookies

We set one strictly necessary cookie, a5_session: it keeps you signed in for 30 days, is HttpOnly, SameSite=Lax and Secure on HTTPS. During Google Sign-In we also set a short-lived HttpOnly cookie, a5_oauth, to prevent CSRF; it expires in 10 minutes. Both are required for the shop to work, so we do not ask for consent.

When you pay, Stripe may set its own cookies on checkout.stripe.com under Stripe’s privacy policy. We do not use analytics or advertising cookies.

7. Retention

Account data is kept while the account is active. Accounting records (invoices and billing data, held at our payment processor Stripe) are kept for 10 years under the Law on Accounting of the Republic of Lithuania, including after the account is deleted; when deletion is scheduled, renewal is stopped but the processor-side records are kept for that duty. A trial grant tied to an I_Kodas is kept as long as needed to enforce “once per account and once per company”, including after the account is deleted; the client IP linked to it is kept for no longer than 12 months from the start of the trial and is then deleted. Scan metadata is kept for 12 months for security, quota enforcement and abuse prevention, and is then deleted. Invoice files and extracted content are never stored. Server logs: nginx access and error logs are rotated daily and kept for about 14 days; application logs, used for security and troubleshooting, are normally kept up to 30 days, and longer only where required to investigate a security incident.

8. Your rights

You have the right to access, rectify, erase (some records are kept as described in section 7), restrict, port and object to processing. You can exercise data portability and erasure yourself in the dashboard (“My data”): download your data as a machine-readable file, and delete your account either when the paid period ends (recommended; undoable until then) or immediately. You may also write to info@integravizija.lt. For personal data contained in documents uploaded through the invoice-scanner, requests should be addressed to the controller who uploaded the document (for example, your accountant); we assist that controller under the data processing agreement. AI extraction assists you in preparing your own records; we do not take automated decisions with legal effects under Article 22 GDPR.

You may lodge a complaint with the State Data Protection Inspectorate (VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt.