Privacy Policy

1. Who we are and how to contact us

This privacy policy explains how UAB Codus (company code 306635689, registered office Sakalaičių Sodų 5-oji g. 6, LT-02216 Vilnius; hereinafter sors, we) processes personal data while providing the document digitization and invoice processing service (hereinafter the Service).

For personal data matters, contact us at [email protected]. We respond to every request in accordance with GDPR Art. 12 (within one month, extended where necessary, with notice of the extension).

The supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (VDAI), Laisvės pr. 60, LT-04018 Vilnius, vdai.lrv.lt.

2. Our roles: controller and processor

We act as both a data controller and a data processor, depending on the category of data:

• Data controller - when we process your account data, usage and billing data, technical logs, and the counterparty master-data database (see section 5). For these categories we determine the purposes and means of processing ourselves.
• Data processor - when we process the content of documents uploaded to the Service. Invoices and other documents often contain personal data of third parties (for example, self-employed individuals or individual buyers). The controller of that data is your organization or its client company, and we process it only on its documented instructions, as set out in the Data Processing Agreement (GDPR Art. 28).

3. What data we process and on what legal basis

We do not knowingly process special categories of data (GDPR Art. 9). Should such data appear in uploaded documents, we would process it only as a processor, on the client's instructions, and would not analyse it separately.

4. Where we obtain data from

We obtain data from the following sources:

• directly from you - when you register, use the Service, upload documents and change account settings;
• by email - when you or senders you designate forward documents to the Service email address assigned to your organization, we receive the whole message: the sender's address and name, the subject and the attachments;
• from identity providers - when you sign in with a Google or Apple account, we receive only the identifiers needed for sign-in (email address, name, provider account identifier);
• from public registries - the Register Centre JAR open data (company names, codes, addresses, statuses), the STI VAT payer register, the VIES VAT validation service, and Bank of Lithuania / European Central Bank exchange rates - to resolve and verify counterparty identities;
• from systems you connect - when you configure an export or dictionary import from your accounting system, data is transferred on your behalf using your API keys.

5. Counterparty master-data database

To provide the Service we maintain a shared database of counterparty master data. It holds data of legal entities only: public registry data and the names, codes, VAT codes, addresses and bank accounts of legal entities seen in documents.

As a controller, we use this database to: (a) resolve and verify counterparty identities against the registries; (b) ensure data quality (one record per legal entity, without duplicates); (c) prevent fraud - for example, when the bank account stated in a legal entity's document differs from those seen before or is already linked to another legal entity, we raise a warning.

The legal basis is legitimate interests (GDPR Art. 6(1)(f)). The interests are balanced as follows: the database holds only general master data of legal entities; document content (amounts, line items, document files) is never shared between organizations and stays within each organization's environment; records of natural persons (including sole traders) taken from documents are never placed in the shared database - they are visible only to the organization whose documents mention them and are deleted together with that organization's data; public registry entries about natural persons (for example, in the VAT payer register) are used only for verification and are never searchable; organization-specific counterparty settings are visible only to that organization.

Public registry data is refreshed as the registries publish updates. Legal-entity records in the shared database are not deleted when one client stops using the Service: they are not that client's document content and describe legal entities.

6. To whom we disclose data

We disclose data only to:

• sub-processors that provide services necessary for the Service on our behalf - the list, with the categories of data they process and transfer safeguards, is published in the Sub-processor list;
• recipients designated by the client - when exporting processed data to the accounting systems the client has connected (for example, Rivile), on the client's instructions and using the client's API keys;
• law enforcement bodies, courts, bailiffs, notaries or supervisory authorities (for example, VDAI), where applicable law so requires;
• our employees - only in the cases and under the conditions set out in section 10 (to provide support, fix a fault or keep the Service secure).

We do not sell personal data or disclose it to third parties for their marketing purposes.

7. International data transfers

The core Service infrastructure is located in the European Union: application and database hosting and transactional email delivery are in Germany, and uploaded document storage is in an EU data centre.

We transfer data outside the EU only to the following providers:

• OpenAI (USA) - to recognize document page images and extract fields using AI models, and to map text to accounting codes. The transfer relies on the provider's Data Processing Agreement (DPA) and the EU Standard Contractual Clauses (SCCs); under the provider's terms, transferred data is not used for model training. In interactive processing, transferred data is retained by the provider for no longer than 30 days (for abuse prevention) and is then deleted; in the economy (deferred processing) tier, request files are retained in the provider's infrastructure for up to 30 days after processing and are then deleted.
• Cloudflare (USA) - to deliver document links (including edge caching), for DNS, and to receive inbound email (the documents-by-email feature). The transfer relies on the provider's DPA and the EU-US Data Privacy Framework (DPF); document files are cached at the edge location serving the request, typically in the EU.
• Google and Apple (USA) - only to authenticate sign-in; only sign-in identifiers are transferred. The transfer relies on the DPF.

Detailed information about each transfer is provided in the Sub-processor list.

8. Retention periods

We keep data only as long as required by the purpose of processing, the legal basis and applicable law:

• Account data - for as long as the account exists; deleted immediately upon account deletion (except billing records).
• Document content and originals - for the duration of the Service. For 30 days after the service contract ends or is terminated, the client can request an export of its data, which we provide as a downloadable archive via a link; when those 30 days end, we delete the client's documents and data. Where the client only used the trial volume and concluded no service contract, the same 30-day period runs from the client's deletion request. Data may remain in backups until the backup rotation completes (no longer than 35 days).
• Counterparty master data - registry data is refreshed on the registries' publication cycle; legal-entity records in the shared database are kept for as long as they are needed for the purposes in section 5 and are not deleted when one client stops using the Service; records of natural persons taken from documents are kept only within the environment of the organization whose documents mention them and are deleted together with that organization's data.
• Audit and technical logs - audit log entries are kept for 7 days or for the period agreed in the service contract; server technical logs for up to 30 days.
• Billing data (issued invoices, payment records) - 10 years under the Law on Accounting.
• Economy-tier processing files in OpenAI's infrastructure - up to 30 days after processing (see section 7).

9. Your rights

You have the right to access your data, to request its rectification or erasure, to restrict its processing, to object to processing, and to receive your data in a structured, commonly used format (GDPR Arts. 15-22).

Submit requests to [email protected]. We respond within one month of receiving the request; in complex cases we may extend this period by up to two additional months and will inform you of the extension.

For data contained in document content (where we act as a processor), please contact your accounting firm or its client company - the data controller; when the controller handles your request, we provide it with all necessary assistance under the Data Processing Agreement.

We make no decisions with legal or similarly significant effect solely by automated means: every document is confirmed by the client's user.

If you believe your data is processed unlawfully, you have the right to lodge a complaint with the State Data Protection Inspectorate (vdai.lrv.lt) or a court.

10. Data security

We apply appropriate technical and organizational measures (GDPR Art. 32): data is encrypted in transit (TLS); each organization can access its data only through tenant-scope isolation (every query is scoped to the organization); accounting system access keys are encrypted with AES-256-GCM; the document storage is private; access is granted by role; significant actions are recorded in the audit log.

A document original is reachable only through a link containing a random, unguessable token. Anyone holding such a link can open the file without signing in. At the client's instruction the link is embedded in exports to the client's accounting system, so the original can be opened straight from it. The link stops working when the document is deleted; because of edge caching the file may remain reachable for up to 24 hours longer.

We access a client's data only where needed to provide support, fix a fault or keep the Service secure. We ask the client's permission first, except where urgent action is needed to protect security or data integrity or where the law requires it - in those cases we inform the client afterwards. Our staff are bound by confidentiality.

11. Cookies

While using the Service we store only strictly necessary and functional cookies in your browser:

• session cookies (authentication) - strictly necessary, valid for up to 90 days;
• the language preference cookie - necessary to display the site in your chosen language;
• the appearance preference cookie - functional, stores your chosen theme.

We use no analytics, marketing, advertising or behavioural tracking cookies - neither our own nor third parties'. No third-party tracking tools are embedded in the site.

You can delete cookies at any time in your browser settings; deleting the session cookie will sign you out of your account.

12. Minors

The Service is intended for businesses and their employees; we do not provide it to persons under 18 and do not knowingly process such persons' data.

13. Changes

We may update this policy. We inform about material changes by email and/or in the application no later than 30 days in advance. By continuing to use the Service after the changes take effect, you confirm that you accept the updated policy. Copies of previous versions are provided on request ([email protected]).

This policy is provided in Lithuanian and English; in the event of any discrepancy, the Lithuanian version prevails.

14. Contact

UAB Codus, company code 306635689, registered office Sakalaičių Sodų 5-oji g. 6, LT-02216 Vilnius. Privacy contact: [email protected].