DRAFT — REQUIRES LEGAL REVIEW
This is not a signed agreement, not legal advice, and not a certification.
It does not apply until both parties sign a copy that counsel has reviewed.
Placeholders in square brackets are empty on purpose.
On 17 October 2026 the operator confirmed, from the Mistral admin privacy page, that the switch "use API calls to train Mistral models" is disabled and that Labs models are disabled. That training opt-out is active. Zero Data Retention has not been requested. This page does not treat it as active.

DATA PROCESSING AGREEMENT
Article 28 of Regulation (EU) 2016/679 (GDPR)
Draft template for VectorInvoice

1. Parties
Controller: [LEGAL_NAME], [ADDRESS], registration or activity-certificate number [REGISTRATION_CODE], email [EMAIL].
Processor: Alexander Mauz, individual activity (individuali veikla) in Lithuania, VAT-registered.
The postal address, individual-activity certificate number, VAT code, and email are not published in this draft. The exact name on the certificate is not copied here.
Date: [DATE]
Signatures: [SIGNATURE] — blank. This file is not signed.

2. Subject
The processor hosts VectorInvoice and stores the controller's account data, receipt images, and invoice fields so the controller can review them and download files. Team members, if the controller invites them, upload and review receipts inside that workspace.

3. Duration
From [START_DATE] until the service ends, plus the retention window in section 10. The application's retention window defaults to 10 years. Counsel has not confirmed the period and which fields a legal hold requires. The number is configuration, not a statement of the statute.

4. Nature and purpose
Processing is limited to storage, display to the controller's users, extraction of invoice fields when a Mistral key is configured, preparation of download files, and support access only after the controller grants it.
The application refuses an internal purpose named "training". Separately, the operator confirmed on 17 October 2026 that Mistral's switch "use API calls to train Mistral models" is disabled and that Labs models are disabled. That confirmation does not turn on Zero Data Retention.
Nothing in the application is sent to the Lithuanian tax authority (VMI) by this service.

5. Types of data
Account email and name. Receipt images. Supplier names, VAT codes, invoice numbers, dates, and amounts. Buyer name, buyer code, and buyer email on a sales invoice. Team invite emails and review comments.
VAT codes, addresses, IBANs, buyer codes, buyer emails, and the receipt file are encrypted at rest as described in section 7. Supplier names, invoice numbers, amounts, buyer names, and line descriptions are stored in the clear so the review screen can search them.
No payment-card number is processed. The plan name and a billing-status label are stored. No payment provider is connected.

6. People the data is about
The controller's users, people the controller invites to a team, and people named on receipts or invoices the controller uploads. The processor does not decide that list.

7. Measures that exist in this service
The description matches the code. It is not a certificate. Details of the measures are in the operator's technical records.
- AES-256-GCM for the fields and files named in section 5, with a per-taxpayer data key wrapped by a master key. A cloud KMS is not wired. The blueprint stores the master key as an environment variable.
- Passwords stored with Argon2id. Session cookies are httpOnly (except the CSRF cookie), SameSite=Strict, and Secure when the deployment turns that flag on.
- CSRF: unsafe requests must send the token from the vi_csrf cookie.
- Authenticator-app codes (TOTP) and one-time recovery codes. Email one-time codes for login are optional and are not accepted while an authenticator is enrolled. Administrators must enrol an authenticator unless the deployment turns that rule off. This deployment turns it off.
- Deletion from Settings asks for the password again and a one-time email code, then one of DELETE_FILES, DELETE_DATA, or DELETE. The email code is delivered to an inbox only when mail sending exists. Mail sending is not configured. A mail host, its country, and its data-processing terms are not published in this draft.
- Rate limits inside one server process. They are not shared across every instance.
- An append-only audit log that does not store email addresses, amounts, or free text.
- A signed-in JSON export.
- The encrypted receipt is also stored in the database row, because the free Render disk is wiped on restart. There is no backup job and no tested restore in this service. Whether the Render plan keeps backups has not been confirmed here. Deletion does not erase provider backups.
Antivirus scanning does nothing until a scanner is configured. A customer-facing mailer for the deletion code is not configured.

8. Subprocessors
The public list is the page /subprocessors. As of this draft the code can send personal data to:
- Render Services, Inc., 525 Brannan St, San Francisco, CA 94131, United States. The published blueprint uses region Oregon for the site, the API, Postgres, and Redis. Redis persistence is off. DPA published at https://render.com/dpa — acceptance is not recorded in this draft. The addendum describes EU standard contractual clauses for a transfer outside the EEA. This draft does not claim they have been signed for this deployment.
- Mistral AI, 15 rue des Halles, 75001 Paris, France, only when an API key is set. The code calls https://api.eu.mistral.ai for OCR, chat completions, and speech-to-text. It refuses api.us.mistral.ai, the global host api.mistral.ai, and the files and agents APIs. DPA published at https://legal.mistral.ai/terms/data-processing-addendum/ — acceptance is not recorded in this draft. The training opt-out is active on the confirmation in the header. Zero Data Retention is a separate setting and has not been requested. This draft does not treat it as active. Mistral documents that account and billing metadata may be processed outside the EU inference region.
- The European Commission's VIES service, when a VAT number is looked up and the lookup is not switched off. No signed DPA is published on this site. Counsel has not classified this lookup on this page.
- The open data set at get.data.gov.lt for a Lithuanian company code, under the same switch. The same classification is not published on this page.
No analytics vendor and no payment vendor is connected.
Notice to the controller before a new subprocessor is added is described here as publishing the name on the public page. It is not a signed notice period.

9. Transfers
The published deployment sets the region to Oregon, United States, not to an EU region. Render documents a Frankfurt region. This blueprint does not use it.
Render's transfer terms have not been accepted in this draft, and whether production moves to an EU region is not decided here. This draft does not invent a transfer mechanism beyond what Render's published addendum describes.

10. Deletion and return
Settings can export JSON, delete stored files, delete stored records, or delete the account. Account deletion anonymises the login and removes sessions and second-factor secrets.
A record inside the configured retention window may be kept as a reduced row: period, direction, document number, date, and amounts. Not the file, the name, the address, or the notes. The default window is 10 years and is marked for legal confirmation.
Not removed by the button: provider database backups, disk snapshots, unused database space, email already sent, and the append-only audit log.
Return of data is the export. A contact address for a request that does not come through the screen is not published in this draft.

11. Breach
The processor tells the controller without undue delay after becoming aware of a personal-data breach, so the controller can notify its authority. Where the processor is itself the controller, the Lithuanian authority is the State Data Protection Inspectorate (VDAI), and the notice period in Article 33 is 72 hours. The processor follows a documented breach procedure. The operator's phone and email for that notice are not published in this draft.

12. Audits
The controller may ask for the description in section 7. This draft does not grant a right to an on-site audit and does not claim an external penetration test has been done.
Whether to offer a planned audit and an external test is not decided in this draft.

13. Signatures
Controller signatory [SIGNATORY_NAME], place [PLACE], date [DATE], signature [SIGNATURE].
Processor signatory [PROCESSOR_SIGNATORY_NAME], place [PLACE], date [DATE], signature [SIGNATURE].

End of draft. Do not treat this file as signed, as a policy, or as a certification.