VectorInvoiceArticle 28
Data processing agreement
A draft for GDPR Article 28. It is not signed and it is not legal advice. Names, addresses, and signatures are blank on purpose. On 17 October 2026 the operator confirmed, from the Mistral admin privacy page, that the switch "use API calls to train Mistral models" is disabled and that Labs models are disabled. That training opt-out is active. Zero Data Retention has not been requested. This page does not treat it as active.
Parties. The customer is the controller of invoice content. The processor named in this draft is Alexander Mauz, individual activity (individuali veikla) in Lithuania, VAT-registered. The postal address, certificate number, VAT code, and email are not published on this page. The exact name on the certificate is not copied here.
Subject matter. Hosting the account, the receipt files, the review, and the files the customer downloads. Team members the customer invites upload and review receipts in that workspace.
Duration. For as long as the account exists, and afterwards only for the retention window in the application (default 10 years). Counsel has not confirmed the period on this page. The number is configuration, not a statement of the statute.
Data. Account email and name, receipt images, invoice fields, and the files the customer generates. VAT codes, addresses, IBANs, and the receipt file are encrypted. Supplier names, invoice numbers, and amounts are stored in the clear. No payment-card number is stored.
Processor duties. Process on the customer's instructions, refuse an internal purpose named training, and tell the customer about a personal-data breach without undue delay. This deployment runs in Oregon, United States, not in the EU. The transfer terms, and any move to an EU region, are not decided on this page.
Subprocessors the code can call: Render in Oregon, Mistral at api.eu.mistral.ai when a key is set, the European Commission VIES service, and get.data.gov.lt. The training opt-out described above is active. Zero Data Retention has not been requested. This page does not treat it as active. The public list is the subprocessors page. No analytics vendor and no payment vendor is connected.
End of service. Export and deletion are in Settings. Deletion asks for the password and a one-time email code. That code is not delivered to an inbox until mail sending exists. This page does not replace a signed Article 28 contract.