Invly Privacy Policy

Effective date: 2026-05-28 Version: 1.4 (2026-09-09) Data controller: Rev Tech MB (registration code 307780627), registered office Vilnius, V. Nagevičiaus g. 3, LT-08237, email info@invly.lt.

The Lithuanian-language version of this policy is authoritative for data subjects residing in Lithuania; this English version is provided as a reference translation.

1. Scope

This privacy policy explains how Rev Tech MB ("we", "Invly") processes personal data when you use the invoice management platform at www.invly.lt and related services. The policy implements Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Lithuanian Law on the Legal Protection of Personal Data.

2. What we collect

2.1. Account data

• Email (required — used for login and communications)
• Password (stored as a hash via Supabase Auth — we cannot see it)

2.2. Business profile data (optionally provided)

• Company name, registration code, VAT code
• Address
• IBAN and bank name
• Phone number
• Logo (if uploaded)

2.3. Operational data (created while using the platform)

• Invoices, line items, dates, amounts, statuses
• Client and product catalog entries — note: when these include your clients' personal data, see section 8 on your obligations as a data controller
• Expense records and uploaded documents
• Recurring-invoice and template configurations

2.4. Payment data

Subscription payments are processed by Stripe Payments Europe, Ltd. We do not store your card number or CVV — only a Stripe customer identifier, subscription status, and period-end date. See Stripe's privacy notice: https://stripe.com/privacy.

2.5. Technical data

• IP address, browser type, language (in server logs at Supabase and Vercel)
• Login timestamps
• Audit-log records of in-app actions (invoice created, client deleted, etc.)

2.6. AI feature data

When you use an AI feature — invoice generation from prose, receipt and invoice recognition from a photo or PDF, bank-statement recognition, tax-report preparation, or the AI accountant chat — the relevant text or document is transmitted to OpenAI (USA). We do not pass account identifiers — only the content of your request. OpenAI commits not to train models on data submitted through its API (see https://openai.com/policies/api-data-usage-policies).

2.7. Employee data (uploaded by you as an employer)

If you use the employee register and payroll calculation, you upload your employees' data to Invly:

• First and last name
• Job title
• Employment contract start and end dates, full-time-equivalent share
• Monthly gross salary under the contract
• Whether the tax-free allowance (NPD) applies and whether the employee takes part in pension accumulation
• IBAN for salary transfers (optional)
• Personal identification number and occupation code (LPK), if you prepare Sodra and tax authority filing files (optional, see below)
• The monthly payslips and payroll sheets calculated from this data and approved by you

An employee's personal identification number is stored only for filings. Sodra notices (SAM, 1-SD, 2-SD, 9-SD) and tax authority returns (GPM313, GPM312) are invalid without it, so you may enter it in the register. The field is optional: without it the register and payslips work, and filing files are simply not generated. The number is shown only to you and the accountant you authorised, never reaches AI features (2.6) or emails, and is kept for the same period as other employee data (section 3).

For this data you are the data controller and Invly is the processor (see section 8). Employee data is never passed to AI features (2.6). If you have granted your accountant access through the accountant portal, they can view the employee register.

3. Purposes and legal basis

4. Recipients and sub-processors

As of 2026-05-28:

The Enable Banking row is not active yet. The direct bank connection is not switched on in production, so no data reaches this sub-processor. We list it in advance so it is published before it starts operating. Its exact legal entity, seat and transfer mechanism will be stated here before it is switched on.

PostHog, Meta and Google Ads only run if you chose "Accept" in the cookie banner. If you chose "Essential only" they are never loaded and no data is sent to them. You can withdraw consent at any time in the cookie settings.

We will notify you at least 30 days before adding a new sub-processor, in-app or by email. If you do not consent, you may terminate the service.

We do not sell or share your personal data with third parties for marketing.

5. International transfers

Where data is transferred to sub-processors in or transferring to the United States (Vercel, Resend, OpenAI, Meta Platforms, Google), transfers are governed by Standard Contractual Clauses approved by the European Commission, together with supplementary technical measures (TLS in transit, encryption at rest where applicable).

6. Your rights (GDPR Articles 15-22)

You have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16) — most fields are editable in your account settings
• Erase your data ("right to be forgotten", Art. 17) — note that accounting records are retained for 10 years per Lithuanian law
• Restrict processing (Art. 18)
• Data portability (Art. 20) — exportable via CSV and PDF
• Object to processing where based on legitimate interest (Art. 21)
• Withdraw consent at any time where consent is the basis
• Lodge a complaint with the supervisory authority — the State Data Protection Inspectorate of the Republic of Lithuania (L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, https://vdai.lrv.lt)

To exercise these rights, contact info@invly.lt or info@invly.lt. We respond within 30 days of receipt (extensible by 60 days for complex requests).

7. Security

• TLS 1.2+ for all traffic
• Postgres with Row-Level Security: users see only their own data
• Passwords stored as bcrypt hashes (Supabase Auth)
• Production access is restricted and logged
• Regular backups (managed by Supabase)

Security incidents are reported to the supervisory authority within 72 hours of discovery (GDPR Art. 33) and directly to affected data subjects where the incident poses a high risk to their rights (Art. 34).

8. Your obligations as a data controller

When you upload your clients' personal data (e.g. their email or company code on an invoice), you are the data controller for that data and Invly is the processor. A separate Data Processing Agreement (DPA) is available on request at info@invly.lt.

The same applies to employee data (2.7): as the employer you are the controller of your employees' data, and Invly processes it only on your instructions, only for payroll calculation and only to the extent the service requires. You are responsible for informing your employees about the processing and for the statutory retention of payroll records.

9. Cookies

We use only strictly necessary cookies for session management. See cookie-policy-en.md.

10. Children

Invly is not directed at persons under 16 and we do not knowingly collect their data. If you become aware that a minor has provided data, please notify info@invly.lt.

11. Changes to this policy

Material changes will be posted to https://www.invly.lt/privacy and, when necessary, emailed to users at least 30 days before they take effect.

12. Contact

• Controller: Rev Tech MB
• Address: Vilnius, V. Nagevičiaus g. 3, LT-08237
• Email: info@invly.lt
• Data Protection contact: info@invly.lt

In case of conflict in interpretation, the Lithuanian version of this policy prevails for data subjects resident in the Republic of Lithuania.