pinigo

Privacy policy

Draft – to be reviewed by a lawyer before launch. This text is not yet a binding privacy policy. Details in square brackets will be filled in before launch.

Updated: 2026-10-27

1. Who processes your data

Pinigo is provided by, and the data controller is, [Company name, registration code, address] ("we"). Data protection contact: [email address].

When you use Pinigo to store data about your clients, suppliers or staff (for example on invoices), you are the controller of that data and we process it on your behalf as a processor. A data processing agreement (DPA) will be available before launch.

2. What we store

  • Account: name, email address, phone number (if you provide it), a password hash (never the password itself), language preference, two-factor authentication and passkey data if you enable them.
  • Company details: legal form (IV, VL or MB), name, registration code, VAT code, address, contacts, bank account, individual activity certificate or business certificate details, tax profile settings, and a logo and stamp if you upload them.
  • Clients and suppliers: their details and contacts that you enter or fill in from the Lithuanian Register of Legal Entities open data and the EU VIES.
  • Documents: invoices, proforma invoices, credit notes and proposals, their lines, payments, when they were sent and viewed, and the client's response to a proposal.
  • Expenses and uploads: expense records and uploaded photos or PDFs of documents.
  • Company members: email addresses and roles (for example accountant) of the people you invite.
  • Technical data and logs: sign-in sessions (IP address, browser identifier), an activity log (who changed a document and when), error and security logs.

We do not store payment card details. When payments are introduced they will be handled by the payment partner (planned: Paysera).

3. Why we process data

  • Providing the service (performance of a contract): your account, preparing documents, sending PDFs and emails, tax estimates, exports.
  • Security and abuse prevention (legitimate interest): sign-in throttling, logs, backups.
  • Legal obligations: data we must keep by law.
  • Improving the service (legitimate interest): aggregated usage statistics, not at the level of individuals. We do not use advertising cookies.

4. Who we share data with

  • Hosting and infrastructure providers. Production hosting is planned in the European Union; the provider will be named before launch: [hosting provider].
  • The email delivery provider when you send documents or receive notifications: [email provider].
  • The EU VIES system when you check a VAT code (only the code being checked is sent).
  • Recipients you choose: the clients you send documents to and the members you invite to your company.

We do not sell data or share it for advertising.

5. How long we keep data

  • Account and company data – while you use the service. After you delete your account, data is deleted within [period], except backups, which are overwritten within [period].
  • You are responsible for keeping accounting documents for the period required by law (for example 10 years for VAT invoices). Download an export before deleting your account.
  • Technical logs – no longer than [period].

6. Your rights

Under the GDPR you may request access to, correction or deletion of your data, restriction of processing, object to processing and receive your data in a portable format. Some of this you can do yourself: edit your data in the settings, export documents, payments and expenses as CSV and a PDF archive, and delete your account in the profile settings. Otherwise write to [email address].

If you believe your data is processed unlawfully, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

7. Cookies

We only use necessary cookies: the session, CSRF protection, and your language and appearance (light or dark theme) settings. We do not use analytics or advertising cookies. If that changes, we will let you know and ask for consent.

8. Security

Data is transferred over an encrypted connection (HTTPS), passwords are stored as hashes, and uploaded files are stored privately and are only available to company members. You can enable two-factor authentication or sign in with a passkey.

9. Changes

We will notify you of material changes to this policy by email or in the service before they take effect.