Privacy Policy — Paperwork

1. Data Controller

The data controller of your personal data is the service provider: Kęstutis Skrebė (email: paperwork@mintedmind.eu). The service is currently provided by a natural person operating under an individual activity certificate. Individual activity certificate No. 1540135.

2. What Data Is Collected and Processed

Depending on how you use the system, we process the following categories of data:

Account details: your name, email address, password hash, company or sole proprietorship details (name, company code, VAT code, address, bank account number (IBAN), bank name).
Client details: details you enter about your clients — name, company name, email address, phone number, work site address or billing address.
Document and contract data: estimates, service agreements/contracts, completion certificates, VAT invoices, service descriptions, amounts, dates, terms, and notes.
Signing and audit trail data: electronic signature image or Dokobit qualified e-signature data, signing timestamp, signer's IP address, and browser User-Agent string, required to ensure legal enforceability and auditability.
Expense receipts and invoices: photos or PDF files of receipts uploaded for automatic Optical Character Recognition (OCR) and expense tracking.

3. Purposes and Legal Bases for Processing

Data is processed under the following legal bases pursuant to the GDPR:

Service provision and contract performance (GDPR Art. 6(1)(b)) — account management, document generation, sending signing links, and enabling core platform features.
Compliance with legal obligations (GDPR Art. 6(1)(c)) — accounting, tax, and record-keeping statutory obligations.
Legitimate interests (GDPR Art. 6(1)(f)) — maintaining system security, fraud and abuse prevention, improving services, and legal defense.

4. Data Retention Period

Active account data is stored for the duration of the subscription. Upon account deletion or termination of services, data is retained for the period mandated by applicable law (e.g. 10 years for statutory accounting documents). After statutory retention periods expire, data is securely deleted or permanently anonymized.

5. Data Transfers to Third Parties

Data is only transferred to trusted data processors providing essential infrastructure: cloud hosting providers (located within the European Union), qualified e-signature providers (Dokobit / Signicat), banking/payment processors (Paysera) for payment reconciliation, and our own self-operated AI/OCR server (part of our own infrastructure, processing uploaded receipts and invoices for automatic text recognition). Optional AI features (reminder drafts, text translation) use an AI language model provider (OpenAI, USA), which may process data outside the EU/EEA under its own data processing terms. In all other cases data is never transferred outside the EU/EEA, and no data is ever sold or shared for advertising purposes.

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of access: request information about and copies of your processed personal data.
Right to data portability: download all your account data in JSON format at any time using the self-service button on your profile page ("Download my data").
Right to rectification: request correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") or restriction of processing, subject to statutory retention obligations.
Right to lodge a complaint with the relevant Data Protection Authority (in Lithuania: VDAI) if you believe your data is processed unlawfully.

7. Contact Us

If you have questions regarding personal data processing or wish to exercise your rights, contact us at: paperwork@mintedmind.eu.