Privacy Policy

Last updated: 2026-08-30

This Privacy Policy explains how Nordlet ("Nordlet", "we", "us") handles personal data when you visit nordlet.com, use the application at app.nordlet.com, call the API at api.nordlet.com, or contact us. It is written to meet the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Controller: Nordlet, Republic of Estonia.

1. Two roles: controller and processor

Nordlet acts in two different roles, and this policy covers only the first.

• Controller. For the data we collect about you as a user of the website and the application — your account, your sign-in activity, your billing, your support requests — Nordlet decides why and how the data is processed. This policy describes that processing.
• Processor. For the data that you and your users enter into the application or send to the API — invoices, partner contact details, employee and payroll data, bank transactions, scanned documents — the business that owns the account is the controller and Nordlet processes it only on that business's instructions. That processing is governed by the Data Processing Agreement. If you are an employee, customer or supplier of a business that uses Nordlet and want to exercise your rights over data that business holds about you, contact that business.

2. What data we collect and why

Data	Where it comes from	Why we process it	Legal basis (GDPR art. 6)
Email address, name, preferred language	You, when you request a sign-in link or accept an invitation	To create and operate your account, send one-time sign-in links, and show the application in your language	Performance of the contract (6.1.b)
Sign-in link tokens, session tokens, time of sign-in	Generated by the service	To authenticate you; tokens are stored only as hashes	Performance of the contract (6.1.b)
Company details you register (name, code, VAT number, country)	You	To operate the company workspace and issue our invoices to the right entity	Performance of the contract (6.1.b)
Billing records: credit purchases, nightly usage deductions, invoices, VAT status	You and Stripe	To charge for the service, to issue invoices, and to keep the accounting records the law requires of us	Contract (6.1.b); legal obligation (6.1.c)
Payment card or bank details	You, entered on Stripe's checkout page	To take payment. Nordlet never sees the full card number; Stripe stores it	Contract (6.1.b)
Usage metering: number of API requests, pages scanned, storage used, per company and day	Generated by the service	To calculate charges and enforce plan limits	Contract (6.1.b)
Audit log: who did what and when inside a company	Generated by the service	To give you an immutable record of changes to accounting data, and to investigate security incidents	Contract (6.1.b); legitimate interest in security (6.1.f)
Server logs: IP address, request path, user agent, timestamps, error details	Your browser or API client	To keep the service running, detect abuse, rate-limit, and debug failures	Legitimate interest in security and reliability (6.1.f)
Emails and messages you send us	You	To answer you	Legitimate interest in handling requests (6.1.f)
Content you post on the public issue tracker	You, on GitHub	To provide support. Note that this tracker is public and operated by GitHub under its own terms	Legitimate interest (6.1.f)

We do not collect data for advertising, and we do not sell personal data.

3. Cookies

The application sets two cookies:

• a session cookie that keeps you signed in for up to 30 days; it is HTTP-only and is not readable by scripts;
• a language cookie (NEXT_LOCALE) that remembers which language you chose, for up to one year.

Both are strictly necessary for the application to work, so no consent banner is shown. The website and the application do not use analytics, tracking or advertising cookies. Stripe's checkout page, which you open when buying credits, sets its own cookies under Stripe's privacy policy.

4. Who receives personal data

We share personal data only with providers that help us run the service, and only the data each one needs:

Recipient	Purpose	Location
Amazon Web Services EMEA SARL	Hosting of the web application, storage of uploaded files, delivery of transactional email	European Union
Stripe Payments Europe, Ltd.	Payment processing, VAT calculation at checkout, invoices for credit purchases	Ireland; card data may be processed by Stripe, Inc. in the United States under Stripe's own safeguards
Resend, Inc.	Delivery of transactional email (sign-in links, invitations, notifications), where configured instead of Amazon SES	United States, with EU data-hosting where enabled
Mistral AI	Optical character recognition of documents you upload for scanning. Only the uploaded document is sent, and only when you use the scanning feature	France
Enable Banking Oy	Retrieving bank transactions from banks you connect. Only when you connect a bank account	Finland
The Peppol access point configured for your company	Sending and receiving e-invoices. Only when you enable e-invoicing	Depends on the provider
European Commission (VIES)	Validating VAT numbers you enter. Only the VAT number is sent	European Union
GitHub, Inc.	Public issue tracker used for support	United States

We may also disclose personal data where the law requires it, to a court or authority with a valid request, or to a buyer of the business that operates Nordlet, who would then be bound by this policy.

5. Transfers outside the European Economic Area

Our servers and database are in the European Union. Where a provider in the table above processes data outside the EEA (Stripe, Inc., Resend, GitHub), the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses approved by the Commission. You can ask us for a copy of the safeguards in place.

6. How long we keep data

Data	Retention
Account and company data	While the account exists. An account that never buys credits is deleted 30 days after its trial ends. A deleted company can be restored for 10 days, then it is permanently removed. After an account is deleted or the contract ends, remaining data is deleted within 30 days
Sign-in link tokens	15 minutes, or until used
Session tokens	Up to 30 days, or until you log out
Billing records and our invoices to you	10 years from the end of the financial year, as Lithuanian accounting law requires
Server logs	90 days
Audit log	As long as the company workspace exists
Emails you send us	2 years after the matter is closed
Backups	Overwritten in the ordinary backup cycle, at most 35 days after the data was deleted from the live system

7. Your rights

Under the GDPR you may ask us to:

• tell you what personal data we hold about you and give you a copy (access);
• correct inaccurate data (rectification);
• delete your data (erasure), subject to the retention obligations above;
• restrict how we use it in certain cases;
• give you your data in a machine-readable format (portability) — the API and the export functions of the application already provide this for all data you entered;
• stop processing based on legitimate interest (objection).

Write to info@nordlet.com from the email address of your account, or tell us how we can verify who you are. We answer within one month. If you think we handle your data unlawfully you can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the supervisory authority of the EU country where you live or work.

8. Security

All traffic to the website, the application and the API is encrypted with TLS. Sign-in links, sessions, invitations and API keys are stored as hashes, so a copy of the database does not reveal them. Each company's data is isolated by row-level security rules enforced inside the database, so an API key of one company cannot read another company's rows. Uploaded files are stored encrypted at rest. Access by Nordlet staff is limited to what is needed to operate the service and is logged. If a security breach affects your personal data and is likely to result in a high risk to you, we will tell you without undue delay, as the GDPR requires.

9. Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. Nightly billing, rate limiting and the suspension of accounts with no credits are contractual rules applied mechanically, not profiling.

10. Children

The service is for businesses. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

When we change this policy we update the "Last updated" date above. For changes that reduce your rights or add new purposes we will email account owners at least 30 days in advance.

12. Contact

Nordlet, Republic of Lithuania — info@nordlet.com.