Privacy Policy
- Last updated
- 4 September 2026
1. Who we are
kvitas.app is a service operated by UAB Backoffice Solutions, the same company that operates backoffice.lt. We are the controller of your personal data.
UAB Backoffice Solutions Company code: 307630360 Address: Švitrigailos g. 11K-109, LT-03228 Vilnius, Lithuania Email: privacy@backoffice.lt
This policy explains what data we collect when you use kvitas.app, why we process it, and what rights you have under the General Data Protection Regulation (GDPR). It covers the kvitas.app service only. The Backoffice platform has its own separate policy published on backoffice.lt.
2. How the service works
You photograph a cash receipt. We read the receipt details from the photograph, meaning the receipt number, the date and the total. We then contact that retailer’s own public self-service portal on your behalf and request a VAT invoice. We deliver the resulting PDF to you in the way you have chosen.
The service is built for businesses that want to reclaim VAT and document their expenses properly.
3. What data we process
Account data. Your email address. If you sign in with a Google account, also your name and profile picture.
Company data. Your Lithuanian company code. The company name and address come back from the retailer’s own portal, which reads them from the public register, so we do not collect or verify them separately.
Receipt data. The photograph, the details read from it, meaning the receipt number, the date and the total, and the resulting VAT invoice in PDF form.
Delivery data. The email addresses we send documents to. If you connect Google Drive or Dropbox, also the folder identifier.
Technical data. Request metadata, the approximate country determined at the network edge, and error diagnostics. We do not store your full IP address in application logs.
4. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Converting a receipt into a VAT invoice and delivering the document | Performance of a contract |
| Managing your account and supporting you | Performance of a contract |
| Security, abuse prevention and improving the service | Legitimate interest |
| Marketing messages | Consent |
| Connecting a Google Drive or Dropbox account | Consent |
| Keeping accounting records | Legal obligation |
5. Sharing data with retailers
To obtain the VAT invoice, we transmit the receipt details and your company code to the retailer whose receipt you submitted, for example Maxima, IKI or Rimi.
The retailer issues the invoice itself, so for that transaction it acts as an independent controller. This means the retailer’s own privacy policy applies to its processing, not this one.
Without this transfer the service cannot work, because the invoice is legally issued by the retailer and not by us.
6. Service providers
We rely on a small number of service providers. They process data only on our instructions and only as far as the service requires.
| Service provider | What we use it for | When it applies | |
|---|---|---|---|
 | Google Cloud, europe-west3 region in Germany | Hosting, database, file storage and the Vertex AI model that reads the receipt photograph | Always |
 | Cloudflare | Content delivery, security filtering and the Turnstile abuse check. It does not store receipt content | Always |
 | Google Firebase | Signing in to your account | Always |
 | SparkPost | Sending and receiving email | Always |
 | Stripe | Payments. Card details never reach our systems | When you pay for the service |
 | Telegram | Receiving receipts through the chat bot. In that case the photograph passes through Telegram | Only if you use the bot |
  | Google Drive or Dropbox | Delivering documents into your folder | Only if you connect an account |
 | Microsoft OneDrive | Delivery of documents to your folder | Only if you connect an account |
7. How long we keep data
| Data | Retention period |
|---|---|
| Receipt photographs and invoice PDF files | 90 days after processing |
| Account data | While the account is open and for a reasonable period after it closes |
| Application logs | 30 days |
| Security logs | 90 days |
Invoices you have already exported to your email, Google Drive or Dropbox belong to you. These periods do not apply to them, because those documents live in your own space.
8. Where data is stored
All data is stored in the European Union. The servers, the database and the file storage run in the Google Cloud europe-west3 region in Germany.
Cloudflare processes requests at its network locations worldwide, but it does not store the content of receipt photographs or invoices.
9. Data security
Data is encrypted both in transit and at rest. Access to the production environment is limited to the people who need it for their work. Sign-in is handled by Google Firebase, so we do not store passwords ourselves.
No system is completely secure. If a data breach occurred, we would inform you and the supervisory authority as the law requires.
10. Cookies
On the marketing website we use Cloudflare Web Analytics. It sets no cookies and does not link your activity across different websites.
In the application itself we use only the cookies strictly necessary for sign-in and security.
We use no advertising or profiling cookies. That is precisely why you see no cookie consent banner. If this ever changes, we will update this policy and ask for your consent where required.
11. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it
- have inaccurate data corrected
- have your data erased
- restrict processing
- object to processing that is based on legitimate interest
- transfer your data to another service provider
- withdraw consent at any time. Withdrawal does not affect processing carried out before it
To exercise these rights, write to privacy@backoffice.lt. We will respond within one month at the latest.
If you believe your rights have been infringed, you have the right to lodge a complaint with the supervisory authority. In Lithuania this is the State Data Protection Inspectorate, Valstybinė duomenų apsaugos inspekcija.
12. Automated processing
An artificial intelligence model reads the receipt photograph and extracts the receipt number, the date and the total from the image.
This processing produces no legal effect on you and no other similarly significant effect. You can always correct the result by hand. We carry out no profiling and make no automated decisions about you.
13. Children’s privacy
The service is built for businesses. It is not directed at anyone under 16, and we do not knowingly collect their data.
14. Changes to this policy
When we update this policy, we will change the date at the top of the document. We will notify you of material changes by email or in the service itself.
15. Contact us
Questions about data protection and your rights: privacy@backoffice.lt
UAB Backoffice Solutions Švitrigailos g. 11K-109, LT-03228 Vilnius, Lithuania