Privacy policy

Updated: 2026-10-01

1. Who we are and our two roles

Numerio is operated by MB „Blue age lab", company registration number 306656523, VAT number LT100016571516, registered office at Saulėtekio al. 15-1, LT-10224 Vilnius, Lithuania (hereinafter — Numerio or we).

Numerio acts in two different roles:

• For your account, billing and website data, Numerio is the data controller — we decide why and how that data is processed.
• For the mailbox content, invoice data and bank-statement lines described in section 4, your business is the data controller and Numerio is the data processor. We process that data only on your instructions, under the Data Processing Agreement (DPA) published at /dpa. Section 4 still explains how we handle it, and section 4.4 explains who answers requests from people named in your documents.

To contact us about privacy matters:

• by email: hello@numerio.ai
• by phone: +370 5 208 0417

Numerio has not appointed a data protection officer. Our core activities do not involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data — the cases in which GDPR Article 37 requires one. The contact details above handle every privacy question.

2. Who this policy applies to

This policy describes how we process personal data:

• when you visit our website numerio.ai (website visitors);
• when you register for and use the Numerio service (registered users).

Real customer data is only connected after the data-processing terms have been expressly agreed with the individual customer (see the Data Processing Agreement).

Numerio is a business service. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

3. Data about website visitors

The numerio.ai website uses no tracking, analytics or marketing cookies. The only cookie it stores is the functional language-preference cookie numerio-lang: it is written only when you yourself click the language switcher; it holds nothing but the value lt or en; it lasts one year; and it contains no identifier by which you could be recognised or tracked. Such a cookie is strictly necessary to carry out a preference you have explicitly expressed, and therefore requires no separate consent under EU ePrivacy rules.

For traffic statistics we use Plausible (Plausible Insights OÜ), an EU-hosted, cookieless analytics service that does not identify any individual — which is why we show no cookie-consent banner on the website: none is needed.

If you write to us by email (hello@numerio.ai) or send an early-access request by email, we process the contact details you provide (name, email address, company name, message content) solely in order to answer your enquiry or consider your request.

Legal basis: our legitimate interest in answering enquiries and developing the service (GDPR Article 6(1)(f)).

4. Data about registered users

Providing your account data (name, email address, company details) is a contractual requirement: without it we cannot open a Numerio account for you. Connecting a mailbox and uploading bank statements are your choice: without them you can still hold an account, but the core features will not work.

When you register for Numerio, you create an account and can connect data sources. The categories of data processed are:

Just as important is what Numerio does not process:

• Numerio never connects directly to your bank account and takes no payment actions — we work only with the bank statement files you upload yourself.
• Numerio does not reach into your whole mailbox — access is read-only, and our system selects only invoice-related correspondence.

4.1 Mailbox access — how it works

• Access to Gmail is granted through Google OAuth, and access to Outlook through Microsoft OAuth and Graph. In both cases access is read-only — Numerio cannot send, delete or change your mail.
• Credentials (OAuth access and refresh tokens) are stored encrypted, are not accessible to unauthorised persons, and never appear in logs.
• You can disconnect a mailbox at any time in your account settings. When you do: no new mail checks are started; if the mailbox was Gmail, Numerio revokes its own access through Google (which invalidates the Google access token at the same time), and the local credential is deleted once the revocation is confirmed; if the mailbox was Outlook, Numerio deletes its stored credential and stops reading it. Microsoft does not offer Numerio a way to confirm remote revocation, so you can also revoke the app's access in your Microsoft account or organisation settings; data already collected into the Numerio system before disconnection (for example invoices already processed) continues to be retained under section 6.
• Unselected, non-invoice mail content is never stored as raw copies — Numerio does not accumulate an archive of your whole mailbox.

4.2 Automated extraction and human review

Invoice data is recognised by an automated system, but that system never makes the final decision without a human:

• Every extracted field is assigned a confidence level (low, medium, high).
• Low-confidence fields always require review; medium-confidence fields show a warning; and even high-confidence data becomes confirmed only when a person accepts it.
• No confidence level by itself generates or sends the accountant package — that is always done by a person, through a deliberate action.

This means that, for the purposes of GDPR Article 22, Numerio does not take decisions producing legal effects concerning you or similarly significantly affecting you based solely on automated processing — data extraction is an assistive tool, not a decision-making mechanism.

4.3 Google user data — Limited Use

Numerio’s use of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. Specifically, for data received through the Gmail API (scope gmail.readonly):

• We use it only to provide and improve the user-facing features described in this policy — detecting invoice-related emails, extracting invoice data, and matching invoices against payments — features you see in Numerio itself.
• We do not transfer it to anyone else, except: to sub-processors, to the extent necessary to provide or improve those same features (the full list is in the Data Processing Agreement, published at /dpa); for security purposes (for example to investigate abuse); where required by applicable law; or as part of a merger, acquisition or transfer of assets — in that last case only with your explicit prior consent.
• We do not sell it and we do not use it for advertising of any kind.
• No human reads this data, except: with your explicit, recorded consent (for example when you ask for help with a specific document); where necessary for security purposes; where required by applicable law; or where the data has been aggregated and anonymised and is used only for internal operations.
• We do not use it to create, improve or train any artificial-intelligence or machine-learning model — section 4.5 describes how automated extraction handles each document.
• These commitments also apply to our employees, contractors, agents and successors.

4.4 People named in your documents

Invoices and related emails often name people who are not Numerio users — a supplier's accountant, a sole trader, an employee in an email signature. Numerio processes their data only because it appears in a document your business received or uploaded, and only to extract the invoice fields described in section 4. For this data, your business is the data controller and Numerio is the data processor, acting on your instructions under the Data Processing Agreement. Such a person should therefore send any request about their data to your business. If they contact Numerio directly, we will refer them to you and help you answer, as set out in the Data Processing Agreement.

4.5 Automated processing and AI — the same rules for every source

The rules below apply equally to mail read from Gmail, mail read through Microsoft Graph when you connect Outlook, documents you upload yourself and the bank statement files you upload. Microsoft has no single named policy that matches Google's Limited Use requirements, so we state these rules here directly:

• We use the data only to provide and improve the features described in this policy — detecting invoice-related emails, extracting invoice data, and matching invoices against payments.
• We do not sell it and we do not use it for advertising of any kind.
• We do not use it to create, improve or train any artificial-intelligence or machine-learning model. Automated invoice extraction sends a document to the EU processing service described in section 7 to process a single request only — no model is trained on this data.
• No human reads it, except: with your explicit, recorded consent (for example when you ask for help with a specific document); where necessary for security purposes; where required by applicable law; or where the data has been aggregated and anonymised and is used only for internal operations.
• We share it only with the service providers described in section 8.
• These commitments also apply to our employees, contractors, agents and successors.

5. Purposes and legal bases of processing

6. Retention periods

• Original documents (received email attachments that became invoices in the Numerio system) are stored write-once and kept for the 10-year statutory retention period that applies to accounting documents. During that period the application, a user login and Numerio staff in normal operation cannot alter or delete them. Your company, as the data controller, holds the retention duty and decides; Numerio stores the originals as its processor.
• Once a workspace is deleted, the data extracted from the documents and the other data associated with the workspace is removed from the active system; what remains in backups is removed in line with our backup cycle. While a legal retention obligation applies, original documents stay stored read-only at no charge. Once your written retention instruction and applicable law permit deletion, we complete logged deletion within 30 calendar days.
• Credentials (OAuth access and refresh tokens) are kept only for as long as the source is connected, or while its disconnection is in progress — see section 4.1.
• Contact enquiries (section 3) are kept for as long as needed to deal with the enquiry, and no longer than 24 months.
• Billing data (section 4) is kept for 10 years from the end of the invoice year, in line with Lithuanian accounting-document retention rules, also after the workspace is deleted.

We confirm retention and deletion terms separately and explicitly with each customer before real company data is connected — you know these terms before any real data is processed.

7. Where data is stored

The documents and data Numerio stores and processes — original documents, the fields extracted from them and account information — are hosted in the European Union, using managed infrastructure services located in the EU. Data is encrypted both in transit and at rest. Automated extraction of invoice data uses an artificial-intelligence processing service that is likewise located in the EU.

Two things sit outside Numerio's own EU hosting:

• Stripe handles billing. Stripe's billing processing can involve limited transfers to its US parent company under the European Commission's Standard Contractual Clauses.
• Your Outlook or Gmail mailbox stays with your e-mail provider. Where that mailbox is hosted depends on the provider you chose and its settings, not on Numerio.

To get a copy of the safeguards that apply to such a transfer, write to hello@numerio.ai.

8. Who we share data with (sub-processors)

Numerio uses a small number of service providers (sub-processors) in order to deliver the service: OVHcloud for infrastructure and storage, Mistral AI SAS for document extraction, Brevo for transactional email, Stripe for billing and Plausible for website statistics. The full, specific list, with purpose, region and safeguards, is set out in our Data Processing Agreement (DPA), published at /dpa.

Your mailbox provider (Google for Gmail, Microsoft for Outlook) is not a Numerio sub-processor. You hold your own agreement with that provider, and Numerio reads the mailbox only under the access you grant and can revoke at any time.

We do not transfer data to third parties for marketing purposes and we do not sell it.

9. Your rights

As a data subject, you have the right under the GDPR to:

• access the data we process about you;
• rectify inaccurate data;
• request erasure of data (the “right to be forgotten”), subject to legal retention obligations;
• restrict processing;
• port your data (receive it in a structured, machine-readable format);
• object to processing based on legitimate interest;
• withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to hello@numerio.ai. We will respond no later than one month from receipt of the request.

10. Right to lodge a complaint

If you believe your data is being processed in breach of the GDPR, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI), L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, https://vdai.lrv.lt — or with the supervisory authority of any other EU Member State, if that is where you habitually reside or work.

11. If a data breach happens

If a personal data breach is likely to put your rights and freedoms at high risk, we will tell you directly and without undue delay: what happened, its likely consequences, and what we are doing about it. This is in addition to the notice we give the State Data Protection Inspectorate (VDAI) where the GDPR requires it. Where the breach concerns data we process for your business as a processor (section 1), we will inform your business without undue delay, as set out in the Data Processing Agreement.

12. Changes to this policy

This policy may be updated. We will publish material changes on this page with a new “Updated” date, and will notify registered users by email where a change materially affects them.

13. Contact

MB „Blue age lab", Saulėtekio al. 15-1, LT-10224 Vilnius, Lithuania
Tel. +370 5 208 0417 · email hello@numerio.ai