This English version is a translation provided for convenience. The Estonian version is binding and prevails in case of any discrepancy: read the Estonian version
1Controller
VeebiNool OÜ (registry code 17304431), Ristiku 3, 72715 Paide, Järvamaa, Estonia.
E-mail: tugi@lepinski.ee
Phone: +372 5885 9220
No data protection officer has been appointed — the volume and nature of our processing do not require one. Please send all data protection enquiries to the e-mail address above.
2What data we collect
Account data. E-mail address and password (the password is kept only in encrypted form — we cannot see it). If you sign in with a Google account, we receive your e-mail address and name from Google; in that case no password is created.
Contract data. Everything you fill into the contract form: the parties' names, personal identification or registry codes, addresses, e-mail addresses, phone numbers, bank accounts (IBAN), representatives' names and roles, and the substantive terms of the contract (amounts, deadlines, descriptions). This is often another person's data — see “If you enter someone else's data” below.
Saved profiles. If you save your own or another party's details for next time, we keep them with your account until you delete them.
Uploaded files. Documents uploaded under “Fill in your own template” (.docx or .pdf) and the fields detected in them.
Checked contracts. Contract text pasted or uploaded under “Contract check”.
Payment data. Payments are made through Stripe. Card details never reach us — we see only the transaction reference and status.
Feedback and ratings. The content of the feedback form and satisfaction ratings.
3Why and on what basis we process it
To provide the service (contract, GDPR Art. 6(1)(b)). Creating an account, drafting a contract, generating the preview and the final file, sharing the contract with the other party to fill in, managing the subscription.
To comply with a legal obligation (Art. 6(1)(c)). Accounting and tax records for purchases.
On the basis of consent (Art. 6(1)(a)). The newsletter. You can withdraw your consent at any time — either on your profile page or through the link at the end of every e-mail. Withdrawal does not affect the lawfulness of processing before it.
On the basis of legitimate interest (Art. 6(1)(f)). Security of the service, preventing misuse and improving the service. We use statistics on purchases and contract types in aggregated form (e.g. which contract type is popular), not to profile individuals.
4To whom data is passed
We do not sell personal data or pass it to third parties for marketing purposes. To run the service we use the following processors:
- Supabase — account, database, uploaded files and sign-in.
- Vercel — web hosting and visitor statistics (the statistics are cookie-free and do not identify individual visitors).
- Stripe — payment processing.
- OpenAI — drafting the contract text, the contract check and form suggestions. See the separate warning below.
- Resend — sending e-mails (confirmations, a copy of the finished contract, notifications, the newsletter).
- Google — only if you choose to sign in with Google.
5Transfers of data outside the European Union
Drafting contracts, the contract check and form suggestions use OpenAI's service, whose servers are in the United States of America. This means that the contract text you draft or upload for checking travels outside the European Union for processing — together with all the names, codes and amounts it contains. The transfer is based on the European Commission's standard contractual clauses.
If a contract contains data you do not want sent outside the EU, do not use the contract check or AI suggestions on that document.
6If you enter someone else's data
A contract always has at least two parties, so you usually also enter the data of another person or company into the form. With regard to that data, you are the one who decides what is entered and why — we process it on your instructions. Please enter only the data needed to make the contract, and make sure you have the right to use it.
7How long data is kept
We keep the account and the data related to it for as long as the account exists. When the account is deleted, saved profiles, uploaded templates and contract drafts are deleted too.
We keep accounting documents (about purchases) for seven years, as the Accounting Act requires.
Shared filling links expire automatically. We will specify the exact retention periods of other data shortly.
9Your rights
You have the right:
- to find out what data of yours we process and to get a copy of it;
- to have inaccurate data corrected;
- to have data deleted when there is no longer a basis for processing it;
- to restrict processing or object to it;
- to take your data with you in machine-readable form;
- to withdraw your newsletter consent at any time.
To make a request, write to tugi@lepinski.ee. We will reply within one month at the latest.
If you believe we process your data unlawfully, you have the right to turn to the Data Protection Inspectorate.
10Changes
If we change this policy significantly, we will notify account holders by e-mail. Minor clarifications take effect on publication.