Privacy Policy
Last updated: 15 August 2026
1. Who we are
Virexa ("Virexa", "we", "us") operates the Virexa invoicing and tax service from Helsinki, Finland. Virexa is the data controller for the personal data described in this notice. For privacy questions, email support@virexainvoice.com.
2. Data we process
- Account data — name, email address, hashed password, language and preferences.
- Business data you create — invoices, customers, receipts and OCR results, mileage records, VAT figures, and chat history with the AI assistant.
- Support data — messages and attachments you send us.
- Usage and technical data — usage/telemetry, device identifiers, IP address and log data.
3. Purposes and legal basis
- Creating your account and providing the service, including subscription entitlements — performance of a contract.
- Customer support and service communications — contract / legitimate interests.
- Security, abuse and fraud prevention, and product improvement and analytics — legitimate interests.
- Marketing emails, where sent — consent, withdrawable at any time.
- Retaining records to meet Finnish bookkeeping and tax requirements — legal obligation.
4. AI processing
When you use the AI tax helper, your prompt and the relevant business data context are sent to a sub-processor (Lovable AI Gateway). Providers do not retain or use your prompts to train models.
5. Who we share data with
- Paddle.com Market Ltd — Merchant of Record. Paddle sells our subscriptions and handles checkout, payments, subscription management, tax compliance, invoicing, refunds and related customer service. When you purchase a plan, Paddle collects and processes your payment and billing details as its own controller under its privacy notice, and shares subscription status data with us so we can grant your plan. We never receive or store your full card details.
- Service providers / subprocessors — hosting and database (EU region), email delivery, AI inference, error monitoring and analytics tooling, acting on our instructions.
- Professional advisers — legal and accounting advisers where necessary.
- Authorities — where required by law or to defend legal claims.
We do not sell your personal data. Where data is transferred outside the EU/EEA (for example by a sub-processor), we rely on an adequacy decision or EU Standard Contractual Clauses together with appropriate additional safeguards.
6. How long we keep data
- Account and workspace data — for as long as your account is active, then deleted within 30 days of account deletion (backups purged within 90 days).
- Invoices, receipts and other accounting records — retained for the period required by Finnish bookkeeping law (currently 6 years from the end of the financial year).
- AI chat history — until you delete it, or with your account.
- Support correspondence — up to 24 months.
- Usage and security logs — up to 12 months.
When data is no longer needed for these purposes, it is deleted or irreversibly anonymised.
7. Security
We apply appropriate technical and organisational measures to protect your data: encryption in transit (TLS 1.2+) and at rest, hashed passwords, row-level access controls so each workspace can only reach its own records, least-privilege access for staff, EU-region hosting, audit logging, and regular backups. No system is perfectly secure, but we review these measures on an ongoing basis and will notify you and the supervisory authority of a qualifying personal data breach as required by the GDPR.
8. Your rights
You have the right to access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent. Many of these are available directly in your account; otherwise email support@virexainvoice.com and we will respond within one month. You may also lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) or your local supervisory authority.
9. Cookies
We use essential cookies and local storage for sign-in sessions, language and security. We use limited analytics storage to understand product usage, and Paddle sets cookies necessary to complete checkout. We do not use advertising cookies. You can clear or block cookies in your browser settings; essential cookies are required for the service to work.