Your privacy, in plain English.

ArveBot is operated by Healthview AI OÜ, registry code 14466724, at Sõpruse pst 202-1, 13416 Tallinn, Estonia. Email: hello@arvebot.com. We are the data controller for the website, accounts, waitlist and support messages.

• Viewing, instant invoice checks and invoice generation run in your browser. We do not receive those documents.
• If you choose the official KoSIT check, the invoice is processed temporarily on our EU server and deleted immediately after the result.
• For bank-statement conversion, your browser sends extracted text or page images to our EU-hosted service and Mistral AI. The content is used only to produce your result, is not stored by ArveBot and is not used for AI training.

• Account: email, language, account date, secure sign-in session and monthly usage count. We need this to provide your account.
• Waitlist: email, language and the feature or plan you selected. We use this with your consent to contact you about that request. You may leave at any time.
• Support: your email and message so we can reply and handle legal claims if necessary.
• Security and analytics: limited request information for security, rate limits and anonymous statistics in our self-hosted Umami system. We do not put document content or filenames in logs. Umami uses no tracking cookies and does not follow you across websites.
• Billing: if paid plans open, Stripe will handle payment details. ArveBot will store only the customer, subscription and transaction records needed for billing and law. Paid checkout is currently disabled.

Under the GDPR, account and tool data is needed to provide the service you request; billing records may be required by law; and limited support, security and anonymous analytics data is used for our legitimate interests in answering you, preventing abuse and improving ArveBot. Waitlist messages are based on your consent. An account email is required only if you choose to create an account, and joining a waitlist is optional.

ArveBot uses necessary storage to remember your language, keep you signed in, save generator details on your device and apply anonymous tool limits. You can remove local data in the tool or browser settings. We use no advertising or cross-site tracking cookies.

We use Hetzner for EU hosting, Mistral AI for bank-statement structuring, Brevo for sign-in emails, Stripe for future payments and GitHub for encrypted backups. Anonymous Umami statistics stay on our EU server. These providers receive only the data needed for their task. Core processing is in the EEA. If a provider processes limited data elsewhere, we use an EU adequacy decision or contractual safeguards. We do not sell personal data.

• Browser-only invoices are never received. KoSIT files are deleted immediately. Statement content lasts only for the live conversion request.
• Account data remains until you delete the account. Waitlist data remains until you withdraw, we contact you, or the waitlist is no longer needed.
• Encrypted database backups are kept for 14 days. Records that Estonian accounting law requires are kept for seven years. Other support and security data is deleted when no longer needed.

You may ask to see, correct, delete, restrict or receive your personal data. You may object to legitimate-interest processing or withdraw consent. You may also complain to the Estonian Data Protection Inspectorate or your local EEA authority. We do not make automated decisions with legal or similarly serious effects on you. We normally answer verified requests within one month.